[^\.]*$)" | where isnull(extension) | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=5m Processes.process_name Processes.dest Processes.process_guid Processes.user | `drop_dm_object_name(Processes)`] | stats count min(_time) as firstTime max(_time) as lastTime by dest process_name process_guid file_name file_path file_create_time user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_without_extension_in_critical_folder_filter`
+[ESCU - Windows Gather Victim Network Info Through Ip Check Web Services - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies process that attempts to connect to a known IP web services. This technique is commonly used by trickbot and other malware to perform reconnaissance against the infected machine and look for its IP address.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1590.005", "T1590"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies process that attempts to connect to a known IP web services. This technique is commonly used by trickbot and other malware to perform reconnaissance against the infected machine and look for its IP address.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA.
+action.escu.known_false_positives = Filter internet browser application to minimize the false positive of this detection.
+action.escu.creation_date = 2022-06-21
+action.escu.modification_date = 2022-06-21
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Gather Victim Network Info Through Ip Check Web Services - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = process connecting IP location web services on $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 25}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Gather Victim Network Info Through Ip Check Web Services - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1590.005", "T1590"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `sysmon` EventCode=22 QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org", "*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net", "*iplogger.org*", "*ip-api.com*") | stats min(_time) as firstTime max(_time) as lastTime count by Image ProcessId QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_gather_victim_network_info_through_ip_check_web_services_filter`
+
[ESCU - Windows Get-AdComputer Unconstrained Delegation Discovery - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -31923,7 +32101,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Get-AdComputer Unconstrained Delegation Discovery - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
action.risk = 1
action.risk.param._risk_message = Suspicious PowerShell Get-ADComputer was identified on endpoint $ComputerName$
@@ -31969,7 +32147,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Hidden Schedule Task Settings - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["Industroyer2", "Active Directory Discovery"]
action.risk = 1
action.risk.param._risk_message = A schedule task with hidden setting enable in host $dest$
@@ -32015,7 +32193,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Hide Notification Features Through Registry - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Ransomware", "Windows Defense Evasion Tactics", "Windows Registry Abuse"]
action.risk = 1
action.risk.param._risk_message = Registry modification to hide windows notification on $dest$
@@ -32055,7 +32233,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows High File Deletion Frequency - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Clop Ransomware", "WhisperGate"]
action.risk = 1
action.risk.param._risk_message = High frequency file deletion activity detected on host $Computer$
@@ -32095,7 +32273,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Hunting System Account Targeting Lsass - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Credential Dumping"]
action.risk = 1
action.risk.param._risk_message = A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related to credential dumping on $dest$. Review for further details.
@@ -32120,6 +32298,86 @@ realtime_schedule = 0
is_visible = false
search = `sysmon` EventCode=10 TargetImage=*lsass.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hunting_system_account_targeting_lsass_filter`
+[ESCU - Windows Identify Protocol Handlers - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings). To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL in the property to limit the scope of this query to similar handlers as ms-msdt.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings). To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL in the property to limit the scope of this query to similar handlers as ms-msdt.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives will be found. https and http is a URL Protocol handler that will trigger this analytic. Tune based on process or command-line.
+action.escu.creation_date = 2022-07-11
+action.escu.modification_date = 2022-07-11
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Identify Protocol Handlers - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Living Off The Land"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing a protocol handler.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 6}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 6}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Identify Protocol Handlers - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 20, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process Name"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process_name Processes.process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | lookup windows_protocol_handlers handler AS process OUTPUT handler ishandler | where ishandler="TRUE" | `windows_identify_protocol_handlers_filter`
+
+[ESCU - Windows Impair Defense Add Xml Applocker Rules - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic is to identify a process that imports applocker xml policy using PowerShell commandlet. This technique was seen in Azorult malware where it drop an xml Applocker policy that will deny several AV products and further executed the PowerShell Applocker commandlet.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic is to identify a process that imports applocker xml policy using PowerShell commandlet. This technique was seen in Azorult malware where it drop an xml Applocker policy that will deny several AV products and further executed the PowerShell Applocker commandlet.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = Administrators may execute this command that may cause some false positive.
+action.escu.creation_date = 2022-06-24
+action.escu.modification_date = 2022-06-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Impair Defense Add Xml Applocker Rules - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = Applocker importing xml policy command was executed in $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Impair Defense Add Xml Applocker Rules - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` AND Processes.process="*Import-Module Applocker*" AND Processes.process="*Set-AppLockerPolicy *" AND Processes.process="* -XMLPolicy *" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_add_xml_applocker_rules_filter`
+
[ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -32135,7 +32393,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
action.risk = 1
action.risk.param._risk_message = Windows Defender context menu registry key deleted on $dest$.
@@ -32175,7 +32433,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Impair Defense Delete Win Defender Profile Registry - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
action.risk = 1
action.risk.param._risk_message = Windows Defender Logger registry key set to 'disabled' on $dest$.
@@ -32200,6 +32458,52 @@ realtime_schedule = 0
is_visible = false
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender" Registry.action = deleted by Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action Registry.user Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_delete_win_defender_profile_registry_filter`
+[ESCU - Windows Impair Defense Deny Security Software With Applocker - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies a modification in the Windows registry by the Applocker utility that contains details or registry data values related to denying the execution of several security products. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV products and then loaded by using PowerShell Applocker commandlet.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies a modification in the Windows registry by the Applocker utility that contains details or registry data values related to denying the execution of several security products. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV products and then loaded by using PowerShell Applocker commandlet.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = False positives may be present based on organization use of Applocker. Filter as needed.
+action.escu.creation_date = 2022-06-24
+action.escu.modification_date = 2022-06-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Impair Defense Deny Security Software With Applocker - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = Applocker registry modification to deny the action of several AV products on $dest$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 100}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Impair Defense Deny Security Software With Applocker - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies a modification in the Windows registry by the Applocker utility that contains details or registry data values related to denying the execution of several security products. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV products and then loaded by using PowerShell Applocker commandlet.
+action.notable.param.rule_title = Windows Impair Defense Deny Security Software With Applocker
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy Objects\\*" AND Registry.registry_path= "*}Machine\\Software\\Policies\\Microsoft\\Windows\\SrpV2*") OR Registry.registry_path="*\\Software\\Policies\\Microsoft\\Windows\\SrpV2*" AND Registry.registry_value_data = "*Action\=\"Deny\"*" AND Registry.registry_value_data IN("*O=SYMANTEC*","*O=MCAFEE*","*O=KASPERSKY*","*O=BLEEPING COMPUTER*", "*O=PANDA SECURITY*","*O=SYSTWEAK SOFTWARE*", "*O=TREND MICRO*", "*O=AVAST*", "*O=GRIDINSOFT*", "*O=MICROSOFT*", "*O=NANO SECURITY*", "*O=SUPERANTISPYWARE.COM*", "*O=DOCTOR WEB*", "*O=MALWAREBYTES*", "*O=ESET*", "*O=AVIRA*", "*O=WEBROOT*") by Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.registry_key_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_deny_security_software_with_applocker_filter`
+
[ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -32215,7 +32519,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
action.risk = 1
action.risk.param._risk_message = Windows Defender Logger registry key set to 'disabled' on $dest$.
@@ -32255,7 +32559,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Indirect Command Execution Via forfiles - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Living Off The Land"]
action.risk = 1
action.risk.param._risk_message = The Program Compatability Assistant (pcalua.exe) launched the process $process_name$
@@ -32301,7 +32605,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Indirect Command Execution Via pcalua - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Living Off The Land"]
action.risk = 1
action.risk.param._risk_message = The Program Compatability Assistant (pcalua.exe) launched the process $process_name$
@@ -32353,7 +32657,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows InstallUtil Credential Theft - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Signed Binary Proxy Execution InstallUtil"]
action.risk = 1
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ loading samlib.dll and vaultcli.dll to potentially capture credentials in memory.
@@ -32402,7 +32706,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows InstallUtil in Non Standard Path - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Masquerading - Rename System Utilities", "Unusual Processes", "Ransomware", "Signed Binary Proxy Execution InstallUtil", "WhisperGate", "Living Off The Land"]
action.risk = 1
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$.
@@ -32454,7 +32758,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows InstallUtil Remote Network Connection - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"]
action.risk = 1
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ generating a remote download.
@@ -32511,7 +32815,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows InstallUtil Uninstall Option - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"]
action.risk = 1
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall.
@@ -32569,7 +32873,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows InstallUtil Uninstall Option with Network - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"]
action.risk = 1
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall.
@@ -32625,7 +32929,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows InstallUtil URL in Command Line - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"]
action.risk = 1
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ passing a URL on the command-line.
@@ -32680,7 +32984,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Invalid Users Failed Authentication via Kerberos - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["Active Directory Password Spraying", "Active Directory Kerberos Attacks"]
action.risk = 1
action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$
@@ -32720,7 +33024,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows ISO LNK File Creation - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Spearphishing Attachments"]
action.risk = 1
action.risk.param._risk_message = An ISO file was mounted on $dest$ and should be reviewed and filtered as needed.
@@ -32760,7 +33064,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Kerberos Local Successful Logon - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["Active Directory Kerberos Attacks", "Local Privilege Escalation With KrbRelayUp"]
action.risk = 1
action.risk.param._risk_message = A successful localhost Kerberos authentication event occurred on $dest$, possibly indicative of Kerberos relay attack.
@@ -32806,7 +33110,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows KrbRelayUp Service Creation - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Local Privilege Escalation With KrbRelayUp"]
action.risk = 1
action.risk.param._risk_message = A service was created on $dest$, related to KrbRelayUp.
@@ -32852,7 +33156,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Linked Policies In ADSI Discovery - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["Industroyer2", "Active Directory Discovery"]
action.risk = 1
action.risk.param._risk_message = powershell process having commandline $Message$ for user enumeration
@@ -32877,6 +33181,298 @@ realtime_schedule = 0
is_visible = false
search = `powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=organizationalunit*" ScriptBlockText = "*findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_linked_policies_in_adsi_discovery_filter`
+[ESCU - Windows Modify Registry Disable Toast Notifications - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic is to identify a modification in the Windows registry to disable toast notifications. This Windows Operating System feature is responsible for alerting or notifying user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion and execution.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic is to identify a modification in the Windows registry to disable toast notifications. This Windows Operating System feature is responsible for alerting or notifying user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion and execution.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+action.escu.creation_date = 2022-06-22
+action.escu.modification_date = 2022-06-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Modify Registry Disable Toast Notifications - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = the registry for DisallowRun settings was modified to enable in $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Modify Registry Disable Toast Notifications - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*" Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_toast_notifications_filter`
+
+[ESCU - Windows Modify Registry Disable Win Defender Raw Write Notif - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies a modification in the Windows registry to disable Windows Defender raw write notification feature. This policy controls whether raw volume write notifications are sent to behavior monitoring or not. This registry was recently identified in Azorult malware to bypass Windows Defender detections or behavior monitoring in terms of volume write.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies a modification in the Windows registry to disable Windows Defender raw write notification feature. This policy controls whether raw volume write notifications are sent to behavior monitoring or not. This registry was recently identified in Azorult malware to bypass Windows Defender detections or behavior monitoring in terms of volume write.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = Administrators may enable or disable this feature that may cause some false positive. Filter as needed.
+action.escu.creation_date = 2022-06-23
+action.escu.modification_date = 2022-06-23
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Modify Registry Disable Win Defender Raw Write Notif - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = The registry for raw write notification settings was modified to disable in $dest$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Modify Registry Disable Win Defender Raw Write Notif - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Real-Time Protection\\DisableRawWriteNotification*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_win_defender_raw_write_notif_filter`
+
+[ESCU - Windows Modify Registry Disable Windows Security Center Notif - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic is to identify a modification in the Windows registry to disable windows center notifications. This Windows Operating System feature is responsible for alerting or notifying user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion and execution.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic is to identify a modification in the Windows registry to disable windows center notifications. This Windows Operating System feature is responsible for alerting or notifying user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion and execution.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+action.escu.creation_date = 2022-06-22
+action.escu.modification_date = 2022-06-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Modify Registry Disable Windows Security Center Notif - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = the registry for security center notification settings was modified to disable mode in $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Modify Registry Disable Windows Security Center Notif - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*" Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_windows_security_center_notif_filter`
+
+[ESCU - Windows Modify Registry Disabling WER Settings - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies a modification in the Windows registry to disable Windows error reporting settings. This Windows feature allows the user to report bugs, errors, failure or problems encountered in specific application or processes. Adversaries use this technique to hide any error or failure that some of its malicious components trigger.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies a modification in the Windows registry to disable Windows error reporting settings. This Windows feature allows the user to report bugs, errors, failure or problems encountered in specific application or processes. Adversaries use this technique to hide any error or failure that some of its malicious components trigger.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed.
+action.escu.creation_date = 2022-06-22
+action.escu.modification_date = 2022-06-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Modify Registry Disabling WER Settings - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = the registry for WER settings was modified to be disabled on $dest$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Modify Registry Disabling WER Settings - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies a modification in the Windows registry to disable Windows error reporting settings. This Windows feature allows the user to report bugs, errors, failure or problems encountered in specific application or processes. Adversaries use this technique to hide any error or failure that some of its malicious components trigger.
+action.notable.param.rule_title = Windows Modify Registry Disabling WER Settings
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\disable*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disabling_wer_settings_filter`
+
+[ESCU - Windows Modify Registry DisAllow Windows App - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies modification in the Windows registry to prevent user running specific computer programs that could aid them in manually removing malware or detecting it using security products. This technique was recently identified in Azorult malware where it uses this registry value to prevent several AV products to execute on the compromised host machine.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies modification in the Windows registry to prevent user running specific computer programs that could aid them in manually removing malware or detecting it using security products. This technique was recently identified in Azorult malware where it uses this registry value to prevent several AV products to execute on the compromised host machine.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = Administrators may enable or disable this feature that may cause some false positive. Filter as needed.
+action.escu.creation_date = 2022-06-22
+action.escu.modification_date = 2022-06-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Modify Registry DisAllow Windows App - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = The registry for DisallowRun settings was modified to enable in $dest$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Modify Registry DisAllow Windows App - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies modification in the Windows registry to prevent user running specific computer programs that could aid them in manually removing malware or detecting it using security products. This technique was recently identified in Azorult malware where it uses this registry value to prevent several AV products to execute on the compromised host machine.
+action.notable.param.rule_title = Windows Modify Registry DisAllow Windows App
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disallow_windows_app_filter`
+
+[ESCU - Windows Modify Registry Regedit Silent Reg Import - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies modification of Windows registry using regedit.exe application with silent mode parameter. regedit.exe windows application is commonly used as GUI app to check or modify registry. This application is also has undocumented command-line parameter and one of those are silent mode parameter that performs action without stopping for confirmation with dialog box. Importing registry from .reg files need to monitor in a production environment since it can be used adversaries to import RMS registry in compromised host.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies modification of Windows registry using regedit.exe application with silent mode parameter. regedit.exe windows application is commonly used as GUI app to check or modify registry. This application is also has undocumented command-line parameter and one of those are silent mode parameter that performs action without stopping for confirmation with dialog box. Importing registry from .reg files need to monitor in a production environment since it can be used adversaries to import RMS registry in compromised host.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = Administrators may execute this command that may cause some false positive. Filter as needed.
+action.escu.creation_date = 2022-06-24
+action.escu.modification_date = 2022-06-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Modify Registry Regedit Silent Reg Import - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = The regedit app was executed with silet mode parameter to import .reg file on $dest$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Modify Registry Regedit Silent Reg Import - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="regedit.exe" OR Processes.original_file_name="regedit.exe") AND Processes.process="* /s *" AND Processes.process="*.reg*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_regedit_silent_reg_import_filter`
+
+[ESCU - Windows Modify Registry Suppress Win Defender Notif - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic is to identify a modification in the Windows registry to suppress windows defender notification. This technique was abuse by adversaries and threat actor to bypassed windows defender on the targeted host. Azorult malware is one of the malware use this technique that also disable toast notification and other windows features as part of its malicious behavior.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic is to identify a modification in the Windows registry to suppress windows defender notification. This technique was abuse by adversaries and threat actor to bypassed windows defender on the targeted host. Azorult malware is one of the malware use this technique that also disable toast notification and other windows features as part of its malicious behavior.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+action.escu.creation_date = 2022-06-22
+action.escu.modification_date = 2022-06-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Modify Registry Suppress Win Defender Notif - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = the registry for suppresing windows fdefender notification settings was modified to disabled in $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Modify Registry Suppress Win Defender Notif - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\UX Configuration\\Notification_Suppress*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_suppress_win_defender_notif_filter`
+
[ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -32892,7 +33488,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Data Destruction", "Windows Defense Evasion Tactics", "Hermetic Wiper", "Windows Registry Abuse"]
action.risk = 1
action.risk.param._risk_message = Registry modification in "ShowCompColor" and "ShowInfoTips" on $dest$
@@ -32923,6 +33519,52 @@ realtime_schedule = 0
is_visible = false
search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*" AND Registry.registry_value_name IN("ShowCompColor", "ShowInfoTip") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `windows_modify_show_compress_color_and_info_tip_registry_filter`
+[ESCU - Windows MOF Event Triggered Execution via WMI - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following anaytic identifies MOFComp.exe loading a MOF file. The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Typically, MOFComp.exe does not reach out to the public internet or load a MOF file from User Profile paths. A filter and consumer is typically registered in WMI. Review parallel processes and query WMI subscriptions to gather artifacts. The default path of mofcomp.exe is C:\Windows\System32\wbem.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following anaytic identifies MOFComp.exe loading a MOF file. The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Typically, MOFComp.exe does not reach out to the public internet or load a MOF file from User Profile paths. A filter and consumer is typically registered in WMI. Review parallel processes and query WMI subscriptions to gather artifacts. The default path of mofcomp.exe is C:\Windows\System32\wbem.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives may be present from automation based applications (SCCM), filtering may be required. In addition, break the query out based on volume of usage. Filter process names or f
+action.escu.creation_date = 2022-07-15
+action.escu.modification_date = 2022-07-15
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows MOF Event Triggered Execution via WMI - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Living Off The Land"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ loading a MOF file.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows MOF Event Triggered Execution via WMI - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following anaytic identifies MOFComp.exe loading a MOF file. The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Typically, MOFComp.exe does not reach out to the public internet or load a MOF file from User Profile paths. A filter and consumer is typically registered in WMI. Review parallel processes and query WMI subscriptions to gather artifacts. The default path of mofcomp.exe is C:\Windows\System32\wbem.
+action.notable.param.rule_title = Windows MOF Event Triggered Execution via WMI
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name IN ("cmd.exe", "powershell.exe") Processes.process_name=mofcomp.exe) OR (Processes.process_name=mofcomp.exe Processes.process IN ("*\\AppData\\Local\\*","*\\Users\\Public\\*", "*\\WINDOWS\\Temp\\*")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mof_event_triggered_execution_via_wmi_filter`
+
[ESCU - Windows MSIExec DLLRegisterServer - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -32938,7 +33580,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows MSIExec DLLRegisterServer - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Windows System Binary Proxy Execution MSIExec"]
action.risk = 1
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a file.
@@ -32984,7 +33626,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows MSIExec Remote Download - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Windows System Binary Proxy Execution MSIExec"]
action.risk = 1
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a remote file.
@@ -33030,7 +33672,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows MSIExec Spawn Discovery Command - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Windows System Binary Proxy Execution MSIExec"]
action.risk = 1
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running different discovery commands.
@@ -33076,7 +33718,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows MSIExec Unregister DLLRegisterServer - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Windows System Binary Proxy Execution MSIExec"]
action.risk = 1
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to unregister a file.
@@ -33122,7 +33764,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows MSIExec With Network Connections - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Windows System Binary Proxy Execution MSIExec"]
action.risk = 1
action.risk.param._risk_message = An instance of $process_name$ was identified on endpoint $dest$ contacting a remote destination.
@@ -33168,7 +33810,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows NirSoft AdvancedRun - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Unusual Processes", "Ransomware", "WhisperGate"]
action.risk = 1
action.risk.param._risk_message = An instance of advancedrun.exe, $process_name$, was spawned by $parent_process_name$ on $dest$ by $user$.
@@ -33214,7 +33856,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows NirSoft Utilities - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["WhisperGate"]
action.risk = 1
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to NiRSoft software usage.
@@ -33254,7 +33896,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Non-System Account Targeting Lsass - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Credential Dumping"]
action.risk = 1
action.risk.param._risk_message = A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related to credential dumping on $dest$. Review for further details.
@@ -33285,6 +33927,138 @@ realtime_schedule = 0
is_visible = false
search = `sysmon` EventCode=10 TargetImage=*lsass.exe SourceUser!="NT AUTHORITY\\*" | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_non_system_account_targeting_lsass_filter`
+[ESCU - Windows Odbcconf Hunting - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies Odbcconf.exe running in the environment to assist with identifying tuning higher fidelity analytics related to Odbcconf.exe.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.008"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies Odbcconf.exe running in the environment to assist with identifying tuning higher fidelity analytics related to Odbcconf.exe.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives will be present as this is meant to assist with filtering and tuning.
+action.escu.creation_date = 2022-06-30
+action.escu.modification_date = 2022-06-30
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Odbcconf Hunting - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Living Off The Land"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 6}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 6}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Odbcconf Hunting - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 20, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.008"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process Name"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_hunting_filter`
+
+[ESCU - Windows Odbcconf Load DLL - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies odbcconf.exe, Windows Open Database Connectivity utility, utilizing the action function of regsvr to load a DLL. An example will look like - odbcconf.exe /A { REGSVR T1218-2.dll }. During triage, review parent process, parallel procesess and file modifications.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.008"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies odbcconf.exe, Windows Open Database Connectivity utility, utilizing the action function of regsvr to load a DLL. An example will look like - odbcconf.exe /A { REGSVR T1218-2.dll }. During triage, review parent process, parallel procesess and file modifications.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed.
+action.escu.creation_date = 2022-06-28
+action.escu.modification_date = 2022-06-28
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Odbcconf Load DLL - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Living Off The Land"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Odbcconf Load DLL - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.008"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process Name"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies odbcconf.exe, Windows Open Database Connectivity utility, utilizing the action function of regsvr to load a DLL. An example will look like - odbcconf.exe /A { REGSVR T1218-2.dll }. During triage, review parent process, parallel procesess and file modifications.
+action.notable.param.rule_title = Windows Odbcconf Load DLL
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe Processes.process IN ("*/a *", "*-a*") Processes.process="*regsvr*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_load_dll_filter`
+
+[ESCU - Windows Odbcconf Load Response File - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the odbcconf.exe, Windows Open Database Connectivity utility, loading up a resource file. The file extension is arbitrary and may be named anything. The resource file itself may have different commands supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. During triage, review file modifications and parallel processes.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.008"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies the odbcconf.exe, Windows Open Database Connectivity utility, loading up a resource file. The file extension is arbitrary and may be named anything. The resource file itself may have different commands supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. During triage, review file modifications and parallel processes.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed.
+action.escu.creation_date = 2022-06-30
+action.escu.modification_date = 2022-06-30
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Odbcconf Load Response File - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Living Off The Land"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Odbcconf Load Response File - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.008"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process Name"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the odbcconf.exe, Windows Open Database Connectivity utility, loading up a resource file. The file extension is arbitrary and may be named anything. The resource file itself may have different commands supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. During triage, review file modifications and parallel processes.
+action.notable.param.rule_title = Windows Odbcconf Load Response File
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe Processes.process IN ("*-f *","*/f *") Processes.process="*.rsp*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_load_response_file_filter`
+
[ESCU - Windows Office Product Spawning MSDT - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -33300,7 +34074,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Office Product Spawning MSDT - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Spearphishing Attachments", "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"]
action.risk = 1
action.risk.param._risk_message = Office parent process $parent_process_name$ has spawned a child process $process_name$ on host $dest$.
@@ -33354,7 +34128,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Possible Credential Dumping - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack", "DarkSide Ransomware"]
action.risk = 1
action.risk.param._risk_message = A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related to credential dumping on $dest$. Review for further details.
@@ -33389,6 +34163,52 @@ realtime_schedule = 0
is_visible = false
search = `sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_possible_credential_dumping_filter`
+[ESCU - Windows Powershell Import Applocker Policy - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic is to identify the imports of Windows PowerShell Applocker commandlets. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV product and then loaded using PowerShell Applocker commandlet.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic is to identify the imports of Windows PowerShell Applocker commandlets. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV product and then loaded using PowerShell Applocker commandlet.
+action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+action.escu.known_false_positives = administrators may execute this command that may cause some false positive.
+action.escu.creation_date = 2022-06-30
+action.escu.modification_date = 2022-06-30
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Powershell Import Applocker Policy - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = A PowerShell script contains Import Applocker Policy command $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Powershell Import Applocker Policy - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic is to identify the imports of Windows PowerShell Applocker commandlets. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV product and then loaded using PowerShell Applocker commandlet.
+action.notable.param.rule_title = Windows Powershell Import Applocker Policy
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `powershell` EventCode=4104 ScriptBlockText="*Import-Module Applocker*" ScriptBlockText="*Set-AppLockerPolicy *" ScriptBlockText="* -XMLPolicy *" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_import_applocker_policy_filter`
+
[ESCU - Windows PowerView Constrained Delegation Discovery - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -33404,7 +34224,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows PowerView Constrained Delegation Discovery - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
action.risk = 1
action.risk.param._risk_message = Suspicious PowerShell Get-DomainComputer was identified on endpoint $ComputerName$
@@ -33450,10 +34270,10 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows PowerView Kerberos Service Ticket Request - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
action.risk = 1
-action.risk.param._risk_message = PowerView commandlets used for requesting SPN service ticket executed on $Computer_Name$
+action.risk.param._risk_message = PowerView commandlets used for requesting SPN service ticket executed on $Computer$
action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 27}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
@@ -33479,7 +34299,7 @@ relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
-search = `powershell` EventCode=4104 Message=*Get-DomainSPNTicket* | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powerview_kerberos_service_ticket_request_filter`
+search = `powershell` EventCode=4104 ScriptBlockText=*Get-DomainSPNTicket* | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powerview_kerberos_service_ticket_request_filter`
[ESCU - Windows PowerView SPN Discovery - Rule]
action.escu = 0
@@ -33496,10 +34316,10 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows PowerView SPN Discovery - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
action.risk = 1
-action.risk.param._risk_message = PowerView commandlets used for SPN discovery executed on $Computer_Name$
+action.risk.param._risk_message = PowerView commandlets used for SPN discovery executed on $Computer$
action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 27}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
@@ -33542,7 +34362,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows PowerView Unconstrained Delegation Discovery - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
action.risk = 1
action.risk.param._risk_message = Suspicious PowerShell Get-DomainComputer was identified on endpoint $ComputerName$
@@ -33588,7 +34408,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Process With NamedPipe CommandLine - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
action.risk = 1
action.risk.param._risk_message = Process with named pipe in $process$ on $dest$
@@ -33628,7 +34448,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Processes Killed By Industroyer2 Malware - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Industroyer2"]
action.risk = 1
action.risk.param._risk_message = process was terminated $process_name$ in $dest$
@@ -33668,7 +34488,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Raccine Scheduled Task Deletion - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Ransomware"]
action.risk = 1
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user user$ attempting to disable Raccines scheduled task.
@@ -33714,7 +34534,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Rasautou DLL Execution - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
action.risk = 1
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner.
@@ -33760,7 +34580,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Raw Access To Disk Volume Partition - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Caddy Wiper", "Data Destruction", "Hermetic Wiper"]
action.risk = 1
action.risk.param._risk_message = Process accessing disk partition $device$ in $dest$
@@ -33800,7 +34620,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Raw Access To Master Boot Record Drive - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Data Destruction", "Caddy Wiper", "WhisperGate", "Hermetic Wiper"]
action.risk = 1
action.risk.param._risk_message = process accessing MBR $device$ in $dest$
@@ -33846,7 +34666,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Registry Certificate Added - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Windows Drivers", "Windows Registry Abuse"]
action.risk = 1
action.risk.param._risk_message = A root certificate was added on $dest$.
@@ -33892,7 +34712,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Registry Delete Task SD - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Windows Registry Abuse", "Windows Persistence Techniques"]
action.risk = 1
action.risk.param._risk_message = A scheduled task security descriptor was deleted from the registry on $dest$.
@@ -33938,7 +34758,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Registry Modification for Safe Mode Persistence - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Ransomware", "Windows Registry Abuse", "Windows Drivers"]
action.risk = 1
action.risk.param._risk_message = Safeboot registry $registry_path$ was added or modified with a new value $registry_value_name$ on $dest$
@@ -33969,6 +34789,52 @@ realtime_schedule = 0
is_visible = false
search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path IN ("*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\*","*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\*") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | join process_guid _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)`] | table _time dest user process_name process process_guid registry_path registry_value_name registry_value_data registry_key_name | `windows_registry_modification_for_safe_mode_persistence_filter`
+[ESCU - Windows Remote Access Software RMS Registry - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic is to identify a modification or creation of Windows registry related to the Remote Manipulator System (RMS) Remote Admin tool. RMS is a legitimate tool developed by russian organization TektonIT and has been observed being abused by adversaries to gain remote access to the targeted host. Azorult malware utilized RMS to gain remote access.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1219"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic is to identify a modification or creation of Windows registry related to the Remote Manipulator System (RMS) Remote Admin tool. RMS is a legitimate tool developed by russian organization TektonIT and has been observed being abused by adversaries to gain remote access to the targeted host. Azorult malware utilized RMS to gain remote access.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+action.escu.creation_date = 2022-06-22
+action.escu.modification_date = 2022-06-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Remote Access Software RMS Registry - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = the registry related to RMS tool is created in $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Remote Access Software RMS Registry - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1219"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic is to identify a modification or creation of Windows registry related to the Remote Manipulator System (RMS) Remote Admin tool. RMS is a legitimate tool developed by russian organization TektonIT and has been observed being abused by adversaries to gain remote access to the targeted host. Azorult malware utilized RMS to gain remote access.
+action.notable.param.rule_title = Windows Remote Access Software RMS Registry
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SYSTEM\\Remote Manipulator System*" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_access_software_rms_registry_filter`
+
[ESCU - Windows Remote Assistance Spawning Process - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -33984,7 +34850,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Remote Assistance Spawning Process - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Unusual Processes"]
action.risk = 1
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, generating behavior not common with msra.exe.
@@ -34015,6 +34881,178 @@ realtime_schedule = 0
is_visible = false
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msra.exe `windows_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_assistance_spawning_process_filter`
+[ESCU - Windows Remote Service Rdpwinst Tool Execution - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies RDPWInst.exe tool, which is a RDP wrapper library tool designed to enable remote desktop host support and concurrent RDP session on reduced functionality system. Unfortunately, this open project was abused by adversaries to enable RDP connection to the targeted host for remote access and potentially be for lateral movement.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies RDPWInst.exe tool, which is a RDP wrapper library tool designed to enable remote desktop host support and concurrent RDP session on reduced functionality system. Unfortunately, this open project was abused by adversaries to enable RDP connection to the targeted host for remote access and potentially be for lateral movement.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = This tool was designed for home usage and not commonly seen in production environment. Filter as needed.
+action.escu.creation_date = 2022-06-24
+action.escu.modification_date = 2022-06-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Remote Service Rdpwinst Tool Execution - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = Rdpwinst.exe executed on $dest$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Remote Service Rdpwinst Tool Execution - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies RDPWInst.exe tool, which is a RDP wrapper library tool designed to enable remote desktop host support and concurrent RDP session on reduced functionality system. Unfortunately, this open project was abused by adversaries to enable RDP connection to the targeted host for remote access and potentially be for lateral movement.
+action.notable.param.rule_title = Windows Remote Service Rdpwinst Tool Execution
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="RDPWInst.exe" OR Processes.original_file_name="RDPWInst.exe") AND Processes.process IN ("* -i*", "* -s*", "* -o*", "* -w*", "* -r*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_service_rdpwinst_tool_execution_filter`
+
+[ESCU - Windows Remote Services Allow Rdp In Firewall - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic is to identify a modification in the Windows firewall to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer to remotely access the compromised or targeted host by allowing this protocol in firewall. Even this protocol might be allowed in some production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through firewall which is also common traits of attack to start lateral movement.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic is to identify a modification in the Windows firewall to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer to remotely access the compromised or targeted host by allowing this protocol in firewall. Even this protocol might be allowed in some production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through firewall which is also common traits of attack to start lateral movement.
+action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+action.escu.known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+action.escu.creation_date = 2022-06-21
+action.escu.modification_date = 2022-06-21
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Remote Services Allow Rdp In Firewall - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = new firewall rules was added to allow rdp connection to $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Remote Services Allow Rdp In Firewall - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "netsh.exe" OR Processes.original_file_name= "netsh.exe") AND Processes.process = "*firewall*" AND Processes.process = "*add*" AND Processes.process = "*protocol=TCP*" AND Processes.process = "*localport=3389*" AND Processes.process = "*action=allow*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_services_allow_rdp_in_firewall_filter`
+
+[ESCU - Windows Remote Services Allow Remote Assistance - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic is to identify a modification in the Windows registry to enable remote desktop assistance on a targeted machine. This technique was seen in several adversaries, malware or red teamer like azorult to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This Anomaly behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common. And as per stated in microsoft documentation the default value of this registry is false that makes this a good indicator of suspicious behavior.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic is to identify a modification in the Windows registry to enable remote desktop assistance on a targeted machine. This technique was seen in several adversaries, malware or red teamer like azorult to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This Anomaly behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common. And as per stated in microsoft documentation the default value of this registry is false that makes this a good indicator of suspicious behavior.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+action.escu.creation_date = 2022-06-21
+action.escu.modification_date = 2022-06-21
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Remote Services Allow Remote Assistance - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = the registry for rdp protocol was modified to enable in $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Remote Services Allow Remote Assistance - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal Server\\fAllowToGetHelp*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_services_allow_remote_assistance_filter`
+
+[ESCU - Windows Remote Services Rdp Enable - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic is to identify a modification in the Windows registry to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic is to identify a modification in the Windows registry to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+action.escu.creation_date = 2022-06-21
+action.escu.modification_date = 2022-06-21
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Remote Services Rdp Enable - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = the registry for rdp protocol was modified to enable in $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Remote Services Rdp Enable - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic is to identify a modification in the Windows registry to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common.
+action.notable.param.rule_title = Windows Remote Services Rdp Enable
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_services_rdp_enable_filter`
+
[ESCU - Windows Root Domain linked policies Discovery - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -34030,7 +35068,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Root Domain linked policies Discovery - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["Industroyer2", "Active Directory Discovery"]
action.risk = 1
action.risk.param._risk_message = powershell process having commandline $Message$ for user enumeration
@@ -34070,7 +35108,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Schtasks Create Run As System - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Windows Persistence Techniques"]
action.risk = 1
action.risk.param._risk_message = An $process_name$ was created on endpoint $dest$ attempting to spawn as SYSTEM.
@@ -34116,7 +35154,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Security Account Manager Stopped - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Ryuk Ransomware"]
action.risk = 1
action.risk.param._risk_message = The Windows Security Account Manager (SAM) was stopped via cli by $user$ on $dest$ by this command: $processs$
@@ -34162,7 +35200,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Service Create Kernel Mode Driver - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Windows Drivers"]
action.risk = 1
action.risk.param._risk_message = Service control, $process_name$, loaded a new kernel mode driver on $dest$ by $user$.
@@ -34208,7 +35246,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Service Created With Suspicious Service Path - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Clop Ransomware", "Active Directory Lateral Movement"]
action.risk = 1
action.risk.param._risk_message = A service $Service_File_Name$ was created from a non-standard path using $Service_Name$
@@ -34254,7 +35292,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Service Created Within Public Path - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Active Directory Lateral Movement"]
action.risk = 1
action.risk.param._risk_message = A Windows Service $Service_File_Name$ with a public path was created on $ComputerName
@@ -34300,7 +35338,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Service Creation on Remote Endpoint - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Active Directory Lateral Movement"]
action.risk = 1
action.risk.param._risk_message = A Windows Service was created on a remote endpoint from $dest
@@ -34346,7 +35384,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Service Creation Using Registry Entry - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Active Directory Lateral Movement", "Suspicious Windows Registry Activities", "Windows Persistence Techniques", "Windows Registry Abuse"]
action.risk = 1
action.risk.param._risk_message = A Windows Service was created on a endpoint from $dest$
@@ -34392,7 +35430,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Service Initiation on Remote Endpoint - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Active Directory Lateral Movement"]
action.risk = 1
action.risk.param._risk_message = A Windows Service was started on a remote endpoint from $dest
@@ -34423,6 +35461,52 @@ realtime_schedule = 0
is_visible = false
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe OR Processes.original_file_name=sc.exe) (Processes.process=*\\\\* AND Processes.process=*start*) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_initiation_on_remote_endpoint_filter`
+[ESCU - Windows Service Stop By Deletion - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue there objective and evade detections.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue there objective and evade detections.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+action.escu.known_false_positives = It is possible administrative scripts may start/stop/delete services. Filter as needed.
+action.escu.creation_date = 2022-06-21
+action.escu.modification_date = 2022-06-21
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Service Stop By Deletion - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to delete a service.
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Service Stop By Deletion - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "nist": ["DE.CM"], "observable": [{"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue there objective and evade detections.
+action.notable.param.rule_title = Windows Service Stop By Deletion
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = sc.exe OR Processes.original_file_name = sc.exe) Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_stop_by_deletion_filter`
+
[ESCU - Windows System File on Disk - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -34438,7 +35522,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows System File on Disk - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Windows Drivers"]
action.risk = 1
action.risk.param._risk_message = A new driver is present on $dest$.
@@ -34478,7 +35562,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Terminating Lsass Process - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Double Zero Destructor"]
action.risk = 1
action.risk.param._risk_message = a process $SourceImage$ terminates Lsass process in $dest$
@@ -34524,7 +35608,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Users Authenticate Using Explicit Credentials - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["Active Directory Password Spraying", "Insider Threat"]
action.risk = 1
action.risk.param._risk_message = Potential password spraying attack from $ComputerName$
@@ -34549,6 +35633,52 @@ realtime_schedule = 0
is_visible = false
search = `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1) | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `windows_users_authenticate_using_explicit_credentials_filter`
+[ESCU - Windows Valid Account With Never Expires Password - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies net.exe updating user account policies for password requirement with non-expiring password. This technique was seen in several adversaries and malware like Azorult to maintain the foothold (persistence), gaining privilege escalation, defense evasion and possible for lateral movement for specific users or created user account on the targeted host. This TTP detections is a good pivot to see further what other events that users executes on the machines.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies net.exe updating user account policies for password requirement with non-expiring password. This technique was seen in several adversaries and malware like Azorult to maintain the foothold (persistence), gaining privilege escalation, defense evasion and possible for lateral movement for specific users or created user account on the targeted host. This TTP detections is a good pivot to see further what other events that users executes on the machines.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+action.escu.known_false_positives = This behavior is not commonly seen in production environment and not advisable, filter as needed.
+action.escu.creation_date = 2022-06-23
+action.escu.modification_date = 2022-06-23
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Valid Account With Never Expires Password - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to make non-expiring password on host user accounts.
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Valid Account With Never Expires Password - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Persistence"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "nist": ["DE.CM"], "observable": [{"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies net.exe updating user account policies for password requirement with non-expiring password. This technique was seen in several adversaries and malware like Azorult to maintain the foothold (persistence), gaining privilege escalation, defense evasion and possible for lateral movement for specific users or created user account on the targeted host. This TTP detections is a good pivot to see further what other events that users executes on the machines.
+action.notable.param.rule_title = Windows Valid Account With Never Expires Password
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="* accounts *" AND Processes.process="* /maxpwage:unlimited" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_valid_account_with_never_expires_password_filter`
+
[ESCU - Windows WMI Process Call Create - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -34564,7 +35694,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows WMI Process Call Create - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Suspicious WMI Use"]
action.risk = 1
action.risk.param._risk_message = process with $process$ commandline executed in $dest$
@@ -34612,7 +35742,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"]
action.risk = 1
action.risk.param._risk_message = A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$
@@ -34670,7 +35800,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - WinEvent Scheduled Task Created Within Public Path - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware", "IcedID", "Active Directory Lateral Movement", "Industroyer2"]
action.risk = 1
action.risk.param._risk_message = A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$
@@ -34720,7 +35850,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["IcedID", "Windows Persistence Techniques", "Industroyer2"]
action.risk = 1
action.risk.param._risk_message = A Scheduled Task was scheduled and ran on $dest$.
@@ -34760,7 +35890,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Winhlp32 Spawning a Process - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Remcos"]
action.risk = 1
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, and is not typical activity for this process.
@@ -34806,7 +35936,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Winword Spawning Cmd - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Spearphishing Attachments"]
action.risk = 1
action.risk.param._risk_message = $parent_process_name$ on $dest$ by $user$ launched command: $process_name$ which is very common in spearphishing attacks.
@@ -34852,7 +35982,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Winword Spawning PowerShell - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Spearphishing Attachments"]
action.risk = 1
action.risk.param._risk_message = $parent_process_name$ on $dest$ by $user$ launched the following powershell process: $process_name$ which is very common in spearphishing attacks
@@ -34898,7 +36028,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Winword Spawning Windows Script Host - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Spearphishing Attachments"]
action.risk = 1
action.risk.param._risk_message = User $user$ on $dest$ spawned Windows Script Host from Winword.exe
@@ -34954,7 +36084,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - WMI Permanent Event Subscription - Sysmon - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Suspicious WMI Use"]
action.risk = 1
action.risk.param._risk_message = User $user$ on $host$ executed the following suspicious WMI query: $Query$. Filter: $filter$. Consumer: $Consumer$. EventCode: $EventCode$
@@ -34999,17 +36129,17 @@ action.escu.data_models = []
action.escu.eli5 = The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found in malware and APT events where the adversary will map all running security applications or services on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
action.escu.known_false_positives = network administrator may used this command for checking purposes
-action.escu.creation_date = 2021-06-14
-action.escu.modification_date = 2021-06-14
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
action.escu.confidence = high
action.escu.full_search_name = ESCU - WMI Recon Running Process Or Services - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell"]
action.risk = 1
-action.risk.param._risk_message = Suspicious powerShell script execution by $user$ on $ComputerName$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 30}]
+action.risk.param._risk_message = Suspicious powerShell script execution by $user$ on $Computer$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 30}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
cron_schedule = 0 * * * *
@@ -35017,7 +36147,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - WMI Recon Running Process Or Services - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
schedule_window = auto
action.notable = 1
action.notable.param.nes_fields = user,dest
@@ -35034,7 +36164,7 @@ relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
-search = `powershell` EventCode=4104 Message= "*SELECT*" AND (Message="*Win32_Process*" OR Message="*Win32_Service*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmi_recon_running_process_or_services_filter`
+search = `powershell` EventCode=4104 ScriptBlockText= "*SELECT*" AND (ScriptBlockText="*Win32_Process*" OR ScriptBlockText="*Win32_Service*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmi_recon_running_process_or_services_filter`
[ESCU - Wmic Group Discovery - Rule]
action.escu = 0
@@ -35055,7 +36185,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Wmic Group Discovery - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Active Directory Discovery"]
action.risk = 1
action.risk.param._risk_message = Local group discovery on $dest$ by $user$.
@@ -35083,22 +36213,22 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
[ESCU - Wmic NonInteractive App Uninstallation - Rule]
action.escu = 0
action.escu.enabled = 1
-description = This analytic is to detect a suspicious wmic commandlined that uninstall application non interactively. This technique was seen in IceID to uninstall av products to the compromised host to bypassed and evade detections. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
+description = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This analytic is to detect a suspicious wmic commandlined that uninstall application non interactively. This technique was seen in IceID to uninstall av products to the compromised host to bypassed and evade detections. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
-action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-action.escu.known_false_positives = third party application may use this approach to uninstall there application
-action.escu.creation_date = 2021-10-20
-action.escu.modification_date = 2021-10-20
+action.escu.eli5 = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = Third party application may use this approach to uninstall applications.
+action.escu.creation_date = 2022-07-19
+action.escu.modification_date = 2022-07-19
action.escu.confidence = high
action.escu.full_search_name = ESCU - Wmic NonInteractive App Uninstallation - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["IceID"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["IceID", "Azorult"]
action.risk = 1
-action.risk.param._risk_message = wmic $process$ with commandline $process$ in $dest$
+action.risk.param._risk_message = Wmic $process_name$ with command-line $process$ on $dest$ attempting to uninstall software.
action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
action.risk.param._risk_score = 0
action.risk.param.verbose = 0
@@ -35107,7 +36237,7 @@ dispatch.earliest_time = -70m@m
dispatch.latest_time = -10m@m
action.correlationsearch.enabled = 1
action.correlationsearch.label = ESCU - Wmic NonInteractive App Uninstallation - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IceID"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IceID", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]}
schedule_window = auto
alert.digest_mode = 1
disabled = true
@@ -35135,7 +36265,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - WMIC XSL Execution via URL - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Suspicious WMI Use"]
action.risk = 1
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to download a remote XSL script.
@@ -35181,7 +36311,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Wmiprsve LOLBAS Execution Process Spawn - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Active Directory Lateral Movement"]
action.risk = 1
action.risk.param._risk_message = Wmiprsve.exe spawned a LOLBAS process on $dest$.
@@ -35227,7 +36357,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Wscript Or Cscript Suspicious Child Process - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["FIN7", "Remcos", "Unusual Processes", "WhisperGate"]
action.risk = 1
action.risk.param._risk_message = wscript or cscript parent process spawned $process_name$ in $dest$
@@ -35273,7 +36403,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Wsmprovhost LOLBAS Execution Process Spawn - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Active Directory Lateral Movement"]
action.risk = 1
action.risk.param._risk_message = Wsmprovhost.exe spawned a LOLBAS process on $dest$.
@@ -35319,7 +36449,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - WSReset UAC Bypass - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Living Off The Land", "Windows Registry Abuse"]
action.risk = 1
action.risk.param._risk_message = Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
@@ -35365,7 +36495,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - XMRIG Driver Loaded - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["XMRig"]
action.risk = 1
action.risk.param._risk_message = A driver $ImageLoaded$ related to xmrig crytominer loaded in host $Computer$
@@ -35411,7 +36541,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - XSL Script Execution With WMIC - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["FIN7", "Suspicious WMI Use"]
action.risk = 1
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to load a XSL script.
@@ -35457,7 +36587,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect New Login Attempts to Routers - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Router and Infrastructure Security"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -35505,7 +36635,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Email Attachments With Lots Of Spaces - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Hermetic Wiper", "Emotet Malware DHS Report TA18-201A ", "Suspicious Emails"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -35545,7 +36675,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Email files written outside of the Outlook directory - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Collection and Staging"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -35591,7 +36721,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Email servers sending high volume traffic to hosts - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Collection and Staging", "HAFNIUM Group"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -35631,7 +36761,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Monitor Email For Brand Abuse - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Brand Monitoring", "Suspicious Emails"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -35677,7 +36807,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Suspicious Okta Activity"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -35723,7 +36853,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - No Windows Updates in a time frame - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Monitor for Updates"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -35763,7 +36893,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Okta Account Lockout Events - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Suspicious Okta Activity"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -35803,7 +36933,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Okta Failed SSO Attempts - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Suspicious Okta Activity"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -35843,7 +36973,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Okta User Logins From Multiple Cities - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Suspicious Okta Activity"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -35885,7 +37015,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Suspicious Email Attachment Extensions - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Hermetic Wiper", "Emotet Malware DHS Report TA18-201A ", "Suspicious Emails"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -35925,7 +37055,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Suspicious Java Classes - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Apache Struts Vulnerability"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -35965,7 +37095,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Web Servers Executing Suspicious Processes - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Apache Struts Vulnerability"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36011,7 +37141,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36051,7 +37181,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Instances Launched - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36091,7 +37221,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Amazon EKS Kubernetes cluster scan detection - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Kubernetes Scanning Activity"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36131,7 +37261,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Amazon EKS Kubernetes Pod scan detection - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Kubernetes Scanning Activity"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36171,7 +37301,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - aws detect attach to role policy - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["AWS Cross Account Activity"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36211,7 +37341,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - aws detect permanent key creation - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["AWS Cross Account Activity"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36251,7 +37381,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - aws detect role creation - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["AWS Cross Account Activity"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36291,7 +37421,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - aws detect sts assume role abuse - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
action.escu.analytic_story = ["AWS Cross Account Activity"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36331,7 +37461,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - aws detect sts get session token abuse - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["AWS Cross Account Activity"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36371,7 +37501,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect GCP Storage access from a new IP - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Suspicious GCP Storage Activities"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36411,7 +37541,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect New Open GCP Storage Buckets - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Suspicious GCP Storage Activities"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36457,7 +37587,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect S3 access from a new IP - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36497,7 +37627,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["AWS Security Hub Alerts"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36537,7 +37667,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command and Control"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36577,7 +37707,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Spike in S3 Bucket deletion - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36617,7 +37747,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - GCP Detect gcploit framework - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["GCP Cross Account Activity"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36663,7 +37793,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - GCP Kubernetes cluster pod scan detection - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Kubernetes Scanning Activity"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36703,7 +37833,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Gdrive suspicious file sharing - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Spearphishing Attachments", "Data Exfiltration"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36743,7 +37873,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Gsuite suspicious calendar invite - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Spearphishing Attachments"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36783,7 +37913,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - High Number of Login Failures from a single source - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Office 365 Detections"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36823,7 +37953,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36848,46 +37978,6 @@ realtime_schedule = 0
is_visible = false
search = `aws_cloudwatchlogs_eks` userAgent=kubectl* sourceIPs{}!=127.0.0.1 sourceIPs{}!=::1 src_user=system:anonymous | table src_ip src_user verb userAgent requestURI | stats count by src_ip src_user verb userAgent requestURI |`kubernetes_aws_detect_suspicious_kubectl_calls_filter`
-[ESCU - New container uploaded to AWS ECR - Rule]
-action.escu = 0
-action.escu.enabled = 1
-description = This searches show information on uploaded containers including source user, image id, source IP user type, http user agent, region, first time, last time of operation (PutImage). These searches are based on Cloud Infrastructure Data Model.
-action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1525"]}
-action.escu.data_models = []
-action.escu.eli5 = This searches show information on uploaded containers including source user, image id, source IP user type, http user agent, region, first time, last time of operation (PutImage). These searches are based on Cloud Infrastructure Data Model.
-action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You must also install Cloud Infrastructure data model. Please also customize the `container_implant_aws_detection_filter` macro to filter out the false positives.
-action.escu.known_false_positives = Uploading container is a normal behavior from developers or users with access to container registry.
-action.escu.creation_date = 2020-02-20
-action.escu.modification_date = 2020-02-20
-action.escu.confidence = high
-action.escu.full_search_name = ESCU - New container uploaded to AWS ECR - Rule
-action.escu.search_type = detection
-action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Container Implantation Monitoring and Investigation"]
-action.risk = 1
-action.risk.param._risk_message = tbd
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}]
-action.risk.param._risk_score = 0
-action.risk.param.verbose = 0
-cron_schedule = 0 * * * *
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
-action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - New container uploaded to AWS ECR - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Container Implantation Monitoring and Investigation"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1525"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
-schedule_window = auto
-alert.digest_mode = 1
-disabled = true
-enableSched = 1
-allow_skew = 100%
-counttype = number of events
-relation = greater than
-quantity = 0
-realtime_schedule = 0
-is_visible = false
-search = | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Cloud_Infrastructure.Compute where Compute.user_type!="AssumeRole" AND Compute.http_user_agent="AWS Internal" AND Compute.event_name="PutImage" by Compute.image_id Compute.src_user Compute.src Compute.region Compute.msg Compute.user_type | `drop_dm_object_name("Compute")` | `new_container_uploaded_to_aws_ecr_filter`
-
[ESCU - Child Processes of Spoolsv exe - Rule]
action.escu = 0
action.escu.enabled = 1
@@ -36903,7 +37993,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Child Processes of Spoolsv exe - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Windows Privilege Escalation", "Hermetic Wiper"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36949,7 +38039,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Baron Samedit CVE-2021-3156 - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Baron Samedit CVE-2021-3156"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -36995,7 +38085,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Baron Samedit CVE-2021-3156"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -37041,7 +38131,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Baron Samedit CVE-2021-3156"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -37087,7 +38177,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Computer Changed with Anonymous Account - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["Detect Zerologon Attack"]
action.risk = 1
action.risk.param._risk_message = The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the an account or group being changed by an anonymous account.
@@ -37127,7 +38217,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Outlook exe writing a zip file - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Spearphishing Attachments"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -37173,7 +38263,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Rare Executables - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Emotet Malware DHS Report TA18-201A ", "Unusual Processes", "Cloud Federated Credential Abuse"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -37213,7 +38303,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detection of tools built by NirSoft - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Emotet Malware DHS Report TA18-201A "]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -37267,7 +38357,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Exchange PowerShell Abuse via SSRF - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["ProxyShell"]
action.risk = 1
action.risk.param._risk_message = Activity related to ProxyShell has been identified on $dest$. Review events and take action accordingly.
@@ -37317,13 +38407,13 @@ Module - New-MailboxExportRequest will begin the process of exporting contents o
Module - New-managementroleassignment can assign a management role to a management role group, management role assignment policy, user, or universal security group (USG).
action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
action.escu.known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-action.escu.creation_date = 2021-08-27
-action.escu.modification_date = 2021-08-27
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
action.escu.confidence = high
action.escu.full_search_name = ESCU - Exchange PowerShell Module Usage - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["ProxyShell"]
action.risk = 1
action.risk.param._risk_message = Local user discovery enumeration using PowerShell on $dest$ by $user$
@@ -37355,7 +38445,7 @@ relation = greater than
quantity = 0
realtime_schedule = 0
is_visible = false
-search = `powershell` EventCode=4104 Message IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*") | stats count min(_time) as firstTime max(_time) as lastTime by Path Message OpCode ComputerName User EventCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `exchange_powershell_module_usage_filter`
+search = `powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*") | stats count min(_time) as firstTime max(_time) as lastTime by lastTime by Opcode Computer UserID EventCode ScriptBlockText| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `exchange_powershell_module_usage_filter`
[ESCU - First Time Seen Child Process of Zoom - Rule]
action.escu = 0
@@ -37372,7 +38462,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - First Time Seen Child Process of Zoom - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Suspicious Zoom Child Processes"]
action.risk = 1
action.risk.param._risk_message = Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us which has not been previously on host $dest$
@@ -37412,7 +38502,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - First Time Seen Running Windows Service - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Windows Service Abuse", "Orangeworm Attack Group", "NOBELIUM Group"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -37452,7 +38542,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Linux Stdout Redirection To Dev Null File - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["CyclopsBLink", "Industroyer2"]
action.risk = 1
action.risk.param._risk_message = a commandline $process$ that redirect stdout to dev/null in $dest$
@@ -37492,7 +38582,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - MacOS - Re-opened Applications - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["ColdRoot MacOS RAT"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -37538,7 +38628,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["ProxyShell", "Ransomware"]
action.risk = 1
action.risk.param._risk_message = A file - $file_name$ was written to disk that is related to IIS exploitation related to ProxyShell. Review further file modifications on endpoint $dest$ by user $user$.
@@ -37584,7 +38674,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Print Processor Registry Autostart - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Windows Persistence Techniques", "Windows Privilege Escalation", "Hermetic Wiper"]
action.risk = 1
action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$
@@ -37630,7 +38720,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Processes Tapping Keyboard Events - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["ColdRoot MacOS RAT"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -37676,7 +38766,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Randomly Generated Scheduled Task Name - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["Active Directory Lateral Movement"]
action.risk = 1
action.risk.param._risk_message = A windows scheduled task with a suspicious task name was created on $dest$
@@ -37716,7 +38806,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Randomly Generated Windows Service Name - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Active Directory Lateral Movement"]
action.risk = 1
action.risk.param._risk_message = A Windows Service with a suspicious service name was installed on $ComputerName$
@@ -37756,7 +38846,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Remote Desktop Process Running On System - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Hidden Cobra Malware", "Active Directory Lateral Movement"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -37796,7 +38886,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Spike in File Writes - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -37836,7 +38926,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Sunburst Correlation DLL and Network Event - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["NOBELIUM Group"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -37882,7 +38972,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Suspicious Curl Network Connection - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Silver Sparrow", "Ingress Tool Transfer"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -37942,7 +39032,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Suspicious PlistBuddy Usage - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Silver Sparrow"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -38009,7 +39099,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Suspicious PlistBuddy Usage via OSquery - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Silver Sparrow"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -38062,7 +39152,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Suspicious SQLite3 LSQuarantine Behavior - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Silver Sparrow"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -38110,7 +39200,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Unusual Number of Computer Service Tickets Requested - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["Active Directory Lateral Movement", "Active Directory Kerberos Attacks"]
action.risk = 1
action.risk.param._risk_message =
@@ -38152,7 +39242,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
action.escu.analytic_story = ["Active Directory Lateral Movement"]
action.risk = 1
action.risk.param._risk_message =
@@ -38192,7 +39282,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Unusually Long Command Line - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"]
action.risk = 1
action.risk.param._risk_message = Unusually long command line $Processes.process_name$ on $dest$
@@ -38232,7 +39322,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Unusually Long Command Line - MLTK - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -38272,7 +39362,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Windows Java Spawning Shells - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Log4Shell CVE-2021-44228"]
action.risk = 1
action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ spawning a Windows shell, potentially indicative of exploitation.
@@ -38318,7 +39408,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - WinRM Spawning a Process - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Unusual Processes"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -38364,7 +39454,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - WMI Permanent Event Subscription - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Suspicious WMI Use"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -38410,7 +39500,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - WMI Temporary Event Subscription - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Suspicious WMI Use"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -38456,7 +39546,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect ARP Poisoning - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Router and Infrastructure Security"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -38502,7 +39592,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect IPv6 Network Infrastructure Threats - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Router and Infrastructure Security"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -38548,7 +39638,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Large Outbound ICMP Packets - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Command and Control"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -38594,7 +39684,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Outbound SMB Traffic - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Hidden Cobra Malware", "DHS Report TA18-074A", "NOBELIUM Group"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -38640,7 +39730,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Port Security Violation - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Router and Infrastructure Security"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -38686,7 +39776,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Rogue DHCP Server - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Router and Infrastructure Security"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -38732,7 +39822,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect SNICat SNI Exfiltration - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Data Exfiltration"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -38778,7 +39868,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Software Download To Network Device - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Router and Infrastructure Security"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -38824,7 +39914,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Traffic Mirroring - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Router and Infrastructure Security"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -38870,7 +39960,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Unauthorized Assets by MAC address - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Asset Tracking"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -38916,7 +40006,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Windows DNS SIGRed CVE-2020-1350"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -38962,7 +40052,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Windows DNS SIGRed via Zeek - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Windows DNS SIGRed CVE-2020-1350"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39008,7 +40098,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Zerologon via Zeek - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Detect Zerologon Attack"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39060,7 +40150,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - DNS Query Length Outliers - MLTK - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39100,7 +40190,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Excessive DNS Failures - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Suspicious DNS Traffic", "Command and Control"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39140,7 +40230,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Hosts receiving high volume of network traffic from email server - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Collection and Staging"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39180,7 +40270,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Large Volume of DNS ANY Queries - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["DNS Amplification Attacks"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39220,7 +40310,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Prohibited Network Traffic Allowed - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39266,7 +40356,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Protocol or Port Mismatch - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Command and Control"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39306,7 +40396,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Protocols passing authentication in cleartext - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Use of Cleartext Protocols"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39352,7 +40442,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Remote Desktop Network Bruteforce - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39398,7 +40488,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Remote Desktop Network Traffic - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Hidden Cobra Malware", "Active Directory Lateral Movement"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39438,7 +40528,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - SMB Traffic Spike - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39481,7 +40571,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - SMB Traffic Spike - MLTK - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39521,7 +40611,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - TOR Traffic - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "NOBELIUM Group", "Command and Control"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39567,7 +40657,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Unusually Long Content-Type Length - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Apache Struts Vulnerability"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39607,7 +40697,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["JBoss Vulnerability", "SamSam Ransomware"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39653,7 +40743,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["F5 TMUI RCE CVE-2020-5902"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39699,7 +40789,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect malicious requests to exploit JBoss servers - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["JBoss Vulnerability", "SamSam Ransomware"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39745,7 +40835,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Monitor Web Traffic For Brand Abuse - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Brand Monitoring"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39791,7 +40881,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - SQL Injection with Long URLs - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["SQL Injection"]
action.risk = 1
action.risk.param._risk_message = SQL injection attempt with url $url$ detected on $dest$
@@ -39837,7 +40927,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Supernova Webshell - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["NOBELIUM Group"]
action.risk = 1
action.risk.param._risk_message = tbd
@@ -39889,7 +40979,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect hosts connecting to dynamic domain providers - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Data Protection", "Prohibited Traffic Allowed or Protocol Mismatch", "DNS Hijacking", "Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"]
action.risk = 1
action.risk.param._risk_message = A dns query $query$ from your infra connecting to suspicious domain in host $host$
@@ -39935,7 +41025,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Detect Outbound LDAP Traffic - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Log4Shell CVE-2021-44228"]
action.risk = 1
action.risk.param._risk_message = An outbound LDAP connection from $src_ip$ in your infrastructure connecting to dest ip $dest_ip$
@@ -39975,7 +41065,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - DNS Query Length With High Standard Deviation - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"]
action.risk = 1
action.risk.param._risk_message = A dns query $query$ with 2 time standard deviation of name len of the dns query in host $host$
@@ -40015,7 +41105,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - F5 BIG-IP iControl REST Vulnerability CVE-2022-1388 - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["F5 BIG-IP Vulnerability CVE-2022-1388"]
action.risk = 1
action.risk.param._risk_message = An attempt to exploit CVE-2022-1388 against an F5 appliance $dest$ has occurred.
@@ -40061,7 +41151,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Multiple Archive Files Http Post Traffic - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Data Exfiltration", "Command and Control"]
action.risk = 1
action.risk.param._risk_message = A http post $http_method$ sending packet with possible archive bytes header 4form_data$ in uri path $uri_path$
@@ -40107,7 +41197,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Plain HTTP POST Exfiltrated Data - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Data Exfiltration", "Command and Control"]
action.risk = 1
action.risk.param._risk_message = A http post $http_method$ sending packet with plain text of information $form_data$ in uri path $uri_path$
@@ -40153,7 +41243,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Splunk Identified SSL TLS Certificates - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Splunk Vulnerabilities"]
action.risk = 1
action.risk.param._risk_message = The following $dest$ is using the self signed Splunk certificate.
@@ -40193,7 +41283,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Confluence Unauthenticated Remote Code Execution CVE-2022-26134 - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
action.escu.analytic_story = ["Atlassian Confluence Server and Data Center CVE-2022-26134"]
action.risk = 1
action.risk.param._risk_message = A URL was requested related to CVE-2022-26134, a unauthenticated remote code execution vulnerability, on $dest$ by $src$.
@@ -40239,7 +41329,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Log4Shell JNDI Payload Injection Attempt - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Log4Shell CVE-2021-44228"]
action.risk = 1
action.risk.param._risk_message = CVE-2021-44228 Log4Shell triggered for host $dest$
@@ -40279,7 +41369,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Log4Shell JNDI Payload Injection with Outbound Connection - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Log4Shell CVE-2021-44228"]
action.risk = 1
action.risk.param._risk_message = CVE-2021-44228 Log4Shell triggered for host $dest$
@@ -40313,13 +41403,13 @@ action.escu.data_models = ["Web"]
action.escu.eli5 = The following analytic is static indicators related to CVE-2022-22963, Spring4Shell. The 3 indicators provide an amount of fidelity that source IP is attemping to exploit a web shell on the destination. The filename and cmd are arbitrary in this exploitation. Java will write a JSP to disk and a process will spawn from Java based on the cmd passed. This is indicative of typical web shell activity.
action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel.
action.escu.known_false_positives = The jsp file names are static names used in current proof of concept code. =
-action.escu.creation_date = 2022-04-05
-action.escu.modification_date = 2022-04-05
+action.escu.creation_date = 2022-07-12
+action.escu.modification_date = 2022-07-12
action.escu.confidence = high
action.escu.full_search_name = ESCU - Spring4Shell Payload URL Request - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Spring4Shell CVE-2022-22965"]
action.risk = 1
action.risk.param._risk_message = A URL was requested related to Spring4Shell POC code on $dest$ by $src$.
@@ -40365,7 +41455,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - VMware Server Side Template Injection Hunt - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["VMware Server Side Injection and Privilege Escalation"]
action.risk = 1
action.risk.param._risk_message = An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred.
@@ -40405,7 +41495,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - VMware Workspace ONE Freemarker Server-side Template Injection - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["VMware Server Side Injection and Privilege Escalation"]
action.risk = 1
action.risk.param._risk_message = An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred.
@@ -40445,7 +41535,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Web JSP Request via URL - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Spring4Shell CVE-2022-22965"]
action.risk = 1
action.risk.param._risk_message = A suspicious URL has been requested against $dest$ by $src$, related to web shell activity.
@@ -40491,7 +41581,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Web Spring4Shell HTTP Request Class Module - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Spring4Shell CVE-2022-22965"]
action.risk = 1
action.risk.param._risk_message = A http body request related to Spring4Shell has been sent to $dest$ by $src$.
@@ -40537,7 +41627,7 @@ action.escu.confidence = high
action.escu.full_search_name = ESCU - Web Spring Cloud Function FunctionRouter - Rule
action.escu.search_type = detection
action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
action.escu.analytic_story = ["Spring4Shell CVE-2022-22965"]
action.risk = 1
action.risk.param._risk_message = A suspicious URL has been requested against $dest$ by $src$, related to a vulnerability in Spring Cloud.
diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf
index b305e7d87f..59d49d5004 100644
--- a/dist/escu/default/transforms.conf
+++ b/dist/escu/default/transforms.conf
@@ -1,10 +1,17 @@
#############
# Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-06-29T20:42:24 UTC
+# On Date: 2022-07-19T21:28:12 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
+[__mlspl_risky_spl_pre_trained_model]
+filename = __mlspl_risky_spl_pre_trained_model.mlmodel
+default_match = false
+case_sensitive_match = false
+# description = Detect Risky SPL using Pretrained ML Model
+min_matches = 1
+
[__mlspl_unusual_commandline_detection]
filename = __mlspl_unusual_commandline_detection.mlmodel
default_match = false
@@ -306,6 +313,14 @@ default_match = false
match_type = WILDCARD(file)
min_matches = 1
+[windows_protocol_handlers]
+filename = windows_protocol_handlers.csv
+default_match = false
+case_sensitive_match = false
+# description = A list of Windows Protocol Handlers
+match_type = WILDCARD(handler)
+min_matches = 1
+
[zoom_first_time_child_process]
collection = zoom_first_time_child_process
external_type = kvstore
diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf
index 3dc6dac2a9..256e1a8073 100644
--- a/dist/escu/default/workflow_actions.conf
+++ b/dist/escu/default/workflow_actions.conf
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-06-29T20:42:24 UTC
+# On Date: 2022-07-19T21:28:12 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
diff --git a/dist/escu/lookups/__mlspl_risky_spl_pre_trained_model.mlmodel b/dist/escu/lookups/__mlspl_risky_spl_pre_trained_model.mlmodel
new file mode 100644
index 0000000000..5aa2f7fd9c
--- /dev/null
+++ b/dist/escu/lookups/__mlspl_risky_spl_pre_trained_model.mlmodel
@@ -0,0 +1,2 @@
+algo,model,options
+DetectRiskySPL,"{""__mlspl_type"": [""algos.DetectRiskySPL"", ""DetectRiskySPL""], ""dict"": {""classes"": null, ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""columns"": [""spl_text""], ""estimator"": {""__mlspl_type"": [""sklearn.pipeline"", ""Pipeline""], ""dict"": {""steps"": [[""features"", {""__mlspl_type"": [""sklearn.feature_extraction.text"", ""CountVectorizer""], ""dict"": {""input"": ""content"", ""encoding"": ""utf-8"", ""decode_error"": ""strict"", ""strip_accents"": null, ""preprocessor"": null, ""tokenizer"": null, ""analyzer"": ""word"", ""lowercase"": true, ""token_pattern"": "" collect | delete | fit | outputcsv | outputlookup |adhoc| sendalert | sendemail |splunk\\-system\\-user| tscollect | run | script | runshellscript "", ""stop_words"": null, ""max_df"": 1.0, ""min_df"": 1, ""max_features"": null, ""ngram_range"": [1, 1], ""vocabulary"": null, ""binary"": false, ""dtype"": {""__mlspl_type"": [""builtins"", ""type""], ""type"": [""numpy"", ""int64""]}, ""fixed_vocabulary_"": false, ""_stop_words_id"": 94300723879360, ""stop_words_"": {""__mlspl_type"": [""builtins"", ""set""], ""set"": []}, ""vocabulary_"": {""splunk-system-user"": 12, "" delete "": 1, ""adhoc"": 11, "" outputlookup "": 4, "" script "": 7, "" run "": 5, "" collect "": 0, "" sendemail "": 9, "" sendalert "": 8, "" outputcsv "": 3, "" fit "": 2, "" runshellscript "": 6, "" tscollect "": 10}}}], [""predictor"", {""__mlspl_type"": [""sklearn.linear_model._logistic"", ""LogisticRegression""], ""dict"": {""penalty"": ""l2"", ""dual"": false, ""tol"": 0.0001, ""C"": 1.0, ""fit_intercept"": true, ""intercept_scaling"": 1, ""class_weight"": {""0"": 1, ""1"": 10}, ""random_state"": null, ""solver"": ""liblinear"", ""max_iter"": 100, ""multi_class"": ""auto"", ""verbose"": 0, ""warm_start"": false, ""n_jobs"": null, ""l1_ratio"": null, ""n_features_in_"": 13, ""classes_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDIsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAAAAAAAAAAAEAAAAAAAAA""}, ""coef_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsIDEzKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAqulbT8VG8TQJU6VfC9QuY/kCCmapJVFUDQl14TS2ApPw5vYc32jBxAxVuQ3Sv35D8Y+azG/kDmP9vpUE0rTwlALsMVcoUGE0ASjjFaKyMaQA2zZ/yMQRZAQLZHc97OHEAfrzTDBGwSwA==""}, ""intercept_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAqBnhyKtBckwA==""}, ""n_iter_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk0JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoLAAAA""}}}]], ""memory"": null, ""verbose"": false}}}}","{""args"": [""risk_score"", ""spl_text""], ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""model_name"": ""risky_spl_pre_trained_model"", ""algo_name"": ""LogisticRegression"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""1024"", ""max_model_size_mb"": ""15"", ""max_score_time"": ""600"", ""streaming_apply"": ""false"", ""use_sampling"": ""true""}, ""kfold_cv"": null}"
diff --git a/dist/escu/lookups/security_services.csv b/dist/escu/lookups/security_services.csv
index bfbac66fb0..b8982c6109 100644
--- a/dist/escu/lookups/security_services.csv
+++ b/dist/escu/lookups/security_services.csv
@@ -1,5 +1,5 @@
service,description,category
*mpssvc*,Windows Firewall Service,security
-*wscsvc*,Windows Security Center Service,securty
+*wscsvc*,Windows Security Center Service,security
*windefend*,Windows Defender Service,security
*sysmon*,Sysmon Driver,security
diff --git a/dist/escu/lookups/windows_protocol_handlers.csv b/dist/escu/lookups/windows_protocol_handlers.csv
new file mode 100644
index 0000000000..4f809b8b61
--- /dev/null
+++ b/dist/escu/lookups/windows_protocol_handlers.csv
@@ -0,0 +1,205 @@
+handler,ishandler
+"*bingmaps:*",TRUE
+"*calculator:*",TRUE
+"*callto:*",TRUE
+"*conf:*",TRUE
+"*DLNA-PLAYSINGLE:*",TRUE
+"*Explorer.AssocActionId.BurnSelection:*",TRUE
+"*Explorer.AssocActionId.EraseDisc:*",TRUE
+"*Explorer.AssocActionId.ZipSelection:*",TRUE
+"*Explorer.AssocProtocol.search-ms:*",TRUE
+"*Explorer.BurnSelection:*",TRUE
+"*Explorer.EraseDisc:*",TRUE
+"*Explorer.ZipSelection:*",TRUE
+"*feed:*",TRUE
+"*feeds:*",TRUE
+"*file:*",TRUE
+"*FirefoxURL-308046B0AF4A39CB:*",TRUE
+"*ftp:*",TRUE
+"*grvopen:*",TRUE
+"*http:*",TRUE
+"*https:*",TRUE
+"*iehistory:*",TRUE
+"*ierss:*",TRUE
+"*im:*",TRUE
+"*LDAP:*",TRUE
+"*Lync15:*",TRUE
+"*Lync15classic:*",TRUE
+"*ma-chan:*",TRUE
+"*ma-filelink:*",TRUE
+"*mailto:*",TRUE
+"*mapi:*",TRUE
+"*mapi15:*",TRUE
+"*mapi16:*",TRUE
+"*mk:*",TRUE
+"*MMS:*",TRUE
+"*ms-access:*",TRUE
+"*ms-actioncenter:*",TRUE
+"*ms-apprep:*",TRUE
+"*ms-availablenetworks:*",TRUE
+"*ms-cortana:*",TRUE
+"*ms-cxh:*",TRUE
+"*ms-device-enrollment:*",TRUE
+"*ms-excel:*",TRUE
+"*ms-msdt:*",TRUE
+"*ms-penworkspace:*",TRUE
+"*ms-powerpoint:*",TRUE
+"*ms-publisher:*",TRUE
+"*ms-settings:*",TRUE
+"*ms-settings-airplanemode:*",TRUE
+"*ms-settings-bluetooth:*",TRUE
+"*ms-settings-cellular:*",TRUE
+"*ms-settings-connectabledevices:*",TRUE
+"*ms-settings-displays-topology:*",TRUE
+"*ms-settings-emailandaccounts:*",TRUE
+"*ms-settings-language:*",TRUE
+"*ms-settings-location:*",TRUE
+"*ms-settings-lock:*",TRUE
+"*ms-settings-mobilehotspot:*",TRUE
+"*ms-settings-notifications:*",TRUE
+"*ms-settings-power:*",TRUE
+"*ms-settings-privacy:*",TRUE
+"*ms-settings-proximity:*",TRUE
+"*ms-settings-screenrotation:*",TRUE
+"*ms-settings-wifi:*",TRUE
+"*ms-settings-workplace:*",TRUE
+"*ms-teams:*",TRUE
+"*ms-windows-search:*",TRUE
+"*ms-word:*",TRUE
+"*mssharepointclient:*",TRUE
+"*msteams:*",TRUE
+"*mswindowsmusic:*",TRUE
+"*mswindowsvideo:*",TRUE
+"*odopen:*",TRUE
+"*OneIndex16:*",TRUE
+"*OneNote:*",TRUE
+"*OneNote.URL.16:*",TRUE
+"*OneNoteDesktop:*",TRUE
+"*OneNoteDesktop.URL.16:*",TRUE
+"*Outlook.URL.feed.15:*",TRUE
+"*Outlook.URL.mailto.15:*",TRUE
+"*Outlook.URL.stssync.15:*",TRUE
+"*Outlook.URL.webcal.15:*",TRUE
+"*res:*",TRUE
+"*rlogin:*",TRUE
+"*search:*",TRUE
+"*search-ms:*",TRUE
+"*sip:*",TRUE
+"*sips:*",TRUE
+"*skypecast15:*",TRUE
+"*stssync:*",TRUE
+"*tbauth:*",TRUE
+"*tel:*",TRUE
+"*telnet:*",TRUE
+"*tn3270:*",TRUE
+"*webcal:*",TRUE
+"*webcals:*",TRUE
+"*windows.tbauth:*",TRUE
+"*WMP11.AssocProtocol.DLNA-PLAYSINGLE:*",TRUE
+"*WMP11.AssocProtocol.MMS:*",TRUE
+"*Word:*",TRUE
+"*xbox-tcui:*",TRUE
+"*appinstaller.oauth2:*",TRUE
+"*bingnews:*",TRUE
+"*bingweather:*",TRUE
+"*feedback-hub:*",TRUE
+"*git-client:*",TRUE
+"*IE.HTTP:*",TRUE
+"*insiderhub:*",TRUE
+"*microsoft-edge:*",TRUE
+"*microsoft-edge-holographic:*",TRUE
+"*microsoft.windows.camera:*",TRUE
+"*microsoft.windows.camera.multipicker:*",TRUE
+"*microsoft.windows.camera.picker:*",TRUE
+"*microsoft.windows.photos.crop:*",TRUE
+"*microsoft.windows.photos.picker:*",TRUE
+"*microsoft.windows.photos.videoedit:*",TRUE
+"*Microsoft.Workfolders:*",TRUE
+"*microsoftvideo:*",TRUE
+"*ms-aad-brokerplugin:*",TRUE
+"*ms-appinstaller:*",TRUE
+"*ms-calculator:*",TRUE
+"*ms-clock:*",TRUE
+"*ms-contact-support:*",TRUE
+"*ms-cortana2:*",TRUE
+"*ms-cxh-full:*",TRUE
+"*ms-default-location:*",TRUE
+"*ms-device-enrollment2:*",TRUE
+"*ms-drive-to:*",TRUE
+"*ms-edu-secureassessment:*",TRUE
+"*ms-eyecontrolspeech:*",TRUE
+"*ms-gamebar:*",TRUE
+"*ms-gamebarservices:*",TRUE
+"*ms-gamingoverlay:*",TRUE
+"*ms-get-started:*",TRUE
+"*ms-getoffice:*",TRUE
+"*ms-inputapp:*",TRUE
+"*ms-insights:*",TRUE
+"*ms-meetnow:*",TRUE
+"*ms-meetnowflyout:*",TRUE
+"*ms-mmsys:*",TRUE
+"*ms-msime-imepad:*",TRUE
+"*ms-msime-imjpdct:*",TRUE
+"*ms-officeapp:*",TRUE
+"*ms-officecmd:*",TRUE
+"*ms-oobenetwork:*",TRUE
+"*ms-people:*",TRUE
+"*ms-perception-simulation:*",TRUE
+"*ms-phone:*",TRUE
+"*ms-photos:*",TRUE
+"*ms-powerautomate:*",TRUE
+"*ms-print-addprinter:*",TRUE
+"*ms-print-printjobs:*",TRUE
+"*ms-quick-assist:*",TRUE
+"*ms-rdx-document:*",TRUE
+"*ms-retaildemo-launchbioenrollment:*",TRUE
+"*ms-retaildemo-launchstart:*",TRUE
+"*ms-screenclip:*",TRUE
+"*ms-screensketch:*",TRUE
+"*ms-search:*",TRUE
+"*ms-sttoverlay:*",TRUE
+"*ms-taskswitcher:*",TRUE
+"*ms-to-do:*",TRUE
+"*ms-todo:*",TRUE
+"*ms-unistore-email:*",TRUE
+"*ms-virtualtouchpad:*",TRUE
+"*ms-walk-to:*",TRUE
+"*ms-wcrv:*",TRUE
+"*ms-windows-store:*",TRUE
+"*ms-windows-store-deskext:*",TRUE
+"*ms-windows-store2:*",TRUE
+"*ms-wpc:*",TRUE
+"*ms-wpdrmv:*",TRUE
+"*ms-wxh:*",TRUE
+"*ms-xbet-survey:*",TRUE
+"*ms-xbl-3d8b930f:*",TRUE
+"*ms-xgpueject:*",TRUE
+"*msgamepass:*",TRUE
+"*msgamingapp:*",TRUE
+"*msnews:*",TRUE
+"*msnnews:*",TRUE
+"*msnweather:*",TRUE
+"*msxbox:*",TRUE
+"*outlookaccounts:*",TRUE
+"*outlookcal:*",TRUE
+"*outlookmail:*",TRUE
+"*read:*",TRUE
+"*vscode:*",TRUE
+"*vsls:*",TRUE
+"*vstfs:*",TRUE
+"*vsweb:*",TRUE
+"*windows-feedback:*",TRUE
+"*windowsdefender:*",TRUE
+"*xboxliveapp-1297287741:*",TRUE
+"*zune:*",TRUE
+"*SecureBrowser.security.getDeviceInfo:*",TRUE
+"*SecureBrowser.security.getMACAddress:*",TRUE
+"*SecureBrowser.security.examineProcessList:*",TRUE
+"*SecureBrowser.security.isRemoteSession:*",TRUE
+"*SecureBrowser.security.isVMSession:*",TRUE
+"*JavaScript:*",TRUE
+"*vbscript:*",TRUE
+"*about:*",TRUE
+"*ms-its:*",TRUE
+"*its:*",TRUE
+"*mk:@MSITStore:*",TRUE
\ No newline at end of file
diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml
new file mode 100644
index 0000000000..a4455e1b05
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml
@@ -0,0 +1,57 @@
+name: Windows Defender Tools in Non Standard Path
+id: c205bd2e-cd5b-4224-8510-578a2a1f83d7
+version: 1
+description: The following analytic identifies usage of the MPCmdRun utility that
+ can be abused by adversaries by moving it to a new directory.
+search: ' from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
+ "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
+ "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
+ null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
+ null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)),
+ process_path=lower(ucast(map_get(input_event, "process_path"), "string", null)),
+ event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name
+ IS NOT NULL AND process_name="mpcmdrun.exe" | where process_path IS NOT NULL AND
+ match_regex(process_path, /(?i)\\microsoft\\windows defender\\platform/)=false AND
+ match_regex(process_path, /(?i)\\windows defender/)=false | eval start_time=timestamp,
+ end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
+ event_id, "process_path", process_path, "process_name", process_name, "cmd_line",
+ cmd_line]) | into write_ssa_detected_events(); '
+how_to_implement: Collect endpoint data such as sysmon or 4688 events.
+known_false_positives: False positives may be present and filtering may be required.
+references:
+- https://attack.mitre.org/techniques/T1036/003/
+- https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/
+tags:
+ analytic_story:
+ - Living Off The Land
+ cis20:
+ - CIS 3
+ - CIS 5
+ - CIS 16
+ kill_chain_phases:
+ - Actions on Objectives
+ mitre_attack_id:
+ - T1036
+ - T1036.003
+ nist:
+ - DE.CM
+ required_fields:
+ - dest_device_id
+ - process_name
+ - _time
+ - dest_user_id
+ - process_path
+ - cmd_line
+ risk_score: 56
+ security_domain: endpoint
+ risk_severity: medium
+test:
+ name: Windows Defender Tools in Non Standard Path Unit Test
+ tests:
+ - name: Windows Defender Tools in Non Standard Path
+ file: endpoint/ssa___windows_defender_tools_in_non_standard_path.yml
+ pass_condition: '| stats count | where count > 0'
+ attack_data:
+ - file_name: windows-security.log
+ data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/mpcmdrun/windows-security.log
+ source: XmlWinEventLog
diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
index 6c73973dd8..c722f05199 100644
--- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
+++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
@@ -1,6 +1,6 @@
name: Windows LOLBin Binary in Non Standard Path
id: 25689101-012a-324a-94d3-08301e6c065a
-version: 2
+version: 3
description: The following analytic identifies native living off the land binaries
within the Windows operating system that may be abused by adversaries by moving
it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io
@@ -27,29 +27,28 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="imewdbld.exe"
OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe"
OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe"
- OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="mpcmdrun.exe"
- OR process_name="msconfig.exe" OR process_name="msdt.exe" OR process_name="mshta.exe"
- OR process_name="msiexec.exe" OR process_name="netsh.exe" OR process_name="odbcconf.exe"
- OR process_name="offlinescannershell.exe" OR process_name="onedrivestandaloneupdater.exe"
- OR process_name="pcalua.exe" OR process_name="pcwrun.exe" OR process_name="pktmon.exe"
- OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="print.exe"
- OR process_name="printbrm.exe" OR process_name="psr.exe" OR process_name="rasautou.exe"
- OR process_name="reg.exe" OR process_name="regini.exe" OR process_name="register-cimprovider.exe"
- OR process_name="regsvr32.exe" OR process_name="replace.exe" OR process_name="rpcping.exe"
- OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="runscripthelper.exe"
- OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="scriptrunner.exe"
- OR process_name="settingsynchost.exe" OR process_name="syncappvpublishingserver.exe"
- OR process_name="ttdinject.exe" OR process_name="tttracer.exe" OR process_name="vbc.exe"
- OR process_name="verclsid.exe" OR process_name="wab.exe" OR process_name="wlrmdr.exe"
- OR process_name="wmic.exe" OR process_name="workfolders.exe" OR process_name="wscript.exe"
- OR process_name="wsreset.exe" OR process_name="wuauclt.exe" OR process_name="xwizard.exe";
+ OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="msconfig.exe"
+ OR process_name="msdt.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe"
+ OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe"
+ OR process_name="onedrivestandaloneupdater.exe" OR process_name="pcalua.exe" OR
+ process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe"
+ OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe"
+ OR process_name="psr.exe" OR process_name="rasautou.exe" OR process_name="reg.exe"
+ OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe"
+ OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe"
+ OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe"
+ OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR process_name="settingsynchost.exe"
+ OR process_name="syncappvpublishingserver.exe" OR process_name="ttdinject.exe" OR
+ process_name="tttracer.exe" OR process_name="vbc.exe" OR process_name="verclsid.exe"
+ OR process_name="wab.exe" OR process_name="wlrmdr.exe" OR process_name="wmic.exe"
+ OR process_name="workfolders.exe" OR process_name="wscript.exe" OR process_name="wsreset.exe"
+ OR process_name="wuauclt.exe" OR process_name="xwizard.exe";
| from $cond_1 | where match_regex(process_path, /(?i)\\windows\\system32/)=false
AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false AND match_regex(process_path,
/(?i)\\windows\\adws/)=false AND match_regex(process_path, /(?i)\\windows\\networkcontroller/)=false
AND match_regex(process_path, /(?i)\\windows\\systemapps/)=false AND match_regex(process_path,
/(?i)\\winsxs/)=false AND match_regex(process_path, /(?i)\\microsoft.net/)=false
- AND match_regex(process_path, /(?i)\\microsoft\\windows defender\\platform/)=false
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(device, user),
body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
process_name]) | into write_ssa_detected_events();'
diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md
index 6e6dce5266..34d700ec51 100644
--- a/docs/_pages/detections.md
+++ b/docs/_pages/detections.md
@@ -166,7 +166,7 @@ sidebar:
| [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Detect Mimikatz Via PowerShell And EventCode 4703](/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703/) | [LSASS Memory](/tags/#lsass-memory) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [Detect Mimikatz With PowerShell Script Block Logging](/endpoint/detect_mimikatz_with_powershell_script_block_logging/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Detect Mimikatz With PowerShell Script Block Logging](/endpoint/detect_mimikatz_with_powershell_script_block_logging/) | [OS Credential Dumping](/tags/#os-credential-dumping), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Detect New Local Admin account](/endpoint/detect_new_local_admin_account/) | [Local Account](/tags/#local-account), [Create Account](/tags/#create-account) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Detect New Login Attempts to Routers](/application/detect_new_login_attempts_to_routers/) | None | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Detect New Open GCP Storage Buckets](/cloud/detect_new_open_gcp_storage_buckets/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -192,6 +192,7 @@ sidebar:
| [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Detect Renamed RClone](/endpoint/detect_renamed_rclone/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Detect Renamed WinRAR](/endpoint/detect_renamed_winrar/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Detect Risky SPL using Pretrained ML Model](/application/detect_risky_spl_using_pretrained_ml_model/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -324,7 +325,6 @@ sidebar:
| [GCP Detect accounts with high risk roles by project](/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project/) | [Valid Accounts](/tags/#valid-accounts) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [GCP Detect gcploit framework](/cloud/gcp_detect_gcploit_framework/) | [Valid Accounts](/tags/#valid-accounts) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [GCP Detect high risk permissions by resource and account](/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account/) | [Valid Accounts](/tags/#valid-accounts) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [GCP GCR container uploaded](/deprecated/gcp_gcr_container_uploaded/) | [Implant Internal Image](/tags/#implant-internal-image) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [GCP Kubernetes cluster pod scan detection](/cloud/gcp_kubernetes_cluster_pod_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [GCP Kubernetes cluster scan detection](/deprecated/gcp_kubernetes_cluster_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [GPUpdate with no Command Line Arguments with Network](/endpoint/gpupdate_with_no_command_line_arguments_with_network/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -345,7 +345,7 @@ sidebar:
| [Get-DomainTrust with PowerShell](/endpoint/get-domaintrust_with_powershell/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Get-DomainTrust with PowerShell Script Block](/endpoint/get-domaintrust_with_powershell_script_block/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Get-ForestTrust with PowerShell](/endpoint/get-foresttrust_with_powershell/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [Get-ForestTrust with PowerShell Script Block](/endpoint/get-foresttrust_with_powershell_script_block/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Get-ForestTrust with PowerShell Script Block](/endpoint/get-foresttrust_with_powershell_script_block/) | [Domain Trust Discovery](/tags/#domain-trust-discovery), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [GetAdComputer with PowerShell](/endpoint/getadcomputer_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [GetAdComputer with PowerShell Script Block](/endpoint/getadcomputer_with_powershell_script_block/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [GetAdGroup with PowerShell](/endpoint/getadgroup_with_powershell/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -359,7 +359,7 @@ sidebar:
| [GetDomainGroup with PowerShell](/endpoint/getdomaingroup_with_powershell/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [GetDomainGroup with PowerShell Script Block](/endpoint/getdomaingroup_with_powershell_script_block/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [GetLocalUser with PowerShell](/endpoint/getlocaluser_with_powershell/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [GetLocalUser with PowerShell Script Block](/endpoint/getlocaluser_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [GetLocalUser with PowerShell Script Block](/endpoint/getlocaluser_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account), [PowerShell](/tags/#powershell) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [GetNetTcpconnection with PowerShell](/endpoint/getnettcpconnection_with_powershell/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [GetNetTcpconnection with PowerShell Script Block](/endpoint/getnettcpconnection_with_powershell_script_block/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [GetWmiObject DS User with PowerShell](/endpoint/getwmiobject_ds_user_with_powershell/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -369,7 +369,7 @@ sidebar:
| [GetWmiObject Ds Group with PowerShell](/endpoint/getwmiobject_ds_group_with_powershell/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [GetWmiObject Ds Group with PowerShell Script Block](/endpoint/getwmiobject_ds_group_with_powershell_script_block/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [GetWmiObject User Account with PowerShell](/endpoint/getwmiobject_user_account_with_powershell/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [GetWmiObject User Account with PowerShell Script Block](/endpoint/getwmiobject_user_account_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [GetWmiObject User Account with PowerShell Script Block](/endpoint/getwmiobject_user_account_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account), [PowerShell](/tags/#powershell) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [GitHub Actions Disable Security Workflow](/cloud/github_actions_disable_security_workflow/) | [Compromise Software Supply Chain](/tags/#compromise-software-supply-chain), [Supply Chain Compromise](/tags/#supply-chain-compromise) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [GitHub Dependabot Alert](/cloud/github_dependabot_alert/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Supply Chain Compromise](/tags/#supply-chain-compromise) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [GitHub Pull Request from Unknown User](/cloud/github_pull_request_from_unknown_user/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Supply Chain Compromise](/tags/#supply-chain-compromise) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -478,6 +478,7 @@ sidebar:
| [Linux System Network Discovery](/endpoint/linux_system_network_discovery/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Linux Visudo Utility Execution](/endpoint/linux_visudo_utility_execution/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Linux pkexec Privilege Escalation](/endpoint/linux_pkexec_privilege_escalation/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Living Off The Land](/endpoint/living_off_the_land/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Correlation](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Loading Of Dynwrapx Module](/endpoint/loading_of_dynwrapx_module/) | [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Local Account Discovery With Wmic](/endpoint/local_account_discovery_with_wmic/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Local Account Discovery with Net](/endpoint/local_account_discovery_with_net/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -501,7 +502,7 @@ sidebar:
| [Malicious PowerShell Process With Obfuscation Techniques](/endpoint/malicious_powershell_process_with_obfuscation_techniques/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Malicious Powershell Executed As A Service](/endpoint/malicious_powershell_executed_as_a_service/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Mimikatz PassTheTicket CommandLine Parameters](/endpoint/mimikatz_passtheticket_commandline_parameters/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Ticket](/tags/#pass-the-ticket) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [MMC](/tags/#mmc) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Modification Of Wallpaper](/endpoint/modification_of_wallpaper/) | [Defacement](/tags/#defacement) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Modify ACL permission To Files Or Folder](/endpoint/modify_acl_permission_to_files_or_folder/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Monitor DNS For Brand Abuse](/deprecated/monitor_dns_for_brand_abuse/) | None | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -524,7 +525,6 @@ sidebar:
| [Network Connection Discovery With Net](/endpoint/network_connection_discovery_with_net/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Network Connection Discovery With Netstat](/endpoint/network_connection_discovery_with_netstat/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Network Discovery Using Route Windows App](/endpoint/network_discovery_using_route_windows_app/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Internet Connection Discovery](/tags/#internet-connection-discovery) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [New container uploaded to AWS ECR](/cloud/new_container_uploaded_to_aws_ecr/) | [Implant Internal Image](/tags/#implant-internal-image) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Nishang PowershellTCPOneLine](/endpoint/nishang_powershelltcponeline/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [No Windows Updates in a time frame](/application/no_windows_updates_in_a_time_frame/) | None | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Non Chrome Process Accessing Chrome Default Dir](/endpoint/non_chrome_process_accessing_chrome_default_dir/) | [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -570,7 +570,7 @@ sidebar:
| [Ping Sleep Batch Command](/endpoint/ping_sleep_batch_command/) | [Virtualization/Sandbox Evasion](/tags/#virtualization/sandbox-evasion), [Time Based Evasion](/tags/#time-based-evasion) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Possible Browser Pass View Parameter](/endpoint/possible_browser_pass_view_parameter/) | [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell), [MMC](/tags/#mmc) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Potential password in username](/endpoint/potential_password_in_username/) | [Local Accounts](/tags/#local-accounts), [Credentials In Files](/tags/#credentials-in-files) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Potentially malicious code on commandline](/endpoint/potentially_malicious_code_on_commandline/) | [Windows Command Shell](/tags/#windows-command-shell) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [PowerShell - Connect To Internet With Hidden Window](/endpoint/powershell_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -579,10 +579,10 @@ sidebar:
| [PowerShell Get LocalGroup Discovery](/endpoint/powershell_get_localgroup_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [PowerShell Loading DotNET into Memory via Reflection](/endpoint/powershell_loading_dotnet_into_memory_via_reflection/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [PowerShell Start-BitsTransfer](/endpoint/powershell_start-bitstransfer/) | [BITS Jobs](/tags/#bits-jobs) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [Powershell Creating Thread Mutex](/endpoint/powershell_creating_thread_mutex/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Powershell Creating Thread Mutex](/endpoint/powershell_creating_thread_mutex/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Powershell Disable Security Monitoring](/endpoint/powershell_disable_security_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Powershell Enable SMB1Protocol Feature](/endpoint/powershell_enable_smb1protocol_feature/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Powershell Fileless Process Injection via GetProcAddress](/endpoint/powershell_fileless_process_injection_via_getprocaddress/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Powershell Fileless Script Contains Base64 Encoded Content](/endpoint/powershell_fileless_script_contains_base64_encoded_content/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Powershell Get LocalGroup Discovery with Script Block Logging](/endpoint/powershell_get_localgroup_discovery_with_script_block_logging/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -611,7 +611,7 @@ sidebar:
| [Randomly Generated Windows Service Name](/endpoint/randomly_generated_windows_service_name/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Ransomware Notes bulk creation](/endpoint/ransomware_notes_bulk_creation/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Recon AVProduct Through Pwh or WMI](/endpoint/recon_avproduct_through_pwh_or_wmi/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Recursive Delete of Directory In Batch CMD](/endpoint/recursive_delete_of_directory_in_batch_cmd/) | [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Reg exe Manipulating Windows Services Registry Keys](/endpoint/reg_exe_manipulating_windows_services_registry_keys/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Reg exe used to hide files directories via registry keys](/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys/) | [Hidden Files and Directories](/tags/#hidden-files-and-directories) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -770,7 +770,7 @@ sidebar:
| [TOR Traffic](/network/tor_traffic/) | [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Time Provider Persistence Registry](/endpoint/time_provider_persistence_registry/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Trickbot Named Pipe](/endpoint/trickbot_named_pipe/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [MMC](/tags/#mmc) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [UAC Bypass With Colorui COM Object](/endpoint/uac_bypass_with_colorui_com_object/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [USN Journal Deletion](/endpoint/usn_journal_deletion/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Uncommon Processes On Endpoint](/deprecated/uncommon_processes_on_endpoint/) | [Malicious File](/tags/#malicious-file) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -818,6 +818,8 @@ sidebar:
| [WinEvent Windows Task Scheduler Event Action Started](/endpoint/winevent_windows_task_scheduler_event_action_started/) | [Scheduled Task](/tags/#scheduled-task) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [WinRM Spawning a Process](/endpoint/winrm_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows AdFind Exe](/endpoint/windows_adfind_exe/) | [Remote System Discovery](/tags/#remote-system-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Application Layer Protocol RMS Radmin Tool Namedpipe](/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe/) | [Application Layer Protocol](/tags/#application-layer-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Binary Proxy Execution Mavinject DLL Injection](/endpoint/windows_binary_proxy_execution_mavinject_dll_injection/) | [Mavinject](/tags/#mavinject), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Command and Scripting Interpreter Hunting Path Traversal](/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Command and Scripting Interpreter Path Traversal Exec](/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Computer Account Created by Computer Account](/endpoint/windows_computer_account_created_by_computer_account/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -847,14 +849,18 @@ sidebar:
| [Windows Excessive Disabled Services Event](/endpoint/windows_excessive_disabled_services_event/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Execute Arbitrary Commands with MSDT](/endpoint/windows_execute_arbitrary_commands_with_msdt/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows File Without Extension In Critical Folder](/endpoint/windows_file_without_extension_in_critical_folder/) | [Data Destruction](/tags/#data-destruction) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Gather Victim Network Info Through Ip Check Web Services](/endpoint/windows_gather_victim_network_info_through_ip_check_web_services/) | [IP Addresses](/tags/#ip-addresses), [Gather Victim Network Information](/tags/#gather-victim-network-information) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Get-AdComputer Unconstrained Delegation Discovery](/endpoint/windows_get-adcomputer_unconstrained_delegation_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Hidden Schedule Task Settings](/endpoint/windows_hidden_schedule_task_settings/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Hide Notification Features Through Registry](/endpoint/windows_hide_notification_features_through_registry/) | [Modify Registry](/tags/#modify-registry) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows High File Deletion Frequency](/endpoint/windows_high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Hunting System Account Targeting Lsass](/endpoint/windows_hunting_system_account_targeting_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows ISO LNK File Creation](/endpoint/windows_iso_lnk_file_creation/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Malicious Link](/tags/#malicious-link), [User Execution](/tags/#user-execution) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Identify Protocol Handlers](/endpoint/windows_identify_protocol_handlers/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Impair Defense Add Xml Applocker Rules](/endpoint/windows_impair_defense_add_xml_applocker_rules/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Impair Defense Delete Win Defender Context Menu](/endpoint/windows_impair_defense_delete_win_defender_context_menu/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Impair Defense Delete Win Defender Profile Registry](/endpoint/windows_impair_defense_delete_win_defender_profile_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Impair Defense Deny Security Software With Applocker](/endpoint/windows_impair_defense_deny_security_software_with_applocker/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Impair Defenses Disable Win Defender Auto Logging](/endpoint/windows_impair_defenses_disable_win_defender_auto_logging/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Indirect Command Execution Via forfiles](/endpoint/windows_indirect_command_execution_via_forfiles/) | [Indirect Command Execution](/tags/#indirect-command-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Indirect Command Execution Via pcalua](/endpoint/windows_indirect_command_execution_via_pcalua/) | [Indirect Command Execution](/tags/#indirect-command-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -869,21 +875,33 @@ sidebar:
| [Windows Kerberos Local Successful Logon](/endpoint/windows_kerberos_local_successful_logon/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows KrbRelayUp Service Creation](/endpoint/windows_krbrelayup_service_creation/) | [Windows Service](/tags/#windows-service) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Linked Policies In ADSI Discovery](/endpoint/windows_linked_policies_in_adsi_discovery/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows MOF Event Triggered Execution via WMI](/endpoint/windows_mof_event_triggered_execution_via_wmi/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows MSIExec DLLRegisterServer](/endpoint/windows_msiexec_dllregisterserver/) | [Msiexec](/tags/#msiexec) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows MSIExec Remote Download](/endpoint/windows_msiexec_remote_download/) | [Msiexec](/tags/#msiexec) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows MSIExec Spawn Discovery Command](/endpoint/windows_msiexec_spawn_discovery_command/) | [Msiexec](/tags/#msiexec) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows MSIExec Unregister DLLRegisterServer](/endpoint/windows_msiexec_unregister_dllregisterserver/) | [Msiexec](/tags/#msiexec) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows MSIExec With Network Connections](/endpoint/windows_msiexec_with_network_connections/) | [Msiexec](/tags/#msiexec) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Modify Registry DisAllow Windows App](/endpoint/windows_modify_registry_disallow_windows_app/) | [Modify Registry](/tags/#modify-registry) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Modify Registry Disable Toast Notifications](/endpoint/windows_modify_registry_disable_toast_notifications/) | [Modify Registry](/tags/#modify-registry) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Modify Registry Disable Win Defender Raw Write Notif](/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif/) | [Modify Registry](/tags/#modify-registry) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Modify Registry Disable Windows Security Center Notif](/endpoint/windows_modify_registry_disable_windows_security_center_notif/) | [Modify Registry](/tags/#modify-registry) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Modify Registry Disabling WER Settings](/endpoint/windows_modify_registry_disabling_wer_settings/) | [Modify Registry](/tags/#modify-registry) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Modify Registry Regedit Silent Reg Import](/endpoint/windows_modify_registry_regedit_silent_reg_import/) | [Modify Registry](/tags/#modify-registry) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Modify Registry Suppress Win Defender Notif](/endpoint/windows_modify_registry_suppress_win_defender_notif/) | [Modify Registry](/tags/#modify-registry) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Modify Show Compress Color And Info Tip Registry](/endpoint/windows_modify_show_compress_color_and_info_tip_registry/) | [Modify Registry](/tags/#modify-registry) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows NirSoft AdvancedRun](/endpoint/windows_nirsoft_advancedrun/) | [Tool](/tags/#tool) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows NirSoft Utilities](/endpoint/windows_nirsoft_utilities/) | [Tool](/tags/#tool) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Non-System Account Targeting Lsass](/endpoint/windows_non-system_account_targeting_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Odbcconf Hunting](/endpoint/windows_odbcconf_hunting/) | [Odbcconf](/tags/#odbcconf) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Odbcconf Load DLL](/endpoint/windows_odbcconf_load_dll/) | [Odbcconf](/tags/#odbcconf) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Odbcconf Load Response File](/endpoint/windows_odbcconf_load_response_file/) | [Odbcconf](/tags/#odbcconf) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Office Product Spawning MSDT](/endpoint/windows_office_product_spawning_msdt/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Possible Credential Dumping](/endpoint/windows_possible_credential_dumping/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows PowerView Constrained Delegation Discovery](/endpoint/windows_powerview_constrained_delegation_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows PowerView Kerberos Service Ticket Request](/endpoint/windows_powerview_kerberos_service_ticket_request/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows PowerView SPN Discovery](/endpoint/windows_powerview_spn_discovery/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows PowerView Unconstrained Delegation Discovery](/endpoint/windows_powerview_unconstrained_delegation_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Powershell Import Applocker Policy](/endpoint/windows_powershell_import_applocker_policy/) | [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Process With NamedPipe CommandLine](/endpoint/windows_process_with_namedpipe_commandline/) | [Process Injection](/tags/#process-injection) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Processes Killed By Industroyer2 Malware](/endpoint/windows_processes_killed_by_industroyer2_malware/) | [Service Stop](/tags/#service-stop) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Raccine Scheduled Task Deletion](/endpoint/windows_raccine_scheduled_task_deletion/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -893,7 +911,12 @@ sidebar:
| [Windows Registry Certificate Added](/endpoint/windows_registry_certificate_added/) | [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Registry Delete Task SD](/endpoint/windows_registry_delete_task_sd/) | [Scheduled Task](/tags/#scheduled-task), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Registry Modification for Safe Mode Persistence](/endpoint/windows_registry_modification_for_safe_mode_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Remote Access Software RMS Registry](/endpoint/windows_remote_access_software_rms_registry/) | [Remote Access Software](/tags/#remote-access-software) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Remote Assistance Spawning Process](/endpoint/windows_remote_assistance_spawning_process/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Remote Service Rdpwinst Tool Execution](/endpoint/windows_remote_service_rdpwinst_tool_execution/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Remote Services Allow Rdp In Firewall](/endpoint/windows_remote_services_allow_rdp_in_firewall/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Remote Services Allow Remote Assistance](/endpoint/windows_remote_services_allow_remote_assistance/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Remote Services Rdp Enable](/endpoint/windows_remote_services_rdp_enable/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Root Domain linked policies Discovery](/endpoint/windows_root_domain_linked_policies_discovery/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Schtasks Create Run As System](/endpoint/windows_schtasks_create_run_as_system/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Security Account Manager Stopped](/endpoint/windows_security_account_manager_stopped/) | [Service Stop](/tags/#service-stop) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -903,9 +926,11 @@ sidebar:
| [Windows Service Creation Using Registry Entry](/endpoint/windows_service_creation_using_registry_entry/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Service Creation on Remote Endpoint](/endpoint/windows_service_creation_on_remote_endpoint/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Service Initiation on Remote Endpoint](/endpoint/windows_service_initiation_on_remote_endpoint/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Service Stop By Deletion](/endpoint/windows_service_stop_by_deletion/) | [Service Stop](/tags/#service-stop) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows System File on Disk](/endpoint/windows_system_file_on_disk/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Terminating Lsass Process](/endpoint/windows_terminating_lsass_process/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows Users Authenticate Using Explicit Credentials](/endpoint/windows_users_authenticate_using_explicit_credentials/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Valid Account With Never Expires Password](/endpoint/windows_valid_account_with_never_expires_password/) | [Service Stop](/tags/#service-stop) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows WMI Process Call Create](/endpoint/windows_wmi_process_call_create/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows connhost exe started forcefully](/deprecated/windows_connhost_exe_started_forcefully/) | [Windows Command Shell](/tags/#windows-command-shell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Windows hosts file modification](/deprecated/windows_hosts_file_modification/) | None | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md
index ef936fc084..695c5a4275 100644
--- a/docs/_pages/stories.md
+++ b/docs/_pages/stories.md
@@ -18,13 +18,14 @@ sidebar:
| [AWS Suspicious Provisioning Activities](aws_suspicious_provisioning_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
| [AWS User Monitoring](aws_user_monitoring) | [Cloud Service Discovery](/tags/#cloud-service-discovery), [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [AcidRain](acidrain) | [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact) |
-| [Active Directory Discovery](active_directory_discovery) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Remote System Discovery](/tags/#remote-system-discovery), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [Local Groups](/tags/#local-groups), [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Local Account](/tags/#local-account), [System Network Connections Discovery](/tags/#system-network-connections-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Internet Connection Discovery](/tags/#internet-connection-discovery), [Kerberoasting](/tags/#kerberoasting), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Credential Access](/tags/#credential-access), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
+| [Active Directory Discovery](active_directory_discovery) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Remote System Discovery](/tags/#remote-system-discovery), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [PowerShell](/tags/#powershell), [Local Groups](/tags/#local-groups), [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Local Account](/tags/#local-account), [System Network Connections Discovery](/tags/#system-network-connections-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Internet Connection Discovery](/tags/#internet-connection-discovery), [Kerberoasting](/tags/#kerberoasting), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Credential Access](/tags/#credential-access), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Active Directory Kerberos Attacks](active_directory_kerberos_attacks) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [AS-REP Roasting](/tags/#as-rep-roasting), [Kerberoasting](/tags/#kerberoasting), [Golden Ticket](/tags/#golden-ticket), [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Gather Victim Identity Information](/tags/#gather-victim-identity-information), [Email Addresses](/tags/#email-addresses), [Pass the Ticket](/tags/#pass-the-ticket), [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force), [OS Credential Dumping](/tags/#os-credential-dumping), [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts), [Remote System Discovery](/tags/#remote-system-discovery) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
-| [Active Directory Lateral Movement](active_directory_lateral_movement) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Windows Remote Management](/tags/#windows-remote-management), [Scheduled Task](/tags/#scheduled-task), [PowerShell](/tags/#powershell), [Scheduled Task/Job](/tags/#scheduled-task/job), [At](/tags/#at), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
+| [Active Directory Lateral Movement](active_directory_lateral_movement) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Windows Remote Management](/tags/#windows-remote-management), [MMC](/tags/#mmc), [Scheduled Task](/tags/#scheduled-task), [PowerShell](/tags/#powershell), [Scheduled Task/Job](/tags/#scheduled-task/job), [At](/tags/#at), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Active Directory Password Spraying](active_directory_password_spraying) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Credential Access](/tags/#credential-access) |
| [Apache Struts Vulnerability](apache_struts_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) |
| [Asset Tracking](asset_tracking) | None | None |
| [Atlassian Confluence Server and Data Center CVE-2022-26134](atlassian_confluence_server_and_data_center_cve-2022-26134) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Server Software Component](/tags/#server-software-component) | [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
+| [Azorult](azorult) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Account Control](/tags/#bypass-user-account-control), [Service Stop](/tags/#service-stop), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Account Access Removal](/tags/#account-access-removal), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Masquerading](/tags/#masquerading), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups), [System Network Connections Discovery](/tags/#system-network-connections-discovery), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job), [Application Layer Protocol](/tags/#application-layer-protocol), [IP Addresses](/tags/#ip-addresses), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Modify Registry](/tags/#modify-registry), [PowerShell](/tags/#powershell), [Remote Access Software](/tags/#remote-access-software) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
| [BITS Jobs](bits_jobs) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence) |
| [Baron Samedit CVE-2021-3156](baron_samedit_cve-2021-3156) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
| [BlackMatter Ransomware](blackmatter_ransomware) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Defacement](/tags/#defacement), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Credential Access](/tags/#credential-access), [Impact](/tags/#impact) |
@@ -38,7 +39,7 @@ sidebar:
| [Collection and Staging](collection_and_staging) | [Masquerading](/tags/#masquerading), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Email Collection](/tags/#email-collection), [Local Email Collection](/tags/#local-email-collection), [Remote Email Collection](/tags/#remote-email-collection) | [Collection](/tags/#collection), [Defense Evasion](/tags/#defense-evasion) |
| [Command and Control](command_and_control) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [DNS](/tags/#dns), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) |
| [Common Phishing Frameworks](common_phishing_frameworks) | [Spearphishing via Service](/tags/#spearphishing-via-service) | [Initial Access](/tags/#initial-access) |
-| [Container Implantation Monitoring and Investigation](container_implantation_monitoring_and_investigation) | [Implant Internal Image](/tags/#implant-internal-image) | [Persistence](/tags/#persistence) |
+| [Container Implantation Monitoring and Investigation](container_implantation_monitoring_and_investigation) | None | None |
| [Credential Dumping](credential_dumping) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager), [NTDS](/tags/#ntds), [Modify Registry](/tags/#modify-registry), [Local Accounts](/tags/#local-accounts), [Credentials In Files](/tags/#credentials-in-files), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [CyclopsBLink](cyclopsblink) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses), [Masquerade Task or Service](/tags/#masquerade-task-or-service), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
| [DHS Report TA18-074A](dhs_report_ta18-074a) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Modify Registry](/tags/#modify-registry), [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
@@ -61,11 +62,11 @@ sidebar:
| [FIN7](fin7) | [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Visual Basic](/tags/#visual-basic), [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation), [XSL Script Processing](/tags/#xsl-script-processing) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [GCP Cross Account Activity](gcp_cross_account_activity) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [HAFNIUM Group](hafnium_group) | [LSASS Memory](/tags/#lsass-memory), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [OS Credential Dumping](/tags/#os-credential-dumping), [NTDS](/tags/#ntds), [Email Collection](/tags/#email-collection), [Remote Email Collection](/tags/#remote-email-collection) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence) |
-| [Hermetic Wiper](hermetic_wiper) | [PowerShell](/tags/#powershell), [Malicious File](/tags/#malicious-file), [Active Setup](/tags/#active-setup), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution), [Windows Command Shell](/tags/#windows-command-shell), [OS Credential Dumping](/tags/#os-credential-dumping), [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Accessibility Features](/tags/#accessibility-features), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Process Injection](/tags/#process-injection), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32), [Access Token Manipulation](/tags/#access-token-manipulation), [Token Impersonation/Theft](/tags/#token-impersonation/theft), [Screensaver](/tags/#screensaver), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Time Providers](/tags/#time-providers), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Data Destruction](/tags/#data-destruction), [Modify Registry](/tags/#modify-registry), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Print Processors](/tags/#print-processors) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
+| [Hermetic Wiper](hermetic_wiper) | [PowerShell](/tags/#powershell), [Malicious File](/tags/#malicious-file), [Active Setup](/tags/#active-setup), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution), [Windows Command Shell](/tags/#windows-command-shell), [OS Credential Dumping](/tags/#os-credential-dumping), [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Accessibility Features](/tags/#accessibility-features), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [MMC](/tags/#mmc), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Process Injection](/tags/#process-injection), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32), [Access Token Manipulation](/tags/#access-token-manipulation), [Token Impersonation/Theft](/tags/#token-impersonation/theft), [Screensaver](/tags/#screensaver), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Time Providers](/tags/#time-providers), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Data Destruction](/tags/#data-destruction), [Modify Registry](/tags/#modify-registry), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Print Processors](/tags/#print-processors) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
| [Hidden Cobra Malware](hidden_cobra_malware) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Network Share Connection Removal](/tags/#network-share-connection-removal), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol), [DNS](/tags/#dns), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Lateral Movement](/tags/#lateral-movement) |
| [Host Redirection](host_redirection) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [DNS](/tags/#dns) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration) |
| [IcedID](icedid) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Process Injection](/tags/#process-injection), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Scheduled Task](/tags/#scheduled-task) | [Collection](/tags/#collection), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
-| [Industroyer2](industroyer2) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [LSASS Memory](/tags/#lsass-memory), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data Destruction](/tags/#data-destruction), [Service Stop](/tags/#service-stop), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
+| [Industroyer2](industroyer2) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [LSASS Memory](/tags/#lsass-memory), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data Destruction](/tags/#data-destruction), [Service Stop](/tags/#service-stop), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Gather Victim Host Information](/tags/#gather-victim-host-information), [PowerShell](/tags/#powershell), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
| [Information Sabotage](information_sabotage) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Exfiltration](/tags/#exfiltration) |
| [Ingress Tool Transfer](ingress_tool_transfer) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [BITS Jobs](/tags/#bits-jobs) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence) |
| [Insider Threat](insider_threat) | [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service), [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force), [Local Accounts](/tags/#local-accounts), [Credentials In Files](/tags/#credentials-in-files) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
@@ -76,10 +77,10 @@ sidebar:
| [Linux Persistence Techniques](linux_persistence_techniques) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At](/tags/#at), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers), [Data Destruction](/tags/#data-destruction) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Linux Post-Exploitation](linux_post-exploitation) | [Unix Shell](/tags/#unix-shell) | [Execution](/tags/#execution) |
| [Linux Privilege Escalation](linux_privilege_escalation) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At](/tags/#at), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers), [Data Destruction](/tags/#data-destruction) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
-| [Living Off The Land](living_off_the_land) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Control Panel](/tags/#control-panel), [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping), [Compiled HTML File](/tags/#compiled-html-file), [Mshta](/tags/#mshta), [Regsvcs/Regasm](/tags/#regsvcs/regasm), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [LSASS Memory](/tags/#lsass-memory), [Security Account Manager](/tags/#security-account-manager), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Unix Shell](/tags/#unix-shell), [Plist File Modification](/tags/#plist-file-modification), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Injection](/tags/#process-injection), [Modify Registry](/tags/#modify-registry), [Scheduled Task/Job](/tags/#scheduled-task/job), [At](/tags/#at), [Scheduled Task](/tags/#scheduled-task), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service), [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Indirect Command Execution](/tags/#indirect-command-execution), [InstallUtil](/tags/#installutil) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
+| [Living Off The Land](living_off_the_land) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Control Panel](/tags/#control-panel), [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping), [Compiled HTML File](/tags/#compiled-html-file), [Mshta](/tags/#mshta), [Regsvcs/Regasm](/tags/#regsvcs/regasm), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [LSASS Memory](/tags/#lsass-memory), [Security Account Manager](/tags/#security-account-manager), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Unix Shell](/tags/#unix-shell), [Plist File Modification](/tags/#plist-file-modification), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [MMC](/tags/#mmc), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Injection](/tags/#process-injection), [Modify Registry](/tags/#modify-registry), [Scheduled Task/Job](/tags/#scheduled-task/job), [At](/tags/#at), [Scheduled Task](/tags/#scheduled-task), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service), [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Mavinject](/tags/#mavinject), [Indirect Command Execution](/tags/#indirect-command-execution), [InstallUtil](/tags/#installutil), [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription), [Odbcconf](/tags/#odbcconf) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Local Privilege Escalation With KrbRelayUp](local_privilege_escalation_with_krbrelayup) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Windows Service](/tags/#windows-service) | [Credential Access](/tags/#credential-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Log4Shell CVE-2021-44228](log4shell_cve-2021-44228) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Windows Command Shell](/tags/#windows-command-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Command And Control](/tags/#command-and-control), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) |
-| [Malicious PowerShell](malicious_powershell) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Process Injection](/tags/#process-injection), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
+| [Malicious PowerShell](malicious_powershell) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [MMC](/tags/#mmc), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Process Injection](/tags/#process-injection), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Kerberoasting](/tags/#kerberoasting), [Impair Defenses](/tags/#impair-defenses) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
| [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact) |
| [Meterpreter](meterpreter) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Execution](/tags/#execution) |
| [Microsoft MSHTML Remote Code Execution CVE-2021-40444](microsoft_mshtml_remote_code_execution_cve-2021-40444) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Control Panel](/tags/#control-panel), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access) |
@@ -97,7 +98,7 @@ sidebar:
| [PrintNightmare CVE-2021-34527](printnightmare_cve-2021-34527) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Prohibited Traffic Allowed or Protocol Mismatch](prohibited_traffic_allowed_or_protocol_mismatch) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement) |
| [ProxyShell](proxyshell) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
-| [Ransomware](ransomware) | [Scheduled Task](/tags/#scheduled-task), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Service Stop](/tags/#service-stop), [Account Access Removal](/tags/#account-access-removal), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Visual Basic](/tags/#visual-basic), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Msiexec](/tags/#msiexec), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance), [Resource Development](/tags/#resource-development) |
+| [Ransomware](ransomware) | [Scheduled Task](/tags/#scheduled-task), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Service Stop](/tags/#service-stop), [Account Access Removal](/tags/#account-access-removal), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Visual Basic](/tags/#visual-basic), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [PowerShell](/tags/#powershell), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Msiexec](/tags/#msiexec), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance), [Resource Development](/tags/#resource-development) |
| [Ransomware Cloud](ransomware_cloud) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
| [Remcos](remcos) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Component Object Model](/tags/#component-object-model), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Screen Capture](/tags/#screen-capture), [Visual Basic](/tags/#visual-basic), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Collection](/tags/#collection), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
| [Revil Ransomware](revil_ransomware) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [User Execution](/tags/#user-execution), [Modify Registry](/tags/#modify-registry), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
@@ -109,7 +110,7 @@ sidebar:
| [Silver Sparrow](silver_sparrow) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Spearphishing Attachments](spearphishing_attachments) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Spearphishing Link](/tags/#spearphishing-link), [Malicious Link](/tags/#malicious-link), [User Execution](/tags/#user-execution) | [Credential Access](/tags/#credential-access), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) |
| [Spectre And Meltdown Vulnerabilities](spectre_and_meltdown_vulnerabilities) | None | None |
-| [Splunk Vulnerabilities](splunk_vulnerabilities) | [File and Directory Discovery](/tags/#file-and-directory-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Digital Certificates](/tags/#digital-certificates), [Network Denial of Service](/tags/#network-denial-of-service), [Process Injection](/tags/#process-injection), [Protocol Impersonation](/tags/#protocol-impersonation), [Digital Certificates](/tags/#digital-certificates), [Valid Accounts](/tags/#valid-accounts), [Drive-by Compromise](/tags/#drive-by-compromise), [Network Sniffing](/tags/#network-sniffing) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Resource Development](/tags/#resource-development) |
+| [Splunk Vulnerabilities](splunk_vulnerabilities) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Digital Certificates](/tags/#digital-certificates), [Network Denial of Service](/tags/#network-denial-of-service), [Process Injection](/tags/#process-injection), [Protocol Impersonation](/tags/#protocol-impersonation), [Digital Certificates](/tags/#digital-certificates), [Valid Accounts](/tags/#valid-accounts), [Drive-by Compromise](/tags/#drive-by-compromise), [Network Sniffing](/tags/#network-sniffing) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Resource Development](/tags/#resource-development) |
| [Spring4Shell CVE-2022-22965](spring4shell_cve-2022-22965) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Web Shell](/tags/#web-shell), [Server Software Component](/tags/#server-software-component) | [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
| [Suspicious AWS EC2 Activities](suspicious_aws_ec2_activities) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Suspicious AWS Login Activities](suspicious_aws_login_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions), [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
@@ -142,7 +143,7 @@ sidebar:
| [Web Fraud Detection](web_fraud_detection) | [Create Account](/tags/#create-account), [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [WhisperGate](whispergate) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Data Destruction](/tags/#data-destruction), [Masquerading](/tags/#masquerading), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Virtualization/Sandbox Evasion](/tags/#virtualization/sandbox-evasion), [Time Based Evasion](/tags/#time-based-evasion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Visual Basic](/tags/#visual-basic), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe), [Process Injection](/tags/#process-injection), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Resource Development](/tags/#resource-development) |
| [Windows DNS SIGRed CVE-2020-1350](windows_dns_sigred_cve-2020-1350) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) |
-| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Compile After Delivery](/tags/#compile-after-delivery), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Modify Registry](/tags/#modify-registry), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Privilege Escalation](/tags/#privilege-escalation) |
+| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Compile After Delivery](/tags/#compile-after-delivery), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Modify Registry](/tags/#modify-registry), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [MMC](/tags/#mmc), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Privilege Escalation](/tags/#privilege-escalation) |
| [Windows Discovery Techniques](windows_discovery_techniques) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
| [Windows Drivers](windows_drivers) | [Rootkit](/tags/#rootkit), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
| [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Rename System Utilities](/tags/#rename-system-utilities), [Change Default File Association](/tags/#change-default-file-association), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
diff --git a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md
index f51059115f..d284f074ec 100644
--- a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md
+++ b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md
@@ -106,8 +106,8 @@ The search is used to detect systems that are still vulnerable to the Spectre an
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **spectre_and_meltdown_vulnerable_systems_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
index 658c53560a..ec79fde91f 100644
--- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
+++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
@@ -104,8 +104,8 @@ The search queries the authentication logs for assets that are categorized as ro
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_new_login_attempts_to_routers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md
index 64449b47a3..d485eb70b4 100644
--- a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md
+++ b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md
@@ -99,8 +99,8 @@ This search returns a list of hosts that have not successfully completed a backu
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **extended_period_without_successful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md
index 14cc93f2cc..31a66e2bfa 100644
--- a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md
+++ b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md
@@ -98,8 +98,8 @@ This search gives you the hosts where a backup was attempted and then failed.
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **unsuccessful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
index 1b3ac7265c..fe4ce2296c 100644
--- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
+++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
@@ -106,8 +106,8 @@ This search looks for Windows endpoints that have not generated an event indicat
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **no_windows_updates_in_a_time_frame_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
index 6c4980927b..d522844132 100644
--- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
+++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
@@ -103,8 +103,8 @@ Attackers often use spaces as a means to obfuscate an attachment's file extensio
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **email_attachments_with_lots_of_spaces_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
index 76b52316e2..410a212365 100644
--- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
+++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
@@ -104,8 +104,8 @@ This search looks for specific GET or HEAD requests to web servers that are indi
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_attackers_scanning_for_vulnerable_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
index 375df95954..421516f284 100644
--- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
+++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
@@ -109,8 +109,8 @@ This search is used to detect malicious HTTP requests crafted to exploit jmx-con
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_malicious_requests_to_exploit_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md
index 9575dc6049..351df8d65f 100644
--- a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md
+++ b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md
@@ -96,8 +96,8 @@ This search looks for DNS requests for faux domains similar to the domains that
#### Macros
The SPL above uses the following Macros:
* [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **monitor_dns_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
index 03d124960f..e9ed6c984d 100644
--- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
+++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
@@ -101,8 +101,8 @@ This search looks for Web requests to faux domains similar to the one that you w
#### Macros
The SPL above uses the following Macros:
* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **monitor_web_traffic_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-11-27-detect_usb_device_insertion.md b/docs/_posts/2017-11-27-detect_usb_device_insertion.md
index 6bcf6212ef..d728677662 100644
--- a/docs/_posts/2017-11-27-detect_usb_device_insertion.md
+++ b/docs/_posts/2017-11-27-detect_usb_device_insertion.md
@@ -100,8 +100,8 @@ The search is used to detect hosts that generate Windows Event ID 4663 for succe
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_usb_device_insertion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
index 155282e149..bfdf6ece90 100644
--- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
+++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
@@ -105,8 +105,8 @@ This search looks for emails claiming to be sent from a domain similar to one th
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **monitor_email_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md
index 256ee9687b..5208a6be64 100644
--- a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md
+++ b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md
@@ -110,8 +110,8 @@ This search looks for AWS CloudTrail events where an instance is started in a pa
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **ec2_instance_started_in_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md
index a7a3e55b1d..3c1752ed2c 100644
--- a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md
+++ b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md
@@ -106,8 +106,8 @@ This search looks for EC2 instances being created with previously unseen AMIs.
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **ec2_instance_started_with_previously_unseen_ami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md
index 5d9fec816d..3bc744ed03 100644
--- a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md
+++ b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md
@@ -117,8 +117,8 @@ This search detects new API calls that have either never been seen before or tha
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **detect_new_api_calls_from_user_roles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
index bbb21c3187..ba87d130b6 100644
--- a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
+++ b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
@@ -124,8 +124,8 @@ This search will detect users creating spikes in API activity related to securit
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **detect_spike_in_security_group_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md
index cfa1600f09..2a13cabd7e 100644
--- a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md
+++ b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md
@@ -101,8 +101,8 @@ This search looks for AWS CloudTrail events where a user logged into the AWS acc
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **detect_api_activity_from_users_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
index 7ed3679870..638971b92a 100644
--- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
+++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
@@ -110,8 +110,8 @@ This search looks for outbound ICMP packets with a packet size larger than 1,000
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_large_outbound_icmp_packets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
index f4a348e37c..473271fdc1 100644
--- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
+++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
@@ -118,8 +118,8 @@ This search looks at S3 bucket-access logs and detects new or previously unseen
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [aws_s3_accesslogs](https://github.com/splunk/security_content/blob/develop/macros/aws_s3_accesslogs.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **detect_s3_access_from_a_new_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
index 7ddc9ec68b..5604b56488 100644
--- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
+++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
@@ -114,8 +114,8 @@ This search looks for the creation of WMI permanent event subscriptions.
#### Macros
The SPL above uses the following Macros:
-* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
> :information_source:
> **wmi_permanent_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
index 02ca8ce578..71d6f444e4 100644
--- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
+++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
@@ -113,8 +113,8 @@ This search looks for the creation of WMI temporary event subscriptions.
#### Macros
The SPL above uses the following Macros:
-* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
> :information_source:
> **wmi_temporary_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-11-02-windows_hosts_file_modification.md b/docs/_posts/2018-11-02-windows_hosts_file_modification.md
index 7af88de92d..a4d2ecf6d7 100644
--- a/docs/_posts/2018-11-02-windows_hosts_file_modification.md
+++ b/docs/_posts/2018-11-02-windows_hosts_file_modification.md
@@ -104,8 +104,8 @@ The search looks for modifications to the hosts file on all Windows endpoints ac
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_hosts_file_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md
index 80916277f9..e330d0107c 100644
--- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md
+++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md
@@ -111,8 +111,8 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote
#### Macros
The SPL above uses the following Macros:
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **remote_wmi_command_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-12-03-usn_journal_deletion.md b/docs/_posts/2018-12-03-usn_journal_deletion.md
index 3c7e03fb3e..c7193842d3 100644
--- a/docs/_posts/2018-12-03-usn_journal_deletion.md
+++ b/docs/_posts/2018-12-03-usn_journal_deletion.md
@@ -113,8 +113,8 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **usn_journal_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-12-14-file_with_samsam_extension.md b/docs/_posts/2018-12-14-file_with_samsam_extension.md
index 7fce34dd7a..92a288413c 100644
--- a/docs/_posts/2018-12-14-file_with_samsam_extension.md
+++ b/docs/_posts/2018-12-14-file_with_samsam_extension.md
@@ -101,8 +101,8 @@ The search looks for file writes with extensions consistent with a SamSam ransom
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **file_with_samsam_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-12-14-samsam_test_file_write.md b/docs/_posts/2018-12-14-samsam_test_file_write.md
index 99c865c735..57b1aa725c 100644
--- a/docs/_posts/2018-12-14-samsam_test_file_write.md
+++ b/docs/_posts/2018-12-14-samsam_test_file_write.md
@@ -107,8 +107,8 @@ The search looks for a file named "test.txt" written to the windows system direc
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **samsam_test_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md
index dae186beec..47ee78a2f2 100644
--- a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md
+++ b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md
@@ -112,8 +112,8 @@ This search looks for PowerShell requesting privileges consistent with credentia
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **detect_mimikatz_via_powershell_and_eventcode_4703_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md
index 22f0bac396..48fbc32d63 100644
--- a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md
+++ b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md
@@ -107,8 +107,8 @@ The search looks for command-line arguments used to hide a file or directory usi
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **reg_exe_used_to_hide_files_directories_via_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
index da386816ec..36e29731e8 100644
--- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
+++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
@@ -108,8 +108,8 @@ This search looks for suspicious processes on all systems labeled as web servers
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **web_servers_executing_suspicious_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-04-25-suspicious_file_write.md b/docs/_posts/2019-04-25-suspicious_file_write.md
index 16d8353900..d7830d2ff0 100644
--- a/docs/_posts/2019-04-25-suspicious_file_write.md
+++ b/docs/_posts/2019-04-25-suspicious_file_write.md
@@ -100,8 +100,8 @@ The search looks for files created with names that have been linked to malicious
#### Macros
The SPL above uses the following Macros:
* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
index 68572ad175..903fc504cb 100644
--- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
+++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
@@ -106,8 +106,8 @@ Command lines that are extremely long may be indicative of malicious activity on
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **unusually_long_command_line_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md
index 700f99aa56..52db687451 100644
--- a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md
+++ b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md
@@ -103,8 +103,8 @@ This search looks for applications on the endpoint that you have marked as prohi
#### Macros
The SPL above uses the following Macros:
* [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **prohibited_software_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
index be75b3546b..875ff5b43e 100644
--- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
+++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
@@ -114,8 +114,8 @@ This search looks for reading lsass memory consistent with credential dumping.
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **detect_credential_dumping_through_lsass_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
index 3de046b373..445b0aa8ec 100644
--- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
+++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
@@ -113,8 +113,8 @@ This search looks for reading loaded Images unique to credential dumping with Mi
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **detect_mimikatz_using_loaded_images_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
index ade57132a5..6228d32f4a 100644
--- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
+++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
@@ -111,8 +111,8 @@ Detect memory dumping of the LSASS process.
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **access_lsass_memory_for_dump_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
index be36a668be..01a8bca88b 100644
--- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
+++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
@@ -111,8 +111,8 @@ Detect remote thread creation into LSASS consistent with credential dumping.
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **create_remote_thread_into_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md
index f7818c9cf6..6ce1a2e91d 100644
--- a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md
+++ b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md
@@ -106,8 +106,8 @@ This search detects loading of unsigned images by LSASS. Deprecated because too
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **unsigned_image_loaded_by_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-12-10-creation_of_shadow_copy.md b/docs/_posts/2019-12-10-creation_of_shadow_copy.md
index 1da58c7e7f..08da7eedb3 100644
--- a/docs/_posts/2019-12-10-creation_of_shadow_copy.md
+++ b/docs/_posts/2019-12-10-creation_of_shadow_copy.md
@@ -112,8 +112,8 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **creation_of_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
index 0d2319e660..0634b112b0 100644
--- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
+++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
@@ -123,8 +123,8 @@ This search allows you to identify DNS requests that are unusually large for the
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **dns_query_length_outliers_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
index d877cebd94..e89e183dd1 100644
--- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
+++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
@@ -111,8 +111,8 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **creation_of_lsass_dump_with_taskmgr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md
index 89f684f87a..68804c7335 100644
--- a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md
+++ b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md
@@ -108,8 +108,8 @@ This search looks for EC2 instances being created with previously unseen instanc
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **ec2_instance_started_with_previously_unseen_instance_type_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
index 950d215c37..39452d1266 100644
--- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
+++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
@@ -102,8 +102,8 @@ This search looks for processes referencing the plist files that determine which
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **macos_-_re-opened_applications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
index 4da5e0416f..9f92f7ce49 100644
--- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
+++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
@@ -114,8 +114,8 @@ Detect the usage of comsvcs.dll for dumping the lsass process.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **dump_lsass_via_comsvcs_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-03-02-remote_registry_key_modifications.md b/docs/_posts/2020-03-02-remote_registry_key_modifications.md
index 31c7141664..9182f443c0 100644
--- a/docs/_posts/2020-03-02-remote_registry_key_modifications.md
+++ b/docs/_posts/2020-03-02-remote_registry_key_modifications.md
@@ -98,8 +98,8 @@ This search monitors for remote modifications to registry keys.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **remote_registry_key_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
index b0acf6b1a0..33c18be258 100644
--- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
+++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
@@ -116,8 +116,8 @@ This search looks for child processes of spoolsv.exe. This activity is associate
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **child_processes_of_spoolsv_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md
index 22a46cbcac..11c14b9a07 100644
--- a/docs/_posts/2020-03-16-detect_rare_executables.md
+++ b/docs/_posts/2020-03-16-detect_rare_executables.md
@@ -114,8 +114,8 @@ This search will return a table of rare processes, the names of the systems runn
#### Macros
The SPL above uses the following Macros:
* [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_rare_executables_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-03-16-process_execution_via_wmi.md b/docs/_posts/2020-03-16-process_execution_via_wmi.md
index 8b0f895a95..ee4bab1330 100644
--- a/docs/_posts/2020-03-16-process_execution_via_wmi.md
+++ b/docs/_posts/2020-03-16-process_execution_via_wmi.md
@@ -110,8 +110,8 @@ The following analytic identifies `WmiPrvSE.exe` spawning a process. This typica
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **process_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-03-16-script_execution_via_wmi.md b/docs/_posts/2020-03-16-script_execution_via_wmi.md
index 8297eac46d..8cfa6e77a5 100644
--- a/docs/_posts/2020-03-16-script_execution_via_wmi.md
+++ b/docs/_posts/2020-03-16-script_execution_via_wmi.md
@@ -110,8 +110,8 @@ This search looks for scripts launched via WMI.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **script_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
index 1309557b22..f8e8536bb0 100644
--- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
+++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
@@ -103,8 +103,8 @@ This search provides information of unauthenticated requests via user agent, and
#### Macros
The SPL above uses the following Macros:
-* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
> :information_source:
> **amazon_eks_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
index 881939da87..a963f0417f 100644
--- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
+++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
@@ -103,8 +103,8 @@ This search provides detection information on unauthenticated requests against K
#### Macros
The SPL above uses the following Macros:
-* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
> :information_source:
> **amazon_eks_kubernetes_pod_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
index 190595c646..6314c7448b 100644
--- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
+++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
@@ -113,9 +113,9 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **first_time_seen_child_process_of_zoom_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
index fca76e2e1c..e170e0f832 100644
--- a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
+++ b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
@@ -123,8 +123,8 @@ The detection Detect Path Interception By Creation Of program exe is detecting t
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_path_interception_by_creation_of_program_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-06-short_lived_windows_accounts.md b/docs/_posts/2020-07-06-short_lived_windows_accounts.md
index 4e0025dae1..3412fb9342 100644
--- a/docs/_posts/2020-07-06-short_lived_windows_accounts.md
+++ b/docs/_posts/2020-07-06-short_lived_windows_accounts.md
@@ -114,8 +114,8 @@ This search detects accounts that were created and deleted in a short time perio
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **short_lived_windows_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md
index 610808a839..57187c0ff4 100644
--- a/docs/_posts/2020-07-06-windows_event_log_cleared.md
+++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md
@@ -116,8 +116,8 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve
#### Macros
The SPL above uses the following Macros:
* [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **windows_event_log_cleared_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
index c45ef8426b..545796a26c 100644
--- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
+++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
@@ -117,8 +117,8 @@ This search looks for network traffic on TCP/3389, the default port used by remo
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **remote_desktop_network_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-08-detect_new_local_admin_account.md b/docs/_posts/2020-07-08-detect_new_local_admin_account.md
index b14f43e277..3e6512d9d8 100644
--- a/docs/_posts/2020-07-08-detect_new_local_admin_account.md
+++ b/docs/_posts/2020-07-08-detect_new_local_admin_account.md
@@ -113,8 +113,8 @@ This search looks for newly created accounts that have been elevated to local ad
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **detect_new_local_admin_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md
index e63eaaca93..62acb2404b 100644
--- a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md
+++ b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md
@@ -119,8 +119,8 @@ This search looks for attempts to stop security-related services on the endpoint
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **attempt_to_stop_security_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -155,6 +155,7 @@ None identified. Attempts to disable security-related services should be identif
* [Disabling Security Tools](/stories/disabling_security_tools)
* [Trickbot](/stories/trickbot)
* [WhisperGate](/stories/whispergate)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md
index 899c3b213b..73fd4e7abe 100644
--- a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md
+++ b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md
@@ -118,8 +118,8 @@ This search looks for successful AWS CloudTrail activity by user accounts that a
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **detect_aws_api_activities_from_unapproved_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md
index 6806765a00..1a5dc12da3 100644
--- a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md
+++ b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md
@@ -123,14 +123,14 @@ This search looks for DNS requests for phishing domains that are leveraging Evil
#### Macros
The SPL above uses the following Macros:
-* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml)
* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml)
+* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml)
+* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml)
* [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml)
+* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml)
* [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml)
* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml)
-* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml)
> :information_source:
> **detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
index 6d646d59fc..e9fd64eac7 100644
--- a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
+++ b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
@@ -119,8 +119,8 @@ This search detects user accounts that have been locked out a relatively high nu
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_excessive_user_account_lockouts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md
index 65843532d0..8a71757140 100644
--- a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md
+++ b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md
@@ -115,8 +115,8 @@ This search is used to detect attempts to use DNS tunneling, by calculating the
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_long_dns_txt_record_response_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md
index a7eb0b73a1..8694a6d3a9 100644
--- a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md
+++ b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md
@@ -113,8 +113,8 @@ This search looks for AWS CloudTrail events wherein a console login event by a u
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
index 3deacfc3e0..0282f5b820 100644
--- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
+++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
@@ -114,8 +114,8 @@ This search looks for outbound SMB connections made by hosts within your network
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_outbound_smb_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
index 7440974e9a..d8e12c392f 100644
--- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
+++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
@@ -126,8 +126,8 @@ This search looks for execution of process `outlook.exe` where the process is wr
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_outlook_exe_writing_a_zip_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
index fe3c0f36fd..6bc4eddfd5 100644
--- a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
+++ b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
@@ -112,8 +112,8 @@ This search looks for the execution of the cscript.exe or wscript.exe processes,
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_use_of_cmd_exe_to_launch_script_interpreters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -137,6 +137,7 @@ Some legitimate applications may exhibit this behavior.
#### Associated Analytic story
* [Emotet Malware DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
* [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md
index 468a29995e..da4c4419a2 100644
--- a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md
+++ b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md
@@ -109,9 +109,9 @@ This search looks for web connections to dynamic DNS providers.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_web_traffic_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
index c83c255d84..79bd71b2c0 100644
--- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
+++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
@@ -110,8 +110,8 @@ This search looks for specific command-line arguments that may indicate the exec
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detection_of_tools_built_by_nirsoft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md
index 6a92d69fb0..7706e0d302 100644
--- a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md
+++ b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md
@@ -118,9 +118,9 @@ This search looks for EC2 instances being modified by users who have not previou
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **ec2_instance_modified_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md
index f37bf58289..a779faf335 100644
--- a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md
+++ b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md
@@ -117,8 +117,8 @@ This search looks for EC2 instances being created by users who have not created
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **ec2_instance_started_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
index ef311872d0..602677cc95 100644
--- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
+++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
@@ -111,8 +111,8 @@ The search looks at the change-analysis data model and detects email files creat
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **email_files_written_outside_of_the_outlook_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md
index c7a48b2c3f..29a348aab2 100644
--- a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md
+++ b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md
@@ -126,8 +126,8 @@ This search looks for command-line arguments that use a `/c` parameter to execut
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **first_time_seen_command_line_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
index e846d6a5a6..ee2f30531a 100644
--- a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
+++ b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
@@ -111,8 +111,8 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **hiding_files_and_directories_with_attrib_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -135,6 +135,7 @@ Some applications and users may legitimately use attrib.exe to interact with the
#### Associated Analytic story
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
index c7fc1c1960..d5e6c456dc 100644
--- a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
+++ b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
@@ -116,9 +116,9 @@ This search looks for PowerShell processes started with parameters used to bypas
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **malicious_powershell_process_-_execution_policy_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
index 553fd07f28..3d3a23142f 100644
--- a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
+++ b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
@@ -114,8 +114,8 @@ Microsoft Windows contains accessibility features that can be launched with a ke
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **overwriting_accessibility_binaries_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
index d8faab220c..631e7a941c 100644
--- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
+++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
@@ -113,8 +113,8 @@ This search looks for network traffic defined by port and transport layer protoc
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **prohibited_network_traffic_allowed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md
index dc8a715ac8..2a83d0b689 100644
--- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md
+++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md
@@ -115,8 +115,8 @@ This search looks for network traffic on common ports where a higher layer proto
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **protocol_or_port_mismatch_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
index b7dc8e4a0e..80127df206 100644
--- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
+++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
@@ -117,8 +117,8 @@ This search looks for the remote desktop process mstsc.exe running on systems up
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **remote_desktop_process_running_on_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
index 031cb96663..a8bbdeb2cf 100644
--- a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
+++ b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
@@ -119,8 +119,8 @@ This search looks for arguments to sc.exe indicating the creation or modificatio
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **sc_exe_manipulating_windows_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -147,6 +147,7 @@ Using sc.exe to manipulate Windows services is uncommon. However, there may be l
* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
* [Disabling Security Tools](/stories/disabling_security_tools)
* [NOBELIUM Group](/stories/nobelium_group)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md
index 4142da78fc..1e8576cece 100644
--- a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md
+++ b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md
@@ -109,8 +109,8 @@ This search looks for flags passed to schtasks.exe on the command-line that indi
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **scheduled_tasks_used_in_badrabbit_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md
index 27a3f80476..ee8e48bbb9 100644
--- a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md
+++ b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md
@@ -113,8 +113,8 @@ This search looks for changes to registry values that control Windows file assoc
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_changes_to_file_associations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md
index 97b844b205..8610cdf3c4 100644
--- a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md
+++ b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md
@@ -107,8 +107,8 @@ This detection looks for emails that are suspicious because of their sender, dom
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_email_-_uba_anomaly_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
index 2004b3acf4..a9d2a15203 100644
--- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
+++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
@@ -117,9 +117,9 @@ This search looks for emails that have attachments with suspicious file extensio
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_email_attachment_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md
index 6c6326adb0..64c07fce81 100644
--- a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md
+++ b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md
@@ -114,8 +114,8 @@ This search looks for reg.exe being launched from a command prompt not started b
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_reg_exe_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md
index 2ba8eb08fa..9b0f587725 100644
--- a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md
+++ b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md
@@ -104,8 +104,8 @@ This search detects writes to the 'System Volume Information' folder by somethin
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **suspicious_writes_to_system_volume_information_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md
index 3dd7fb8db4..f6411060b4 100644
--- a/docs/_posts/2020-07-22-tor_traffic.md
+++ b/docs/_posts/2020-07-22-tor_traffic.md
@@ -114,8 +114,8 @@ This search looks for network traffic identified as The Onion Router (TOR), a be
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **tor_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md
index 8bcf280cc2..d5664f0705 100644
--- a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md
+++ b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md
@@ -108,9 +108,9 @@ This search looks for applications on the endpoint that you have marked as uncom
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **uncommon_processes_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
index 906d51e1ca..ed73e8c274 100644
--- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
+++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
@@ -117,8 +117,8 @@ This search detects SIGRed via Splunk Stream.
#### Macros
The SPL above uses the following Macros:
-* [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml)
* [stream_dns](https://github.com/splunk/security_content/blob/develop/macros/stream_dns.yml)
+* [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml)
> :information_source:
> **detect_windows_dns_sigred_via_splunk_stream_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
index 17c0607e42..86f9ad6e66 100644
--- a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
+++ b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
@@ -122,8 +122,8 @@ This search looks for cloud instances being modified by users who have not previ
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **cloud_instance_modified_by_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md
index 7ef5a0acff..5369ba31dd 100644
--- a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md
+++ b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md
@@ -98,8 +98,8 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **cloud_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
index 5bd362328d..e7d3584681 100644
--- a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
+++ b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
@@ -114,8 +114,8 @@ This search looks for the creation or deletion of hidden shares using net.exe.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **create_or_delete_windows_shares_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
index d7016c612e..8afe9011b3 100644
--- a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
+++ b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
@@ -117,8 +117,8 @@ This search looks for specific authentication events from the Windows Security E
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **detect_activity_related_to_pass_the_hash_attacks_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md
index a1331265ee..11f87c2188 100644
--- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md
+++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md
@@ -117,8 +117,8 @@ Adversaries may abuse netbooting to load an unauthorized network device operatin
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_software_download_to_network_device_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-06-ryuk_test_files_detected.md b/docs/_posts/2020-11-06-ryuk_test_files_detected.md
index f6f753f18d..30d6f15c08 100644
--- a/docs/_posts/2020-11-06-ryuk_test_files_detected.md
+++ b/docs/_posts/2020-11-06-ryuk_test_files_detected.md
@@ -107,8 +107,8 @@ The search looks for files that contain the key word *Ryuk* under any folder in
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **ryuk_test_files_detected_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md
index b82ace11fb..aad62e03e2 100644
--- a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md
+++ b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md
@@ -106,8 +106,8 @@ The search looks for the Console Window Host process (connhost.exe) executed usi
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_connhost_exe_started_forcefully_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md
index 08408f2536..8863ecb9c6 100644
--- a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md
+++ b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md
@@ -107,8 +107,8 @@ The search looks for a Windows Security Account Manager (SAM) was stopped via co
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_security_account_manager_stopped_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md
index 92fc1f7780..875e9afa63 100644
--- a/docs/_posts/2020-11-09-common_ransomware_extensions.md
+++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md
@@ -110,8 +110,8 @@ The search looks for file modifications with extensions commonly used by Ransomw
#### Macros
The SPL above uses the following Macros:
* [ransomware_extensions](https://github.com/splunk/security_content/blob/develop/macros/ransomware_extensions.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **common_ransomware_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md
index fcae1b501f..9aa515ac82 100644
--- a/docs/_posts/2020-11-09-common_ransomware_notes.md
+++ b/docs/_posts/2020-11-09-common_ransomware_notes.md
@@ -108,9 +108,9 @@ The search looks for files created with names matching those typically used in r
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **common_ransomware_notes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-09-deleting_shadow_copies.md b/docs/_posts/2020-11-09-deleting_shadow_copies.md
index 5220a7a914..f6b57fe6ab 100644
--- a/docs/_posts/2020-11-09-deleting_shadow_copies.md
+++ b/docs/_posts/2020-11-09-deleting_shadow_copies.md
@@ -109,8 +109,8 @@ The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **deleting_shadow_copies_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
index a66f50336a..2deda244e4 100644
--- a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
+++ b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
@@ -119,8 +119,8 @@ This search identifies endpoints that have caused a relatively high number of ac
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_excessive_account_lockouts_from_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
index 5bfea4bfef..c0b41eca2c 100644
--- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
+++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
@@ -113,9 +113,9 @@ This search looks for fast execution of processes used for system network config
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_processes_used_for_system_network_configuration_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
index 073047c7e4..67a0109b7f 100644
--- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
+++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
@@ -113,10 +113,10 @@ This search looks for executions of cmd.exe spawned by a process that is often a
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_prohibited_applications_spawning_cmd_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md
index 889f73dd64..3755196466 100644
--- a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md
+++ b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md
@@ -138,6 +138,7 @@ This registry key may be modified via administrators to implement a change in sy
* [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities)
* [Remcos](/stories/remcos)
* [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md
index a635804329..83b2b703c9 100644
--- a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md
+++ b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md
@@ -114,8 +114,8 @@ This search looks for processes launched from files that have double extensions
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **execution_of_file_with_multiple_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md
index 55390d3e19..5850ce8104 100644
--- a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md
+++ b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md
@@ -109,8 +109,8 @@ This search looks for processes launched from files with at least five spaces in
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **execution_of_file_with_spaces_before_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-23-processes_created_by_netsh.md b/docs/_posts/2020-11-23-processes_created_by_netsh.md
index 4f822f395c..7b7f79645c 100644
--- a/docs/_posts/2020-11-23-processes_created_by_netsh.md
+++ b/docs/_posts/2020-11-23-processes_created_by_netsh.md
@@ -107,8 +107,8 @@ This search looks for processes launching netsh.exe to execute various commands
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **processes_created_by_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md
index 4b7da73120..e2c9aaaf5c 100644
--- a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md
+++ b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md
@@ -113,8 +113,8 @@ This search detects the process execution and arguments required to silently cre
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **shim_database_installation_with_suspicious_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
index 3ae13aaa91..14d83a388f 100644
--- a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
+++ b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
@@ -121,8 +121,8 @@ The search looks for reg.exe modifying registry keys that define Windows service
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **reg_exe_manipulating_windows_services_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md
index a491d093cf..bf5a4d23b9 100644
--- a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md
+++ b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md
@@ -115,8 +115,8 @@ This search looks for flags passed to schtasks.exe on the command-line that indi
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **schtasks_used_for_forcing_a_reboot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-12-08-shim_database_file_creation.md b/docs/_posts/2020-12-08-shim_database_file_creation.md
index 89be12496d..499b7a4006 100644
--- a/docs/_posts/2020-12-08-shim_database_file_creation.md
+++ b/docs/_posts/2020-12-08-shim_database_file_creation.md
@@ -113,8 +113,8 @@ This search looks for shim database files being written to default directories.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **shim_database_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md
index 1f18944d0c..545bc9c5ad 100644
--- a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md
+++ b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md
@@ -115,8 +115,8 @@ This search looks for process names that consist only of a single letter.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **single_letter_process_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
index e6918240a1..6f18cf8b5a 100644
--- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
+++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
@@ -115,9 +115,9 @@ During triage, review the parallel processes - what process moved the native Win
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **system_processes_run_from_unexpected_locations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-12-08-unusually_long_command_line.md b/docs/_posts/2020-12-08-unusually_long_command_line.md
index 4bca43b17b..a6874e39d2 100644
--- a/docs/_posts/2020-12-08-unusually_long_command_line.md
+++ b/docs/_posts/2020-12-08-unusually_long_command_line.md
@@ -105,8 +105,8 @@ Command lines that are extremely long may be indicative of malicious activity on
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **unusually_long_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
index ba26589ce1..97b7a140ca 100644
--- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
+++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
@@ -110,8 +110,8 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **sunburst_correlation_dll_and_network_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md
index cbaa2a7114..9a0522dffa 100644
--- a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md
+++ b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md
@@ -106,8 +106,8 @@ This search looks for flags passed to bcdedit.exe modifications to the built-in
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **bcdedit_failure_recovery_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
index 7e569728b0..a3cca683c2 100644
--- a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
+++ b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
@@ -107,8 +107,8 @@ This search provides detection of KMS keys where action kms:Encrypt is accessibl
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
index 94ca9fd7d9..c0a423f76c 100644
--- a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
+++ b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
@@ -101,8 +101,8 @@ This search provides detection of users with KMS keys performing encryption spec
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_detect_users_with_kms_keys_performing_encryption_s3_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
index 9c6b89bff6..738b9292e8 100644
--- a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
+++ b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
@@ -114,8 +114,8 @@ The search looks for AWS CloudTrail events to detect if any network ACLs were cr
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_network_access_control_list_created_with_all_open_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md
index 97fe890be8..338cc3e6db 100644
--- a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md
+++ b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md
@@ -111,8 +111,8 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
index 56ad8afeab..3bd6804b8d 100644
--- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
+++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
@@ -107,9 +107,9 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso
#### Macros
The SPL above uses the following Macros:
+* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml)
> :information_source:
> **suspicious_microsoft_workflow_compiler_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
index 3fb78bf21f..2981f697b7 100644
--- a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
+++ b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
@@ -113,8 +113,8 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_msbuild_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md
index 62ab0f3d32..f837ac19d1 100644
--- a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md
+++ b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md
@@ -112,8 +112,8 @@ The following analytic identifies child processes spawning from "mshta.exe". Th
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_mshta_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
index 625ce535e6..72437922ef 100644
--- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
+++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
@@ -112,9 +112,9 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_hosts_connecting_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
index 58fc09e6f8..c255a85d26 100644
--- a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
+++ b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
@@ -118,9 +118,9 @@ This search looks for PowerShell processes launched with arguments that have cha
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **malicious_powershell_process_with_obfuscation_techniques_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md
index da3b0bca32..f48bcf3d8c 100644
--- a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md
+++ b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md
@@ -112,8 +112,8 @@ This search looks for PowerShell processes started with a base64 encoded command
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_powershell_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
index 3c942c3b56..76b85517e1 100644
--- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
+++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
@@ -113,8 +113,8 @@ The following analytic identifies "rundll32.exe" execution with inline protocol
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_rundll32_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md
index 8c9e4e8eab..c1aa23acd7 100644
--- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md
+++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md
@@ -112,9 +112,9 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_mshta_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md
index adb6f92ec6..1a8acc8dc0 100644
--- a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md
+++ b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md
@@ -106,8 +106,8 @@ This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **wbadmin_delete_system_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md
index 07c93cbcb7..10e272bfee 100644
--- a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md
+++ b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md
@@ -103,8 +103,8 @@ This search provides specific SAML access from specific Service Provider, user a
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_saml_access_by_provider_user_and_principal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md
index 2fb4f610c3..6f97ccba4f 100644
--- a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md
+++ b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md
@@ -103,8 +103,8 @@ This search provides detection of updates to SAML provider in AWS. Updates to SA
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_saml_update_identity_provider_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
index 9137afe955..bf8e91a006 100644
--- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
+++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
@@ -113,9 +113,9 @@ Upon investigating, look for network connections to remote destinations (interna
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_regsvr32_application_control_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md
index dda50e0817..c02bb291a8 100644
--- a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md
+++ b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md
@@ -114,8 +114,8 @@ This technique uses "Install from Media" (IFM), which will extract a copy of the
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **ntdsutil_export_ntds_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
index 30de2e8012..67902820ae 100644
--- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
+++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
@@ -112,9 +112,9 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_regsvr32_register_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md
index beea6f235b..f790f144d3 100644
--- a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md
+++ b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md
@@ -108,8 +108,8 @@ During triage, confirm this is procdump.exe executing. If it is the first time a
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **dump_lsass_via_procdump_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
index d287869beb..8c91ad0ac3 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
@@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_rundll32_application_control_bypass_-_advpack_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
index 0f349fef61..51c0ba4071 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
@@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_rundll32_application_control_bypass_-_setupapi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
index 517530f49a..b157c01edb 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
@@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_rundll32_application_control_bypass_-_syssetup_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
index 6491636d6d..e6450c2428 100644
--- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
+++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
@@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe executing a DLL function name, St
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_rundll32_startw_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
index ebf44d99d2..ac7a1c4a6d 100644
--- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
+++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
@@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_rundll32_dllregisterserver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md
index cd95ed0054..331d8cd804 100644
--- a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md
+++ b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md
@@ -112,8 +112,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_html_help_spawn_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md
index cd7ca3972f..f85e76b088 100644
--- a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md
+++ b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md
@@ -112,8 +112,8 @@ The following analytic identifies regasm.exe spawning a process. This particular
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_regasm_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md
index 762ef51bb9..078a873546 100644
--- a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md
+++ b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md
@@ -112,8 +112,8 @@ The following analytic identifies regsvcs.exe spawning a process. This particula
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_regsvcs_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md
index 7514435156..df0c99103c 100644
--- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md
+++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md
@@ -104,8 +104,8 @@ The following analytic identifies the use of a curl contacting suspicious remote
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_curl_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md
index 349624e824..6b7c13d843 100644
--- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md
+++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md
@@ -118,8 +118,8 @@ Upon triage, capture the property list file being written to disk and review for
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_plistbuddy_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
index 18b16fbc62..2a90b73471 100644
--- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
+++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
@@ -104,8 +104,8 @@ The following analytic identifies the use of a SQLite3 querying the MacOS prefer
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_sqlite3_lsquarantine_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md
index fb9a5ddf1b..592926edfb 100644
--- a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md
+++ b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md
@@ -118,8 +118,8 @@ Upon triage, fodhelper.exe will have a child process and read access will occur
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **fodhelper_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md
index 607c8d3cf4..9050ba0148 100644
--- a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md
+++ b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md
@@ -107,8 +107,8 @@ This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **ryuk_wake_on_lan_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md
index f036563722..5dd5e0a279 100644
--- a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md
+++ b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md
@@ -111,8 +111,8 @@ The following detection identifies Scheduled Tasks registering (creating a new t
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_scheduled_task_from_public_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -140,6 +140,7 @@ Limited false positives may be present. Filter as needed by parent process or co
* [Ryuk Ransomware](/stories/ryuk_ransomware)
* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
* [Living Off The Land](/stories/living_off_the_land)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md
index 82c80cbbd3..3c9f85d4ee 100644
--- a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md
+++ b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md
@@ -117,8 +117,8 @@ This search looks for AWS CloudTrail events where a user has set a default polic
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_setdefaultpolicyversion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md
index dc1f5ff116..6c19456715 100644
--- a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md
+++ b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md
@@ -107,8 +107,8 @@ This detection identifies Microsoft Exchange Server's Unified Messaging services
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **unified_messaging_service_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md
index 171845712b..5bd04bc753 100644
--- a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md
+++ b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md
@@ -112,8 +112,8 @@ The search looks for the Registry Key DisableAntiSpyware set to disable. This is
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_disableantispyware_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -137,6 +137,7 @@ It is unusual to turn this feature off a Windows system since it is a default se
* [Ryuk Ransomware](/stories/ryuk_ransomware)
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
* [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md
index b3a8fd21b4..54aa9d9e45 100644
--- a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md
+++ b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md
@@ -107,9 +107,9 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **nishang_powershelltcponeline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md
index 8cefde7ecd..ddd9eedfd9 100644
--- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md
+++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md
@@ -116,10 +116,10 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe
#### Macros
The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **w3wp_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
index fd1bb2b46c..05dc65a75a 100644
--- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
+++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
@@ -103,8 +103,8 @@ The following analytics identifies a big number of instance of ransomware notes
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **ransomware_notes_bulk_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md
index 1136a6729e..9f9fd5b333 100644
--- a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md
+++ b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md
@@ -102,8 +102,8 @@ The following analytics identifies the resizing of shadowstorage by ransomware m
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **resize_shadowstorage_volume_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md
index 6ecdeac0fa..83a596b564 100644
--- a/docs/_posts/2021-03-16-high_process_termination_frequency.md
+++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md
@@ -103,8 +103,8 @@ This analytics are designed to indentify a high frequency of process termination
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **high_process_termination_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md
index 5c9d198d84..92265d67b6 100644
--- a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md
+++ b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md
@@ -102,8 +102,8 @@ This search looks for high frequency of file deletion relative to process name a
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **windows_high_file_deletion_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-17-clop_common_exec_parameter.md b/docs/_posts/2021-03-17-clop_common_exec_parameter.md
index 755d9d5e2b..95b4806b3e 100644
--- a/docs/_posts/2021-03-17-clop_common_exec_parameter.md
+++ b/docs/_posts/2021-03-17-clop_common_exec_parameter.md
@@ -102,8 +102,8 @@ The following analytics are designed to identifies some CLOP ransomware variant
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **clop_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md
index ad4c1ab818..b7495a6ba1 100644
--- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md
+++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md
@@ -102,9 +102,9 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **certutil_with_decode_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md
index 88a08e2887..9db397178f 100644
--- a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md
+++ b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md
@@ -103,9 +103,9 @@ Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functio
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **powershell_start-bitstransfer_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md
index 58cc4bc2de..c36f3c3426 100644
--- a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md
+++ b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md
@@ -110,8 +110,8 @@ The following query uses IAM events to track the success of a group being delete
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_iam_successful_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
index 608d7a43ff..70a4adb637 100644
--- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
+++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
@@ -108,8 +108,8 @@ This search is to identifies suspicious firewall disabling using netsh applicati
#### Macros
The SPL above uses the following Macros:
* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **disabling_firewall_with_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-31-dsquery_domain_discovery.md b/docs/_posts/2021-03-31-dsquery_domain_discovery.md
index 33f02b64e7..b076a89e3a 100644
--- a/docs/_posts/2021-03-31-dsquery_domain_discovery.md
+++ b/docs/_posts/2021-03-31-dsquery_domain_discovery.md
@@ -107,8 +107,8 @@ In addition to trust discovery, review parallel processes for additional behavio
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **dsquery_domain_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md
index 816cf97240..b60136f69f 100644
--- a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md
+++ b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md
@@ -106,8 +106,8 @@ The following detection identifies any malformed policy document exceptions with
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_iam_assume_role_policy_brute_force_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-01-aws_iam_delete_policy.md b/docs/_posts/2021-04-01-aws_iam_delete_policy.md
index d6f1902252..4a24129392 100644
--- a/docs/_posts/2021-04-01-aws_iam_delete_policy.md
+++ b/docs/_posts/2021-04-01-aws_iam_delete_policy.md
@@ -100,8 +100,8 @@ The following detection identifes when a policy is deleted on AWS. This does not
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_iam_delete_policy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md
index e260cd7bb3..213ebb88ad 100644
--- a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md
+++ b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md
@@ -100,8 +100,8 @@ This detection identifies failure attempts to delete groups. We want to identify
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_iam_failure_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md
index 8298ca7fc7..6809b34a14 100644
--- a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md
+++ b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md
@@ -115,8 +115,8 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **winevent_scheduled_task_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-12-excel_spawning_powershell.md b/docs/_posts/2021-04-12-excel_spawning_powershell.md
index 26c70e1c55..6ecfb6fed8 100644
--- a/docs/_posts/2021-04-12-excel_spawning_powershell.md
+++ b/docs/_posts/2021-04-12-excel_spawning_powershell.md
@@ -107,9 +107,9 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **excel_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md
index 97711642bd..881449035a 100644
--- a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md
+++ b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md
@@ -107,8 +107,8 @@ The following detection identifies Microsoft Excel spawning Windows Script Host
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **excel_spawning_windows_script_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md
index 5ff4bdb821..fa288d86e1 100644
--- a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md
+++ b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md
@@ -115,8 +115,8 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **winevent_scheduled_task_created_to_spawn_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-12-winword_spawning_powershell.md b/docs/_posts/2021-04-12-winword_spawning_powershell.md
index 2135b2af10..a6e3b2fd4f 100644
--- a/docs/_posts/2021-04-12-winword_spawning_powershell.md
+++ b/docs/_posts/2021-04-12-winword_spawning_powershell.md
@@ -107,9 +107,9 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **winword_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md
index 594cd28d35..1b841987af 100644
--- a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md
+++ b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md
@@ -107,8 +107,8 @@ The following detection identifies Microsoft Winword.exe spawning Windows Script
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **winword_spawning_windows_script_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md
index 630da0dd3c..af0757675b 100644
--- a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md
+++ b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md
@@ -107,8 +107,8 @@ This search looks for AWS CloudTrail events and analyse the amount of eventNames
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_excessive_security_scanning_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
index c8dc27db62..395cc1b89a 100644
--- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
+++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
@@ -108,8 +108,8 @@ this detection was designed to identifies suspicious spawned process of known MS
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **office_application_spawn_rundll32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
index 56c059af2a..bef8758516 100644
--- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
+++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
@@ -106,8 +106,8 @@ this search detects a potential malicious office document that create schedule t
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **office_document_creating_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md
index e3e263aa54..036ae99d5e 100644
--- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md
+++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md
@@ -106,8 +106,8 @@ this detection was designed to identifies suspicious office documents that using
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **office_document_executing_macro_code_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md
index 32348a1256..4f941e1c9b 100644
--- a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md
+++ b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md
@@ -102,8 +102,8 @@ this search is to detect potential DNS exfiltration using nslookup application.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **dns_exfiltration_using_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
index 85a2c57319..000c69e486 100644
--- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
+++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
@@ -102,8 +102,8 @@ this search is designed to detect suspicious powershell process that tries to in
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **powershell_remote_thread_to_known_windows_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md
index b297562c89..3518e5e547 100644
--- a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md
+++ b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md
@@ -105,8 +105,8 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **schedule_task_with_http_command_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md
index 2831b2bc73..6ca813b619 100644
--- a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md
+++ b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md
@@ -105,8 +105,8 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **schedule_task_with_rundll32_command_trigger_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
index efd0ae1863..c2c705791c 100644
--- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
+++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
@@ -101,8 +101,8 @@ this search is designed to detect potential malicious wermgr.exe process that dr
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **wermgr_process_create_executable_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
index b31dc8c715..0a6a55d2cd 100644
--- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
+++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
@@ -102,10 +102,10 @@ This search is designed to detect suspicious cmd and powershell process spawned
#### Macros
The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **wermgr_process_spawned_cmd_or_powershell_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md
index 730593c05b..7d58b841d5 100644
--- a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md
+++ b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md
@@ -107,8 +107,8 @@ The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllh
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **anomalous_usage_of_7zip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
index fd3e25319c..c40ab2bb31 100644
--- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
+++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
@@ -108,8 +108,8 @@ The following detection identifies the latest behavior utilized by IcedID malwar
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **office_product_spawning_rundll32_with_no_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md
index eb76a29dcb..cd8bc91dff 100644
--- a/docs/_posts/2021-04-22-winword_spawning_cmd.md
+++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md
@@ -107,9 +107,9 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically,
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **winword_spawning_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md
index aff2d794c5..1678be0cca 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md
@@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by different mal
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **office_product_spawning_bitsadmin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md
index fdb416d0cb..aee81a0e17 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md
@@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by different mal
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **office_product_spawning_certutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md
index 928f33d95d..5fda55ea06 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md
@@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by different mal
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **office_product_spawning_mshta_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md
index 01d1ab8d7b..5eb7a599ed 100644
--- a/docs/_posts/2021-04-26-trickbot_named_pipe.md
+++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md
@@ -102,8 +102,8 @@ this search is to detect potential trickbot infection through the create/connect
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **trickbot_named_pipe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-29-icacls_deny_command.md b/docs/_posts/2021-04-29-icacls_deny_command.md
index 0564a725e3..5bed11167c 100644
--- a/docs/_posts/2021-04-29-icacls_deny_command.md
+++ b/docs/_posts/2021-04-29-icacls_deny_command.md
@@ -102,8 +102,8 @@ This analytic identifies a potential adversary that changes the security permiss
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **icacls_deny_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -126,6 +126,7 @@ Unknown. It is possible some administrative scripts use ICacls. Filter as needed
#### Associated Analytic story
* [XMRig](/stories/xmrig)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
index 43c3a38d63..ff1e142ac3 100644
--- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
+++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
@@ -108,8 +108,8 @@ This analytic will detect suspicious driver loaded paths. This technique is comm
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **suspicious_driver_loaded_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md
index aea92238c8..7046351428 100644
--- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md
+++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md
@@ -108,8 +108,8 @@ This analytic identifies XMRIG coinminer driver installation on the system. The
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **xmrig_driver_loaded_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-04-deleting_of_net_users.md b/docs/_posts/2021-05-04-deleting_of_net_users.md
index 2d513333bd..696ce71d06 100644
--- a/docs/_posts/2021-05-04-deleting_of_net_users.md
+++ b/docs/_posts/2021-05-04-deleting_of_net_users.md
@@ -103,8 +103,8 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **deleting_of_net_users_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-04-disabling_net_user_account.md b/docs/_posts/2021-05-04-disabling_net_user_account.md
index 5d3c6378ba..f1a0878aad 100644
--- a/docs/_posts/2021-05-04-disabling_net_user_account.md
+++ b/docs/_posts/2021-05-04-disabling_net_user_account.md
@@ -103,8 +103,8 @@ This analytic will identify a suspicious command-line that disables a user accou
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **disabling_net_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md
index a0299d74cd..5ca072aeea 100644
--- a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md
+++ b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md
@@ -94,7 +94,7 @@ This analytic will identify suspicious series of command-line to disable several
```
| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "sc.exe" AND Processes.process="*config*" OR Processes.process="*Disabled*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m
-| where count >=5
+| where count >=4
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
@@ -103,8 +103,8 @@ This analytic will identify suspicious series of command-line to disable several
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **excessive_attempt_to_disable_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -127,6 +127,7 @@ unknown
#### Associated Analytic story
* [XMRig](/stories/xmrig)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md
index 3dec5b2e36..95aba44e11 100644
--- a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md
+++ b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md
@@ -104,8 +104,8 @@ This analytic identifies suspicious series of attempt to kill multiple services
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **excessive_service_stop_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md
index 6f39ebd87d..33f149cc00 100644
--- a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md
+++ b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md
@@ -108,8 +108,8 @@ This analytic identifies excessive usage of `taskkill.exe` application. This app
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **excessive_usage_of_taskkill_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -132,6 +132,7 @@ Unknown. Filter as needed.
#### Associated Analytic story
* [XMRig](/stories/xmrig)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2021-05-04-icacls_grant_command.md b/docs/_posts/2021-05-04-icacls_grant_command.md
index eb7ba0395c..01c62fcfba 100644
--- a/docs/_posts/2021-05-04-icacls_grant_command.md
+++ b/docs/_posts/2021-05-04-icacls_grant_command.md
@@ -102,8 +102,8 @@ This analytic identifies potential adversaries that modify the security permissi
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **icacls_grant_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md
index 2c38baa934..2991a72568 100644
--- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md
+++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md
@@ -108,8 +108,8 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove
#### Macros
The SPL above uses the following Macros:
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **process_kill_base_on_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-05-suspicious_process_file_path.md b/docs/_posts/2021-05-05-suspicious_process_file_path.md
index 20defc4a27..aea34adffa 100644
--- a/docs/_posts/2021-05-05-suspicious_process_file_path.md
+++ b/docs/_posts/2021-05-05-suspicious_process_file_path.md
@@ -103,8 +103,8 @@ The following analytic will detect a suspicious process running in a file path w
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md
index e75d99cd23..43eaa37a0b 100644
--- a/docs/_posts/2021-05-06-download_files_using_telegram.md
+++ b/docs/_posts/2021-05-06-download_files_using_telegram.md
@@ -101,8 +101,8 @@ The following analytic will identify a suspicious download by the Telegram appli
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **download_files_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md
index 2283e7d33e..04879af5f4 100644
--- a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md
+++ b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md
@@ -101,8 +101,8 @@ This analytic will detect a suspicious Telegram process enumerating all network
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **enumerate_users_local_group_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md
index 2b90be4869..6fd3ea4bce 100644
--- a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md
+++ b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md
@@ -104,8 +104,8 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **excessive_usage_of_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -134,6 +134,7 @@ unknown. Filter as needed. Modify the time span as needed.
#### Associated Analytic story
* [XMRig](/stories/xmrig)
* [Ransomware](/stories/ransomware)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md
index f92d154dec..ce7b6312f2 100644
--- a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md
+++ b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md
@@ -102,8 +102,8 @@ This analytic will identify suspicious executable or scripts (known file extensi
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **executables_or_script_creation_in_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -131,6 +131,7 @@ Administrators may allow creation of script or exe in the paths specified. Filte
* [WhisperGate](/stories/whispergate)
* [Hermetic Wiper](/stories/hermetic_wiper)
* [Industroyer2](/stories/industroyer2)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md
index 90fde55d8b..39668c135d 100644
--- a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md
+++ b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md
@@ -103,8 +103,8 @@ The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` o
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **excessive_usage_of_cacls_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -127,6 +127,7 @@ Administrators or administrative scripts may use this application. Filter as nee
#### Associated Analytic story
* [XMRig](/stories/xmrig)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md
index d63ea1659d..9e8d148a76 100644
--- a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md
+++ b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md
@@ -104,8 +104,8 @@ This analytic identifies an on demand run of a Windows Schedule Task through she
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **schtasks_run_task_on_demand_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
index 869bea7299..64ff8b9995 100644
--- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
+++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
@@ -106,8 +106,8 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **cmlua_or_cmstplua_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-13-slui_runas_elevated.md b/docs/_posts/2021-05-13-slui_runas_elevated.md
index b8bdc71816..9467a16fca 100644
--- a/docs/_posts/2021-05-13-slui_runas_elevated.md
+++ b/docs/_posts/2021-05-13-slui_runas_elevated.md
@@ -109,8 +109,8 @@ The following analytic identifies the Microsoft Software Licensing User Interfac
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **slui_runas_elevated_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-13-slui_spawning_a_process.md b/docs/_posts/2021-05-13-slui_spawning_a_process.md
index 2de1acd76e..ae5608e181 100644
--- a/docs/_posts/2021-05-13-slui_spawning_a_process.md
+++ b/docs/_posts/2021-05-13-slui_spawning_a_process.md
@@ -109,8 +109,8 @@ The following analytic identifies the Microsoft Software Licensing User Interfac
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **slui_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-18-services_escalate_exe.md b/docs/_posts/2021-05-18-services_escalate_exe.md
index 200b45ac0f..611bdb3994 100644
--- a/docs/_posts/2021-05-18-services_escalate_exe.md
+++ b/docs/_posts/2021-05-18-services_escalate_exe.md
@@ -103,8 +103,8 @@ The following analytic identifies the use of `svc-exe` with Cobalt Strike. The b
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **services_escalate_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
index 38b96a46ec..c32f863108 100644
--- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
+++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
@@ -119,9 +119,9 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **cmd_echo_pipe_-_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md
index 586f6a757d..60c4fd6778 100644
--- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md
+++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md
@@ -110,8 +110,8 @@ The following analytic identifies suspicious processes spawning from WinRM (wsmp
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **winrm_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md
index a21d072f69..42ee811fe0 100644
--- a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md
+++ b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md
@@ -107,8 +107,8 @@ This analytic detects a potential usage of secretsdump.py tool for dumping crede
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **secretdumps_offline_ntds_dumping_tool_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md
index 41ab2d83b9..f6da8244e1 100644
--- a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md
+++ b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md
@@ -132,8 +132,8 @@ SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. Shar
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_sharphound_file_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-27-detect_sharphound_usage.md b/docs/_posts/2021-05-27-detect_sharphound_usage.md
index 152ca345eb..3fe7723c86 100644
--- a/docs/_posts/2021-05-27-detect_sharphound_usage.md
+++ b/docs/_posts/2021-05-27-detect_sharphound_usage.md
@@ -132,8 +132,8 @@ The following analytic identifies SharpHound binary usage by using the original
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_sharphound_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
index ff48516595..93e1e6b5cc 100644
--- a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
+++ b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
@@ -132,8 +132,8 @@ The following analytic identifies the common command-line argument used by Azure
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_azurehound_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md
index 4b312b53f1..b9c6d7610e 100644
--- a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md
+++ b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md
@@ -132,8 +132,8 @@ The following analytic is similar to SharpHound file modifications, but this ins
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_azurehound_file_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
index 5b0437505b..efc68eb9c4 100644
--- a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
+++ b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
@@ -132,8 +132,8 @@ The following analytic identifies common command-line arguments used by SharpHou
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_sharphound_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-02-conti_common_exec_parameter.md b/docs/_posts/2021-06-02-conti_common_exec_parameter.md
index 9167d33ce5..316ee41a9b 100644
--- a/docs/_posts/2021-06-02-conti_common_exec_parameter.md
+++ b/docs/_posts/2021-06-02-conti_common_exec_parameter.md
@@ -102,8 +102,8 @@ This search detects the suspicious commandline argument of revil ransomware to e
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **conti_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md
index 5286c0105c..bb4baa84c7 100644
--- a/docs/_posts/2021-06-02-modification_of_wallpaper.md
+++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md
@@ -101,8 +101,8 @@ This analytic identifies suspicious modification of registry to deface or change
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **modification_of_wallpaper_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-02-revil_common_exec_parameter.md b/docs/_posts/2021-06-02-revil_common_exec_parameter.md
index 3a23505f10..333cfb289a 100644
--- a/docs/_posts/2021-06-02-revil_common_exec_parameter.md
+++ b/docs/_posts/2021-06-02-revil_common_exec_parameter.md
@@ -102,8 +102,8 @@ This analytic identifies suspicious commandline parameter that are commonly used
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **revil_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
index f095875738..aa6d560171 100644
--- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
+++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
@@ -106,8 +106,8 @@ this search is designed to detect potential malicious process loading COM object
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **wbemprox_com_object_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md
index 78a645abb8..21bfada3a3 100644
--- a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md
+++ b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md
@@ -107,8 +107,8 @@ This detection targets behaviors observed in post exploit kits like Meterpreter
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **excessive_number_of_taskhost_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md
index 793f8550d3..900b792ef2 100644
--- a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md
+++ b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md
@@ -120,10 +120,10 @@ The SPL above uses the following Macros:
#### Required field
* _time
-* Message
-* OpCode
-* ComputerName
-* User
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
* EventCode
@@ -144,7 +144,7 @@ Potential for some third party applications to disable AMSI upon invocation. Fil
| Risk Score | Impact | Confidence | Message |
| ----------- | ----------- |--------------|--------------|
-| 49.0 | 70 | 70 | Possible AMSI Unloading via Reflection using PowerShell on $ComputerName$ |
+| 49.0 | 70 | 70 | Possible AMSI Unloading via Reflection using PowerShell on $Computer$ |
> :information_source:
diff --git a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md
index 6961249843..262e1b6bf6 100644
--- a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md
+++ b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md
@@ -107,8 +107,8 @@ this search is to detect execution of `cipher.exe` to clear the unallocated sect
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **clear_unallocated_sector_using_cipher_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md
index 0a14d81719..0ea696d65d 100644
--- a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md
+++ b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md
@@ -107,8 +107,8 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **disable_logs_using_wevtutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md
index 5c7f7d0575..d895f70a46 100644
--- a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md
+++ b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md
@@ -102,8 +102,8 @@ This search is to detect a modification of file or directory permission using ta
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **permission_modification_using_takeown_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
index b4c8dfb0b9..63c2fafb1b 100644
--- a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
+++ b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
@@ -102,8 +102,8 @@ This search is to detect a suspicious bcdedit.exe execution to ignore all failur
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **prevent_automatic_repair_mode_using_bcdedit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
index ede1afad84..e75f0eb6fd 100644
--- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
+++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
@@ -112,8 +112,8 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **detect_wmi_event_subscription_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md
index f638d3f37f..ff2ea0cea2 100644
--- a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md
+++ b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md
@@ -115,8 +115,8 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **suspicious_event_log_service_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md
index d4cd44e404..f41f7f15d2 100644
--- a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md
+++ b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md
@@ -107,8 +107,8 @@ This analytic will identify suspicious process of cscript.exe where it tries to
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **execute_javascript_with_jscript_com_clsid_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
index 5016caf9db..eb65981ea1 100644
--- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
+++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
@@ -107,9 +107,9 @@ This search is to detect a suspicious commandline designed to delete files or di
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **recursive_delete_of_directory_in_batch_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
index 7008624346..bd72e6e9a8 100644
--- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
+++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
@@ -108,8 +108,8 @@ This search is to detect a suspicious modification of firewall to allow file and
#### Macros
The SPL above uses the following Macros:
* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **allow_file_and_printing_sharing_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
index 7e79d3a83f..b5759a2471 100644
--- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
+++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
@@ -108,8 +108,8 @@ This search is to detect a suspicious modification to the firewall to allow netw
#### Macros
The SPL above uses the following Macros:
* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **allow_network_discovery_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
index f3fa23324d..a425090e69 100644
--- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
+++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
@@ -111,8 +111,8 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **excessive_usage_of_sc_service_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -132,6 +132,7 @@ excessive execution of sc.exe is quite suspicious since it can modify or execute
#### Associated Analytic story
* [Ransomware](/stories/ransomware)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md
index c25832cc7b..ef62d7eafc 100644
--- a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md
+++ b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md
@@ -108,8 +108,8 @@ This detection targets behaviors observed when threat actors have used sc.exe to
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **excessive_number_of_service_control_start_as_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
index 6acb309142..0715b23fe2 100644
--- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
+++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
@@ -115,8 +115,8 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **spoolsv_spawning_rundll32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
index c3db511f1e..bbc1985d5b 100644
--- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
+++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
@@ -114,8 +114,8 @@ This search is to detect suspicious loading of dll in specific path relative to
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **spoolsv_suspicious_loaded_modules_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
index d77df07dd8..1b43ca5a8e 100644
--- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
+++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
@@ -106,8 +106,8 @@ This analytic identifies a suspicious behavior related to PrintNightmare, or CVE
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **spoolsv_suspicious_process_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
index fa14f5826f..28dfef2479 100644
--- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
+++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
@@ -113,8 +113,8 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **spoolsv_writing_a_dll_-_sysmon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md
index 6a27da8bc7..d736ada874 100644
--- a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md
+++ b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md
@@ -111,8 +111,8 @@ This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in no
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **msmpeng_application_dll_side_loading_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
index 6f9d39c5bf..c8832363f7 100644
--- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
+++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
@@ -2,6 +2,7 @@
title: "UAC Bypass MMC Load Unsigned Dll"
excerpt: "Bypass User Account Control
, Abuse Elevation Control Mechanism
+, MMC
"
categories:
- Endpoint
@@ -11,10 +12,12 @@ toc_label: ""
tags:
- Bypass User Account Control
- Abuse Elevation Control Mechanism
+ - MMC
- Defense Evasion
- Privilege Escalation
- Defense Evasion
- Privilege Escalation
+ - Defense Evasion
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
@@ -51,6 +54,8 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
+| [T1218.014](https://attack.mitre.org/techniques/T1218/014/) | MMC | Defense Evasion |
+
@@ -108,8 +113,8 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **uac_bypass_mmc_load_unsigned_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
index cc2b500868..9c8e890bd2 100644
--- a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
+++ b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
@@ -122,8 +122,8 @@ This search looks for cloud compute instances created by users who have not crea
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **cloud_compute_instance_created_by_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-19-aws_createloginprofile.md b/docs/_posts/2021-07-19-aws_createloginprofile.md
index 7cb71f6877..b2e2c7f42c 100644
--- a/docs/_posts/2021-07-19-aws_createloginprofile.md
+++ b/docs/_posts/2021-07-19-aws_createloginprofile.md
@@ -116,8 +116,8 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_createloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md
index d7b9b393f5..6c3e88a3a7 100644
--- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md
+++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md
@@ -115,8 +115,8 @@ This search looks for AWS CloudTrail events where a user has created an open/pub
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **detect_new_open_s3_buckets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
index e8abc8052d..fae0ca6e88 100644
--- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
+++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
@@ -108,8 +108,8 @@ This search looks for AWS CloudTrail events where a user has created an open/pub
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **detect_new_open_s3_buckets_over_aws_cli_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
index 85d0179475..4d3b8451a5 100644
--- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
+++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
@@ -108,9 +108,9 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **mshta_spawning_rundll32_or_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
index cb00cd3555..1a8abd0c7d 100644
--- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
+++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
@@ -107,9 +107,9 @@ this search is to detect a suspicious office product process that spawn cmd chil
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **office_product_spawn_cmd_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
index ef3e261bdf..7ee60a9e83 100644
--- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
+++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
@@ -102,8 +102,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **rundll32_createremotethread_in_browser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
index 2612bc03e8..2fee621286 100644
--- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
+++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
@@ -106,8 +106,8 @@ This search is to detect a suspicious rundll32 process that drops executable (.e
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **rundll32_process_creating_exe_dll_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
index 9264ea657c..e574e6f691 100644
--- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
+++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
@@ -108,8 +108,8 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_icedid_rundll32_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
index e63dc15bff..2c4448604c 100644
--- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
+++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
@@ -108,8 +108,8 @@ This search is to detect a suspicious rundll32.exe process with plugininit param
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_rundll32_plugininit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-27-chcp_command_execution.md b/docs/_posts/2021-07-27-chcp_command_execution.md
index b665569a64..247e12d47f 100644
--- a/docs/_posts/2021-07-27-chcp_command_execution.md
+++ b/docs/_posts/2021-07-27-chcp_command_execution.md
@@ -102,8 +102,8 @@ This search is to detect execution of chcp.exe application. this utility is used
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **chcp_command_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -128,6 +128,7 @@ other tools or script may used this to change code page to UTF-* or others
#### Associated Analytic story
* [IcedID](/stories/icedid)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
index 045cd228b1..27cbb5c585 100644
--- a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
+++ b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
@@ -109,9 +109,9 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **regsvr32_with_known_silent_switch_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
index 57dd88fc58..fdf4ec8c06 100644
--- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
+++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
@@ -102,8 +102,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **rundll32_create_remote_thread_to_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md
index 84c0e7fd30..77dd7cbdcb 100644
--- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md
+++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md
@@ -106,8 +106,8 @@ This search is to detect dropping a suspicious file named as "license.dat" in %a
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **drop_icedid_license_dat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
index 06a0119cf5..785cda45b1 100644
--- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
+++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
@@ -106,8 +106,8 @@ This search is to detect a suspicious file creation namely passff.tar and cookie
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **icedid_exfiltrated_archived_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
index 39e21e5d16..ae7b48391d 100644
--- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
+++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
@@ -107,9 +107,9 @@ this detection was designed to identifies suspicious spawned process of known MS
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **office_application_spawn_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
index d7e802c3c9..ce3d5c295e 100644
--- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
+++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
@@ -101,8 +101,8 @@ This search is to detect a suspicious file creation of sqlite3.dll in %temp% fol
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **sqlite_module_in_temp_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
index 2d8501f31d..bf0db94672 100644
--- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
+++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
@@ -102,8 +102,8 @@ This search is to detect suspicious process injection in command shell. This tec
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **create_remote_thread_in_shell_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-09-rundll32_lockworkstation.md b/docs/_posts/2021-08-09-rundll32_lockworkstation.md
index ded585a468..5058d1066c 100644
--- a/docs/_posts/2021-08-09-rundll32_lockworkstation.md
+++ b/docs/_posts/2021-08-09-rundll32_lockworkstation.md
@@ -107,8 +107,8 @@ This search is to detect a suspicious rundll32 commandline to lock the workstati
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **rundll32_lockworkstation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md
index 96458e18c1..9da25e52ad 100644
--- a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md
+++ b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md
@@ -107,8 +107,8 @@ This search is to detect a suspicious un-installation of application using msiex
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **uninstall_app_using_msiexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-11-fsutil_zeroing_file.md b/docs/_posts/2021-08-11-fsutil_zeroing_file.md
index cf2f3085c5..d250310e6a 100644
--- a/docs/_posts/2021-08-11-fsutil_zeroing_file.md
+++ b/docs/_posts/2021-08-11-fsutil_zeroing_file.md
@@ -102,8 +102,8 @@ This search is to detect a suspicious fsutil process to zeroing a target file. T
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **fsutil_zeroing_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
index 3fb4417f2a..65a9387f53 100644
--- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
+++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
@@ -106,8 +106,8 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object.
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **uac_bypass_with_colorui_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
index b6f0d3c01a..1bb1a670db 100644
--- a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
+++ b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
@@ -111,8 +111,8 @@ This search is to detect suspicious google drive or google docs files shared out
#### Macros
The SPL above uses the following Macros:
-* [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml)
> :information_source:
> **gsuite_drive_share_in_external_email_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md
index 3c41a25ed8..9503d402ab 100644
--- a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md
+++ b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md
@@ -107,8 +107,8 @@ This search is to detect a suspicious attachment file extension in Gsuite email
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **gsuite_email_suspicious_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md
index 2ffcffc326..e9fe2ca201 100644
--- a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md
+++ b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md
@@ -107,8 +107,8 @@ This search is to detect a suspicious 7z process with commandline pointing to SM
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **7zip_commandline_to_smb_share_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
index 8bda2214bc..d96bb8f419 100644
--- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
+++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
@@ -119,8 +119,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_ecr_container_scanning_findings_low_informational_unknown_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md
index ba20d125d6..096fcc5bea 100644
--- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md
+++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md
@@ -119,8 +119,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_ecr_container_scanning_findings_medium_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
index a5d581a73a..c869495b9b 100644
--- a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
+++ b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
@@ -112,8 +112,8 @@ This search is to detect a suspicious outbound e-mail from internal email to ext
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **gsuite_outbound_email_with_attachment_to_external_domain_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-18-esentutl_sam_copy.md b/docs/_posts/2021-08-18-esentutl_sam_copy.md
index a6c235bac4..fcb09a3843 100644
--- a/docs/_posts/2021-08-18-esentutl_sam_copy.md
+++ b/docs/_posts/2021-08-18-esentutl_sam_copy.md
@@ -107,9 +107,9 @@ The following analytic identifies the process - `esentutl.exe` - being used to c
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **esentutl_sam_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md
index 7a1ef37c9a..6fc836489c 100644
--- a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md
+++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md
@@ -115,8 +115,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_ecr_container_upload_outside_business_hours_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
index 6bc9d50178..c53734cb79 100644
--- a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
+++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
@@ -115,9 +115,9 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **aws_ecr_container_upload_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
index f70e2c6197..e3595cd0d7 100644
--- a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
+++ b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
@@ -110,8 +110,8 @@ This search is to detect a gsuite email contains suspicious subject having known
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **gsuite_email_suspicious_subject_with_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md
index 60c6036b42..cd7873937d 100644
--- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md
+++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md
@@ -105,8 +105,8 @@ The following analytic identifies cleartext protocols at risk of leaking sensiti
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **protocols_passing_authentication_in_cleartext_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-20-github_commit_changes_in_master.md b/docs/_posts/2021-08-20-github_commit_changes_in_master.md
index b176886222..0db42eec42 100644
--- a/docs/_posts/2021-08-20-github_commit_changes_in_master.md
+++ b/docs/_posts/2021-08-20-github_commit_changes_in_master.md
@@ -101,8 +101,8 @@ This search is to detect a pushed or commit to master or main branch. This is to
#### Macros
The SPL above uses the following Macros:
-* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
> :information_source:
> **github_commit_changes_in_master_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md
index 3fbd261d84..55b0cd8cf1 100644
--- a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md
+++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **getlocaluser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md
index 1ae86ca355..65ed551ddb 100644
--- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md
+++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **getwmiobject_user_account_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
index b9eae53195..97395a0a7b 100644
--- a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
+++ b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
@@ -110,8 +110,8 @@ This analytics is to detect a gmail containing a link that are known to be abuse
#### Macros
The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **gsuite_email_with_known_abuse_web_service_link_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
index 05e5bc2a52..222f8bb9a1 100644
--- a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
+++ b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
@@ -111,8 +111,8 @@ This search is to detect a shared file in google drive with suspicious file name
#### Macros
The SPL above uses the following Macros:
-* [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml)
> :information_source:
> **gsuite_suspicious_shared_file_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md
index 2ed18073be..6161794c2a 100644
--- a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md
+++ b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **domain_account_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md
index 68b6e25aab..e7c336bbb4 100644
--- a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md
+++ b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md
@@ -108,8 +108,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **domain_account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md
index 35ae4c525e..0f8edcb217 100644
--- a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md
+++ b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **domain_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
index fb4bc0a96e..1abdd8c065 100644
--- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
+++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
@@ -102,8 +102,8 @@ This analytic identifies Get-DomainTrust from PowerView in order to gather domai
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **get-domaintrust_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell.md b/docs/_posts/2021-08-24-get_aduser_with_powershell.md
index 0a1bc88c75..99d7a6b93d 100644
--- a/docs/_posts/2021-08-24-get_aduser_with_powershell.md
+++ b/docs/_posts/2021-08-24-get_aduser_with_powershell.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **get_aduser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md
index 00faa196d4..5e3ccc9ec7 100644
--- a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md
+++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **get_domainuser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md
index 4b1da86585..12ffa406ce 100644
--- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md
+++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **getwmiobject_ds_user_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md
index 346c0b4ae4..aa06e4111a 100644
--- a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md
+++ b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `net.exe` with command-line arguments u
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **domain_group_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md
index 5549827dd9..53315ed956 100644
--- a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md
+++ b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **domain_group_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md
index cd7c57ded7..eb3df3262c 100644
--- a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md
+++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-l
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **elevated_group_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md
index f31eb06efa..289891f3b1 100644
--- a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md
+++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **elevated_group_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell.md b/docs/_posts/2021-08-25-getadgroup_with_powershell.md
index c1130fdbc7..78d29754ca 100644
--- a/docs/_posts/2021-08-25-getadgroup_with_powershell.md
+++ b/docs/_posts/2021-08-25-getadgroup_with_powershell.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **getadgroup_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md
index a166e237ad..bd53c4c7a6 100644
--- a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md
+++ b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **getdomaingroup_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md
index b56d16194b..ad340cae7a 100644
--- a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md
+++ b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line util
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **getnettcpconnection_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md
index 3db9586806..4ec21d1676 100644
--- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md
+++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **getwmiobject_ds_group_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
index 5d25f49cba..b95ef0b2e8 100644
--- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
+++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` executing the Get-ADDe
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **get_addefaultdomainpasswordpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
index e278c8d820..2e9ec509b7 100644
--- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
+++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` executing the Get ADUs
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **get_aduserresultantpasswordpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md
index c2e1d92b4b..68210802d9 100644
--- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md
+++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` executing the `Get-Dom
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **get_domainpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md
index 4cdf009cfa..7f195b6c3d 100644
--- a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md
+++ b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command li
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **password_policy_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md
index d8b606a7ef..b15a922a25 100644
--- a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md
+++ b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md
@@ -121,8 +121,8 @@ This search looks for a process launching an `*.lnk` file under `C:\User*` or `*
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **process_creating_lnk_file_in_suspicious_location_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md
index a4109f88e7..27495bc909 100644
--- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md
+++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md
@@ -107,8 +107,8 @@ Review the source attempting to perform this activity against your environment.
#### Macros
The SPL above uses the following Macros:
-* [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml)
> :information_source:
> **exchange_powershell_abuse_via_ssrf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md
index 8b4e1daf49..a7a7709f4a 100644
--- a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md
+++ b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `nltest.exe` with command-line argument
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **domain_controller_discovery_with_nltest_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md
index 34de9a917a..933e997068 100644
--- a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md
+++ b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **remote_system_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md
index 74fd24e098..7ae0dd38c1 100644
--- a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md
+++ b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md
@@ -108,8 +108,8 @@ During triage, review parallel security events to identify further suspicious ac
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **petitpotam_network_share_access_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md
index 097e4595bc..639b6ff4aa 100644
--- a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md
+++ b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md
@@ -105,8 +105,8 @@ The following analytic identifes Event Code 4768, A `Kerberos authentication tic
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **petitpotam_suspicious_kerberos_tgt_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md
index f04ca91335..1526c5c5e8 100644
--- a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md
+++ b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **remote_system_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md
index fed4ecbd94..6158e6df76 100644
--- a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md
+++ b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **domain_controller_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md
index 5bbe8e09bc..9534f2d6fd 100644
--- a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md
+++ b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **domain_group_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-01-github_commit_in_develop.md b/docs/_posts/2021-09-01-github_commit_in_develop.md
index 2eef99dca3..e2886e38e9 100644
--- a/docs/_posts/2021-09-01-github_commit_in_develop.md
+++ b/docs/_posts/2021-09-01-github_commit_in_develop.md
@@ -101,8 +101,8 @@ This search is to detect a pushed or commit to develop branch. This is to avoid
#### Macros
The SPL above uses the following Macros:
-* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
> :information_source:
> **github_commit_in_develop_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-01-github_dependabot_alert.md b/docs/_posts/2021-09-01-github_dependabot_alert.md
index fd2a212384..8e071247fe 100644
--- a/docs/_posts/2021-09-01-github_dependabot_alert.md
+++ b/docs/_posts/2021-09-01-github_dependabot_alert.md
@@ -113,8 +113,8 @@ This search looks for Dependabot Alerts in Github logs.
#### Macros
The SPL above uses the following Macros:
-* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
> :information_source:
> **github_dependabot_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
index b9e564a35b..c13d9a26c5 100644
--- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
+++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
@@ -114,9 +114,9 @@ This search looks for Pull Request from unknown user.
#### Macros
The SPL above uses the following Macros:
-* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
* [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
> :information_source:
> **github_pull_request_from_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md
index eea36a44e0..d2cbc9336e 100644
--- a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md
+++ b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **remote_system_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
index 35ff69f6e7..dfa36ed572 100644
--- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
+++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
@@ -102,8 +102,8 @@ This analytic identifies Get-ForestTrust from PowerSploit in order to gather dom
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **get-foresttrust_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
index 88e16dfd41..ac2289bd7c 100644
--- a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
+++ b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
@@ -102,8 +102,8 @@ This search is to detect a suspicious bcdedit commandline to configure the host
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **bcdedit_command_back_to_normal_mode_boot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md
index bd0b7da87a..fda1a61b06 100644
--- a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md
+++ b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md
@@ -102,8 +102,8 @@ This search is to detect a suspicious bcdedit commandline to configure the host
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **change_to_safe_mode_with_network_config_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md
index f651563fe7..90bf4429ed 100644
--- a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md
+++ b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **getadcomputer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md
index 518a0b9f38..713fbc5000 100644
--- a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md
+++ b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **getdomaincomputer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md
index fce0306599..d908a9d014 100644
--- a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md
+++ b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **getdomaincontroller_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md
index db435f2c37..fb7d6d46cf 100644
--- a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md
+++ b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **getwmiobject_ds_computer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
index 64cb7c7e3c..5f1e7fe3f7 100644
--- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
+++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
@@ -106,8 +106,8 @@ This analytic is to detect an application try to connect and create ADSI Object
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **schcache_change_by_app_connect_and_create_adsi_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-07-system_information_discovery_detection.md b/docs/_posts/2021-09-07-system_information_discovery_detection.md
index 0161023606..8508ab29a4 100644
--- a/docs/_posts/2021-09-07-system_information_discovery_detection.md
+++ b/docs/_posts/2021-09-07-system_information_discovery_detection.md
@@ -110,8 +110,8 @@ Detect system information discovery techniques used by attackers to understand c
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **system_information_discovery_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md
index 48003e4082..594531298f 100644
--- a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md
+++ b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md
@@ -112,8 +112,8 @@ The following detection identifies control.exe loading either a .cpl or .inf fro
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **control_loading_from_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md
index fd396ad9ae..5681350cc9 100644
--- a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md
+++ b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md
@@ -112,8 +112,8 @@ This search looks for the creation of local administrator accounts using net.exe
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **create_local_admin_accounts_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -141,6 +141,7 @@ Administrators often leverage net.exe to create admin accounts.
#### Associated Analytic story
* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2021-09-08-office_spawning_control.md b/docs/_posts/2021-09-08-office_spawning_control.md
index 1d451095a8..c8c05e9d02 100644
--- a/docs/_posts/2021-09-08-office_spawning_control.md
+++ b/docs/_posts/2021-09-08-office_spawning_control.md
@@ -112,8 +112,8 @@ The following detection identifies control.exe spawning from an office product.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **office_spawning_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
index 8b8a3ff9c7..134b9a1a46 100644
--- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
+++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
@@ -113,8 +113,8 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **rundll32_control_rundll_hunt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
index b9e405aef2..9e7b8b4572 100644
--- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
+++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
@@ -113,8 +113,8 @@ The following detection identifies rundll32.exe with `control_rundll` within the
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **rundll32_control_rundll_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md
index b323aa4525..f34dcadfbc 100644
--- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md
+++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md
@@ -107,9 +107,9 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **extraction_of_registry_hives_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md
index e21ffecea2..c89ce7ea75 100644
--- a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md
+++ b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `arp.exe` utilized to get a listing of
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **network_connection_discovery_with_arp_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md
index 155e7de23b..4c0494e90a 100644
--- a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md
+++ b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `net.exe` with command-line arguments u
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **network_connection_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -130,6 +130,7 @@ Administrators or power users may use this command for troubleshooting.
#### Associated Analytic story
* [Active Directory Discovery](/stories/active_directory_discovery)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md
index 810c81f80b..02afe963b8 100644
--- a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md
+++ b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `netstat.exe` with command-line argumen
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **network_connection_discovery_with_netstat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md
index d0d660741e..7e6072e5ca 100644
--- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md
+++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powerhsell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **getcurrent_user_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md
index db30b5adf5..3fcf5e264c 100644
--- a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md
+++ b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md
@@ -107,8 +107,8 @@ This search is to detect a execution of jscript using cscript process. Commonly
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **jscript_execution_using_cscript_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
index 6bc3aff1ed..aa61d94c40 100644
--- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
+++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
@@ -106,8 +106,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **ms_scripting_process_loading_ldap_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
index a0d9a01148..663b1aeade 100644
--- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
+++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
@@ -106,8 +106,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **ms_scripting_process_loading_wmi_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_query.md b/docs/_posts/2021-09-13-system_user_discovery_with_query.md
index b62e73bfdf..3d5f542883 100644
--- a/docs/_posts/2021-09-13-system_user_discovery_with_query.md
+++ b/docs/_posts/2021-09-13-system_user_discovery_with_query.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `query.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **system_user_discovery_with_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md
index 027b3910fe..6c269f5979 100644
--- a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md
+++ b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `whoami.exe` without any arguments. Thi
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **system_user_discovery_with_whoami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md
index 92435c9d5c..52e651933e 100644
--- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md
+++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **user_discovery_with_env_vars_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md
index 9fad82c973..2bdb9d99a4 100644
--- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md
+++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md
@@ -103,8 +103,8 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t
#### Macros
The SPL above uses the following Macros:
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **xsl_script_execution_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
index d3e692ef10..0df0d7499b 100644
--- a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
+++ b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
@@ -107,8 +107,8 @@ The following analytic identifies a non-standard parent process (not matching CM
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **cmdline_tool_not_executed_in_cmd_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md
index 624f0c31d3..0c112c1c9b 100644
--- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md
+++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md
@@ -107,8 +107,8 @@ The following hunting analytic identifies the use of `Get-WMIObject Win32_Group`
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **get_wmiobject_group_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-14-net_localgroup_discovery.md b/docs/_posts/2021-09-14-net_localgroup_discovery.md
index 0284a73976..cae36a82be 100644
--- a/docs/_posts/2021-09-14-net_localgroup_discovery.md
+++ b/docs/_posts/2021-09-14-net_localgroup_discovery.md
@@ -107,8 +107,8 @@ The following hunting analytic will identify the use of localgroup discovery usi
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **net_localgroup_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -137,6 +137,7 @@ False positives may be present. Tune as needed.
#### Associated Analytic story
* [Active Directory Discovery](/stories/active_directory_discovery)
* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md
index 3356fed25c..d1cfcb3cc0 100644
--- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md
+++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md
@@ -107,8 +107,8 @@ The following hunting analytic identifies the use of `get-localgroup` being used
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **powershell_get_localgroup_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-14-wmic_group_discovery.md b/docs/_posts/2021-09-14-wmic_group_discovery.md
index c697bf5232..4934e04504 100644
--- a/docs/_posts/2021-09-14-wmic_group_discovery.md
+++ b/docs/_posts/2021-09-14-wmic_group_discovery.md
@@ -109,8 +109,8 @@ During triage, review parallel processes and identify any further suspicious beh
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **wmic_group_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md
index 4c8a4013eb..694618f1b7 100644
--- a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md
+++ b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md
@@ -102,8 +102,8 @@ This search is to detect a suspicious whoami execution to check if the cmd or sh
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **check_elevated_cmd_using_whoami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md
index 9f48a1bb5b..d8ee054155 100644
--- a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md
+++ b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md
@@ -106,8 +106,8 @@ This search is to detect an anomaly event of non-chrome process accessing the fi
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **non_chrome_process_accessing_chrome_default_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md
index eb47910925..8ed284f78d 100644
--- a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md
+++ b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md
@@ -106,8 +106,8 @@ This search is to detect an anomaly event of non-firefox process accessing the f
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **non_firefox_process_access_firefox_profile_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -134,6 +134,7 @@ other browser not listed related to firefox may catch by this rule.
#### Associated Analytic story
* [FIN7](/stories/fin7)
* [Remcos](/stories/remcos)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2021-09-16-account_discovery_with_net_app.md b/docs/_posts/2021-09-16-account_discovery_with_net_app.md
index 3eb54391d9..2c66cec6fb 100644
--- a/docs/_posts/2021-09-16-account_discovery_with_net_app.md
+++ b/docs/_posts/2021-09-16-account_discovery_with_net_app.md
@@ -109,8 +109,8 @@ this search is to detect a potential account discovery series of command used by
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
index a387f7e780..54672494fe 100644
--- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
+++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
@@ -116,9 +116,9 @@ Attempt To Add Certificate To Untrusted Store
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **attempt_to_add_certificate_to_untrusted_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
index ee6b8e9c8c..8ee59db57a 100644
--- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
+++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
@@ -113,10 +113,10 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-bits_job_persistence.md b/docs/_posts/2021-09-16-bits_job_persistence.md
index 4bacba5373..65b5026013 100644
--- a/docs/_posts/2021-09-16-bits_job_persistence.md
+++ b/docs/_posts/2021-09-16-bits_job_persistence.md
@@ -103,9 +103,9 @@ The following query identifies Microsoft Background Intelligent Transfer Service
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **bits_job_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-bitsadmin_download_file.md b/docs/_posts/2021-09-16-bitsadmin_download_file.md
index b7c07192d5..e430f829c2 100644
--- a/docs/_posts/2021-09-16-bitsadmin_download_file.md
+++ b/docs/_posts/2021-09-16-bitsadmin_download_file.md
@@ -108,9 +108,9 @@ The following query identifies Microsoft Background Intelligent Transfer Service
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **bitsadmin_download_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
index 2b93b8622b..3a7ad373e5 100644
--- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
+++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
@@ -113,9 +113,9 @@ This search detects the use of wmic and Powershell to create a shadow copy.
#### Macros
The SPL above uses the following Macros:
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **creation_of_shadow_copy_with_wmic_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
index 4df0255546..dcf5dcfcc6 100644
--- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
+++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
@@ -112,9 +112,9 @@ This search detects credential dumping using copy command from a shadow copy.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **credential_dumping_via_copy_command_from_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
index e216f6991c..07f3c1ee10 100644
--- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
+++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
@@ -112,9 +112,9 @@ This search detects the creation of a symlink to a shadow copy.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **credential_dumping_via_symlink_to_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md
index 494d89b749..a3b6fe1e24 100644
--- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md
+++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md
@@ -113,8 +113,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM
#### Macros
The SPL above uses the following Macros:
* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_html_help_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md
index 5d586df5e8..64f09c68b7 100644
--- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md
+++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md
@@ -113,8 +113,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM
#### Macros
The SPL above uses the following Macros:
* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_html_help_using_infotech_storage_handlers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md
index 94be623f27..eacfc71a0e 100644
--- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md
+++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md
@@ -112,9 +112,9 @@ The following analytic identifies "mshta.exe" execution with inline protocol han
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_mshta_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md
index 8b03c85b2b..6e43b419ee 100644
--- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md
+++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md
@@ -112,9 +112,9 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_mshta_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
index 3922861f63..792de3fc4f 100644
--- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
+++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
@@ -112,9 +112,9 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **detect_psexec_with_accepteula_flag_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_renamed_7-zip.md b/docs/_posts/2021-09-16-detect_renamed_7-zip.md
index e00bafd53b..2aa3a5d738 100644
--- a/docs/_posts/2021-09-16-detect_renamed_7-zip.md
+++ b/docs/_posts/2021-09-16-detect_renamed_7-zip.md
@@ -107,8 +107,8 @@ The following analytic identifies renamed 7-Zip usage using Sysmon. At this stag
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_renamed_7-zip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_renamed_rclone.md b/docs/_posts/2021-09-16-detect_renamed_rclone.md
index 0170c0ed03..88e57e0dc8 100644
--- a/docs/_posts/2021-09-16-detect_renamed_rclone.md
+++ b/docs/_posts/2021-09-16-detect_renamed_rclone.md
@@ -102,8 +102,8 @@ The following analytic identifies the usage of `rclone.exe`, renamed, being used
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_renamed_rclone_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_renamed_winrar.md b/docs/_posts/2021-09-16-detect_renamed_winrar.md
index fda3661084..e0a0dee5d6 100644
--- a/docs/_posts/2021-09-16-detect_renamed_winrar.md
+++ b/docs/_posts/2021-09-16-detect_renamed_winrar.md
@@ -107,8 +107,8 @@ The following analtyic identifies renamed instances of `WinRAR.exe`. In most cas
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_renamed_winrar_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
index b85418080b..cbd7f74e6d 100644
--- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
+++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
@@ -114,9 +114,9 @@ During triage, confirm this is procdump.exe executing. If it is the first time a
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **dump_lsass_via_procdump_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_net.md b/docs/_posts/2021-09-16-local_account_discovery_with_net.md
index f4b3227e0b..53d906c803 100644
--- a/docs/_posts/2021-09-16-local_account_discovery_with_net.md
+++ b/docs/_posts/2021-09-16-local_account_discovery_with_net.md
@@ -108,8 +108,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **local_account_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md
index 3be4ca3539..8bbbca5fdd 100644
--- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md
+++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md
@@ -108,8 +108,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **local_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md
index bc01d8f37b..11ee174959 100644
--- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md
+++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md
@@ -108,8 +108,8 @@ The following detection identifies the latest behavior utilized by Ursnif malwar
#### Macros
The SPL above uses the following Macros:
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **office_product_spawning_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md
index d68351a19e..5907724877 100644
--- a/docs/_posts/2021-09-16-processes_launching_netsh.md
+++ b/docs/_posts/2021-09-16-processes_launching_netsh.md
@@ -113,8 +113,8 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr
#### Macros
The SPL above uses the following Macros:
* [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **processes_launching_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -139,6 +139,7 @@ Some VPN applications are known to launch netsh.exe. Outside of these instances,
* [Netsh Abuse](/stories/netsh_abuse)
* [Disabling Security Tools](/stories/disabling_security_tools)
* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md
index 108a92cdd0..5a3740eb78 100644
--- a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md
+++ b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md
@@ -107,8 +107,8 @@ This search is to detect potential malicious office document executing lolbin ch
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **office_document_spawned_child_process_to_download_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
index 4988b10ad9..9f36797a90 100644
--- a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
+++ b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
@@ -102,8 +102,8 @@ This search is to detect file creation in remcos folder in appdata which is the
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **remcos_rat_file_creation_in_remcos_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-27-change_default_file_association.md b/docs/_posts/2021-09-27-change_default_file_association.md
index 4244fd0b89..cb7c02689c 100644
--- a/docs/_posts/2021-09-27-change_default_file_association.md
+++ b/docs/_posts/2021-09-27-change_default_file_association.md
@@ -109,8 +109,8 @@ This analytic is developed to detect suspicious registry modification to change
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **change_default_file_association_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md
index 3b034ccca2..65c5eeab70 100644
--- a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md
+++ b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md
@@ -109,8 +109,8 @@ This search is to detect a suspicious modification of registry entry to persist
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **logon_script_event_trigger_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md
index e692c931a0..b84ed3e5c4 100644
--- a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md
+++ b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md
@@ -109,8 +109,8 @@ This analytic is developed to detect possible event trigger execution through sc
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **screensaver_event_trigger_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md
index 7271d312a2..d0cbefcb3b 100644
--- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md
+++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md
@@ -111,8 +111,8 @@ This analytic is to detect a suspicious modification or new registry entry regar
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **print_processor_registry_autostart_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md
index be4fd3f7ba..5ed0df7318 100644
--- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md
+++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md
@@ -108,8 +108,8 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **verclsid_clsid_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md
index 542a0c8b46..e3c8f76556 100644
--- a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md
+++ b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md
@@ -107,8 +107,8 @@ This analytic is to detect a suspicious wscript commandline to execute vbscript.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **vbscript_execution_using_wscript_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md
index dabdccd53c..8ae8f4edaf 100644
--- a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md
+++ b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md
@@ -108,8 +108,8 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **msbuild_suspicious_spawned_by_script_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
index 169b85a91a..aba5066818 100644
--- a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
+++ b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
@@ -109,9 +109,9 @@ This analytic is to detect a loading of dll using regsvr32 application with sile
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **regsvr32_silent_and_install_param_dll_loading_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md
index 04b84d8c5e..f72b3e29df 100644
--- a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md
+++ b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md
@@ -112,8 +112,8 @@ The following analytic identifies a process modifying the registry with a known
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **malicious_inprocserver32_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md
index f0c83e517f..f42d4979d5 100644
--- a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md
+++ b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md
@@ -112,8 +112,8 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **process_writing_dynamicwrapperx_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
index f7e4a6b192..a3863a8678 100644
--- a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
+++ b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
@@ -103,8 +103,8 @@ This analytic is to detect a suspicious rundll32 commandline to clear shim cache
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **rundll32_shimcache_flush_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
index 73f8cdfa44..c13cc3d56c 100644
--- a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
+++ b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
@@ -108,8 +108,8 @@ This analytic is to detect a suspicious copy of file from systemroot folder of t
#### Macros
The SPL above uses the following Macros:
* [process_copy](https://github.com/splunk/security_content/blob/develop/macros/process_copy.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_copy_on_system32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md
index 899a5b9487..0fbefce559 100644
--- a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md
+++ b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md
@@ -103,8 +103,8 @@ The following analytic identifies winhlp32.exe, found natively in `c:\windows\`,
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **winhlp32_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-06-sdelete_application_execution.md b/docs/_posts/2021-10-06-sdelete_application_execution.md
index d018edade9..0cd61d1772 100644
--- a/docs/_posts/2021-10-06-sdelete_application_execution.md
+++ b/docs/_posts/2021-10-06-sdelete_application_execution.md
@@ -112,9 +112,9 @@ This analytic is to detect the execution of sdelete.exe application sysinternal
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **sdelete_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md
index 4a2f07702a..238d194fdd 100644
--- a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md
+++ b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md
@@ -121,8 +121,8 @@ This analytic identifies a suspicious spawned process by WScript or CScript proc
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **wscript_or_cscript_suspicious_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md
index 1834efe99a..762e377e0f 100644
--- a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md
+++ b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md
@@ -118,8 +118,8 @@ The wevtutil.exe application is the windows event log utility. This searches for
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_wevtutil_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md
index 0916b6fef8..36e33ba380 100644
--- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md
+++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md
@@ -110,8 +110,8 @@ During triage, review parallel processes for further suspicious activity.
#### Macros
The SPL above uses the following Macros:
* [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **serviceprincipalnames_discovery_with_setspn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-18-disable_schedule_task.md b/docs/_posts/2021-10-18-disable_schedule_task.md
index cc6eee3d12..1b4cfa60ad 100644
--- a/docs/_posts/2021-10-18-disable_schedule_task.md
+++ b/docs/_posts/2021-10-18-disable_schedule_task.md
@@ -107,8 +107,8 @@ This analytic is to detect a suspicious commandline to disable existing schedule
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **disable_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md
index 4320088985..22720e91d1 100644
--- a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md
+++ b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md
@@ -105,8 +105,8 @@ During triage, review parallel processes for further behavior. In addition, iden
#### Macros
The SPL above uses the following Macros:
* [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_curl_download_to_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-03-windows_adfind_exe.md b/docs/_posts/2021-11-03-windows_adfind_exe.md
index d0aa902176..f998e017cf 100644
--- a/docs/_posts/2021-11-03-windows_adfind_exe.md
+++ b/docs/_posts/2021-11-03-windows_adfind_exe.md
@@ -107,8 +107,8 @@ This search looks for the execution of `adfind.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_adfind_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md
index e9d0341f4a..fd0857c133 100644
--- a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md
+++ b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md
@@ -126,8 +126,8 @@ This search looks for execution of commonly used attacker tools on an endpoint.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **attacker_tools_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md
index 1aa535fe1c..fe5471fb42 100644
--- a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md
+++ b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md
@@ -107,8 +107,8 @@ Adversaries may use one of the three methods based on the remote destination and
#### Macros
The SPL above uses the following Macros:
* [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_curl_upload_to_remote_destination_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
index 00688011cc..be55e557b9 100644
--- a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
@@ -109,8 +109,8 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_service_creation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
index e3f0c5a257..30f8951fe7 100644
--- a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
@@ -109,8 +109,8 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_service_initiation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
index 5bb1da6c62..4adbe759e9 100644
--- a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
+++ b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `winrs.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **remote_process_instantiation_via_winrm_and_winrs_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
index d5f4812d79..9efa6c3b0c 100644
--- a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
+++ b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
@@ -111,8 +111,8 @@ This analytic looks for the execution of `at.exe` with command-line arguments ut
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **scheduled_task_creation_on_remote_endpoint_using_at_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
index 7c615d89a5..8f7eb63971 100644
--- a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
@@ -111,8 +111,8 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **scheduled_task_initiation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md
index 6e8a86eaef..284af4d9fc 100644
--- a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md
+++ b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md
@@ -103,8 +103,8 @@ The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible St
#### Macros
The SPL above uses the following Macros:
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **wmic_xsl_execution_via_url_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md
index 6e3ae286d2..0d1451a1db 100644
--- a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md
+++ b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md
@@ -102,8 +102,8 @@ The following detection identifies excessive AccessDenied events within an hour
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_iam_accessdenied_discovery_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
index cfdd0c66c0..52abb47d1e 100644
--- a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
+++ b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
@@ -107,9 +107,9 @@ this analytic is to detect a suspicious compile before delivery approach of .net
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **csc_net_on_the_fly_compilation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md
index b4a8f3bba3..a40ceb6936 100644
--- a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md
+++ b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md
@@ -98,7 +98,7 @@ This analytic detects a potential suspicious modification of firewall rule allow
```
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*firewall*" Processes.process = "*allowedprogram*" Processes.process = "*add*" Processes.process = "*ENABLE*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*firewall*" Processes.process = "*allow*" Processes.process = "*add*" Processes.process = "*ENABLE*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
@@ -107,8 +107,8 @@ This analytic detects a potential suspicious modification of firewall rule allow
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **firewall_allowed_program_enable_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -133,6 +133,7 @@ A network operator or systems administrator may utilize an automated or manual e
#### Associated Analytic story
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
index 689b08553e..9d9050df1a 100644
--- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
+++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
@@ -108,8 +108,8 @@ This analytic look for a spawned process of route.exe windows application. Adver
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **network_discovery_using_route_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
index f061dea140..622f31b0c1 100644
--- a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
+++ b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
@@ -111,8 +111,8 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc
#### Macros
The SPL above uses the following Macros:
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **remote_process_instantiation_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-12-runas_execution_in_commandline.md b/docs/_posts/2021-11-12-runas_execution_in_commandline.md
index 8fc160fc66..cc681854c0 100644
--- a/docs/_posts/2021-11-12-runas_execution_in_commandline.md
+++ b/docs/_posts/2021-11-12-runas_execution_in_commandline.md
@@ -109,9 +109,9 @@ This analytic look for a spawned runas.exe process with a administrator user opt
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **runas_execution_in_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
index 1eb00cabc5..55bc046bbd 100644
--- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
+++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
@@ -112,8 +112,8 @@ During triage review resulting network connections, file modifications, and para
#### Macros
The SPL above uses the following Macros:
* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_installutil_uninstall_option_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
index 528f6b0294..c2736e0ce1 100644
--- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
+++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
@@ -111,8 +111,8 @@ During triage review resulting network connections, file modifications, and para
#### Macros
The SPL above uses the following Macros:
* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_installutil_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
index 89388cead9..81de8c5624 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
@@ -107,9 +107,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **remote_process_instantiation_via_dcom_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
index 47fd1b737f..5b8a381b82 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
@@ -102,9 +102,9 @@ This analytic looks for the execution of `powershell.exe` leveraging the `Invoke
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **remote_process_instantiation_via_wmi_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md
index f6a1e66377..9d36129ad0 100644
--- a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md
+++ b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md
@@ -102,8 +102,8 @@ The following analytic identifies DiskCryptor process name of dcrypt.exe or int
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_diskcryptor_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
index 77c478c787..cd91819f97 100644
--- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
+++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
@@ -107,9 +107,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **remote_process_instantiation_via_winrm_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-17-windows_dism_remove_defender.md b/docs/_posts/2021-11-17-windows_dism_remove_defender.md
index de4bb52790..407e0e576c 100644
--- a/docs/_posts/2021-11-17-windows_dism_remove_defender.md
+++ b/docs/_posts/2021-11-17-windows_dism_remove_defender.md
@@ -107,8 +107,8 @@ The following analytic identifies the use of the Windows Disk Image Utility, `di
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_dism_remove_defender_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
index 98e16c7643..3262267714 100644
--- a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
+++ b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
@@ -105,8 +105,8 @@ The following analytic identifies executable files (.exe or .dll) being written
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **executable_file_written_in_administrative_smb_share_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
index 1c834b88c8..ab844da06b 100644
--- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
+++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
@@ -108,8 +108,8 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **loading_of_dynwrapx_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md
index 13e86cbc0e..7616892f0b 100644
--- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md
+++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md
@@ -102,9 +102,9 @@ This analytic is to detect a suspicious dxdiag.exe process command-line executio
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_dxdiag](https://github.com/splunk/security_content/blob/develop/macros/process_dxdiag.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **system_info_gathering_using_dxdiag_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md
index 0302e0e287..a240857b3c 100644
--- a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md
+++ b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md
@@ -107,8 +107,8 @@ This analytic will detect if a suspicious process contains a commandline paramet
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **possible_browser_pass_view_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
index 4a7df02b80..f1d26ef0d2 100644
--- a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
@@ -109,8 +109,8 @@ The following analytic identifies `services.exe` spawning a LOLBAS execution pro
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **services_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
index 6393b95a4f..49d8668e14 100644
--- a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
@@ -111,8 +111,8 @@ The following analytic identifies `svchost.exe` spawning a LOLBAS execution proc
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **svchost_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
index 5020e994f5..479ec8abb8 100644
--- a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
@@ -102,8 +102,8 @@ The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution pro
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **wmiprsve_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
index 4f98add5e0..cc5641f5df 100644
--- a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
@@ -107,8 +107,8 @@ The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **wsmprovhost_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
index cc8520ac4b..7b21a8c296 100644
--- a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
@@ -2,6 +2,7 @@
title: "Mmc LOLBAS Execution Process Spawn"
excerpt: "Remote Services
, Distributed Component Object Model
+, MMC
"
categories:
- Endpoint
@@ -11,8 +12,10 @@ toc_label: ""
tags:
- Remote Services
- Distributed Component Object Model
+ - MMC
- Lateral Movement
- Lateral Movement
+ - Defense Evasion
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
@@ -49,6 +52,8 @@ The following analytic identifies `mmc.exe` spawning a LOLBAS execution process.
| [T1021.003](https://attack.mitre.org/techniques/T1021/003/) | Distributed Component Object Model | Lateral Movement |
+| [T1218.014](https://attack.mitre.org/techniques/T1218/014/) | MMC | Defense Evasion |
+
@@ -107,8 +112,8 @@ The following analytic identifies `mmc.exe` spawning a LOLBAS execution process.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **mmc_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -145,7 +150,7 @@ Legitimate applications may trigger this behavior, filter as needed.
| Risk Score | Impact | Confidence | Message |
| ----------- | ----------- |--------------|--------------|
-| 54.0 | 90 | 60 | Mmc.exe spawned a LOLBAS process on $dest |
+| 54.0 | 90 | 60 | Mmc.exe spawned a LOLBAS process on $dest$. |
> :information_source:
diff --git a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md
index fd75d5de84..c4f1f46cc0 100644
--- a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md
+++ b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md
@@ -107,8 +107,8 @@ This analytic will identify a suspicious process command-line related to Windows
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **add_or_set_windows_defender_exclusion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md b/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md
index e177a9deac..a3e9f131d9 100644
--- a/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md
+++ b/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md
@@ -136,6 +136,7 @@ admin or user may choose to use this windows features.
#### Associated Analytic story
* [Remcos](/stories/remcos)
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
index 9a1601b332..6ededee035 100644
--- a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
+++ b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
@@ -102,9 +102,9 @@ This analytic identifies commonly used command-line arguments used by `rclone.ex
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rclone](https://github.com/splunk/security_content/blob/develop/macros/process_rclone.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **detect_rclone_command-line_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
index e55b185381..86a012dfd6 100644
--- a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
+++ b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
@@ -7,6 +7,7 @@ excerpt: "Remote Services
, Scheduled Task
, Windows Service
, PowerShell
+, MMC
"
categories:
- Endpoint
@@ -21,6 +22,7 @@ tags:
- Scheduled Task
- Windows Service
- PowerShell
+ - MMC
- Lateral Movement
- Lateral Movement
- Lateral Movement
@@ -31,6 +33,7 @@ tags:
- Persistence
- Privilege Escalation
- Execution
+ - Defense Evasion
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
@@ -77,6 +80,8 @@ The following analytic assists with identifying a PowerShell process spawned as
| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+| [T1218.014](https://attack.mitre.org/techniques/T1218/014/) | MMC | Defense Evasion |
+
@@ -135,8 +140,8 @@ The following analytic assists with identifying a PowerShell process spawned as
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **possible_lateral_movement_powershell_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md
index 27fc81bebd..f70a9508fb 100644
--- a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md
+++ b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md
@@ -107,8 +107,8 @@ The search logic specifically looks for high number of distinct commands run in
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_linux_discovery_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md
index 1979e02a34..2ef2e5e6e0 100644
--- a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md
+++ b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md
@@ -102,8 +102,8 @@ The following analytic identifies the Raccine Rules Updater scheduled task being
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_raccine_scheduled_task_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
index 180db1a279..d94c2cff62 100644
--- a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
+++ b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
@@ -119,8 +119,8 @@ In addition, `msi.dll` has been abused in DLL side-loading attacks by being load
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **msi_module_loaded_by_non-system_binary_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md
index 0581a6cb2e..0c8c4f2440 100644
--- a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md
+++ b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md
@@ -108,8 +108,8 @@ The following analytic identifies the use of curl on Linux or MacOS attempting t
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **curl_download_and_bash_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md
index bfed14bc43..3247414e8f 100644
--- a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md
+++ b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md
@@ -108,8 +108,8 @@ The following analytic identifies the use of wget on Linux or MacOS attempting t
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **wget_download_and_bash_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md
index 363dd9cec2..9c3749457a 100644
--- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md
+++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md
@@ -107,9 +107,9 @@ The following analytic identifies the process name of Java, Apache, or Tomcat sp
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **linux_java_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
index be6c7be8fc..09319deb53 100644
--- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
+++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
@@ -124,8 +124,8 @@ CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **log4shell_jndi_payload_injection_with_outbound_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md
index 4a076c35c3..130435c879 100644
--- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md
+++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md
@@ -109,9 +109,9 @@ The following analytic identifies the process name of java.exe and w3wp.exe spaw
#### Macros
The SPL above uses the following Macros:
+* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml)
> :information_source:
> **windows_java_spawning_shells_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md
index 42cc8ce213..7a887aa3c0 100644
--- a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md
+++ b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md
@@ -117,8 +117,8 @@ The following analytic identifies a suspicious file creation in known cron table
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_add_files_in_known_crontab_directories_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md
index 47319dbe9c..bb6a258cfd 100644
--- a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md
+++ b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md
@@ -117,8 +117,8 @@ The following analytic identifies a suspicious file creation of /etc/at.allow or
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_at_allow_config_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md
index 6d59c78222..953ced99a4 100644
--- a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md
+++ b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md
@@ -117,8 +117,8 @@ The following analytic identifies a suspicious cronjobs modification using cront
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_edit_cron_table_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md
index 48da01550b..03a9fd16f5 100644
--- a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md
+++ b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md
@@ -117,8 +117,8 @@ This analytic looks for possible suspicious commandline that may use to append a
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md
index 74e771fcd1..ed0ee79276 100644
--- a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md
+++ b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md
@@ -117,8 +117,8 @@ This analytic looks for possible modification of cronjobs file using editor. Thi
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_possible_cronjob_modification_with_editor_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md
index 8a5ef21df0..6f00971b99 100644
--- a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md
+++ b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md
@@ -115,8 +115,8 @@ This analytic looks for suspicious file creation on init system directories for
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_file_creation_in_init_boot_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md
index b0fe1a2c23..2dbf6a99e7 100644
--- a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md
+++ b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md
@@ -115,8 +115,8 @@ This analytic looks for suspicious file creation in /etc/profile.d directory to
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_file_creation_in_profile_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md
index dd50e5d092..a9fdbc8fcb 100644
--- a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md
+++ b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md
@@ -115,8 +115,8 @@ This analytic looks for suspicious command-lines that can be possibly used to mo
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_possible_append_command_to_profile_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md
index 84593309e0..987f16168d 100644
--- a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md
+++ b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md
@@ -117,8 +117,8 @@ This analytic looks for suspicious file creation in systemd timer directory in l
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_service_file_created_in_systemd_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-20-linux_service_restarted.md b/docs/_posts/2021-12-20-linux_service_restarted.md
index 07b80b63ae..f35765c93a 100644
--- a/docs/_posts/2021-12-20-linux_service_restarted.md
+++ b/docs/_posts/2021-12-20-linux_service_restarted.md
@@ -117,8 +117,8 @@ This analytic looks for restarted or re-enable services in linux platform. This
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_service_restarted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md
index 8b5aa7f4d1..eec3c468b0 100644
--- a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md
+++ b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md
@@ -117,8 +117,8 @@ This analytic looks for created or enable services in linux platform. This techn
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_service_started_or_enabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-21-linux_add_user_account.md b/docs/_posts/2021-12-21-linux_add_user_account.md
index 73ed7ae760..9584b01ede 100644
--- a/docs/_posts/2021-12-21-linux_add_user_account.md
+++ b/docs/_posts/2021-12-21-linux_add_user_account.md
@@ -113,8 +113,8 @@ This analytic looks for commands to create user accounts on the linux platform.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_add_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md
index 1ee27b641b..35bdfcb666 100644
--- a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md
+++ b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md
@@ -113,8 +113,8 @@ This analytic looks for a commandline that change the file owner to root using c
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_change_file_owner_to_root_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md
index ff9d2ee30f..31ddc7dcaa 100644
--- a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md
+++ b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md
@@ -115,8 +115,8 @@ This analytic is to look for suspicious command lines that may add entry to /etc
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_nopasswd_entry_in_sudoers_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md
index 70cb99b0bc..a5ce53de0b 100644
--- a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md
+++ b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md
@@ -115,8 +115,8 @@ This analytic looks for suspicious chmod utility execution to enable SUID bit. T
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_setuid_using_chmod_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md
index f532a50a5d..3f84cbaeda 100644
--- a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md
+++ b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md
@@ -115,8 +115,8 @@ This analytic looks for suspicious setcap utility execution to enable SUID bit.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_setuid_using_setcap_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md
index 814ef3f322..3116da0cc8 100644
--- a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md
+++ b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md
@@ -115,8 +115,8 @@ This analytic is to looks for suspicious commandline that add entry to /etc/sudo
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_visudo_utility_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md
index 66b34d739a..e756d513a2 100644
--- a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md
+++ b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md
@@ -115,8 +115,8 @@ This analytic looks for suspicious file creation in kernel/driver directory in l
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_file_created_in_kernel_driver_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md
index 94a25b61c5..b2488c3634 100644
--- a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md
+++ b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md
@@ -115,8 +115,8 @@ This analytic looks for inserting of linux kernel module using insmod utility fu
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_insert_kernel_module_using_insmod_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md
index b251fd4fae..7f68a84eeb 100644
--- a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md
+++ b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md
@@ -115,8 +115,8 @@ This analytic looks for possible installing a linux kernel module using modprobe
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_install_kernel_module_using_modprobe_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md
index 8634937703..ecf91245bd 100644
--- a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md
+++ b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md
@@ -117,8 +117,8 @@ This analytic is to detect a suspicious command that may hijack a library functi
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_preload_hijack_library_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md
index e41cc28923..c58ac363d4 100644
--- a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md
+++ b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md
@@ -115,8 +115,8 @@ This analytic is to look for possible elevation control access using a common kn
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_common_process_for_elevation_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md
index 61633cc0b9..0087e4ed82 100644
--- a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md
+++ b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md
@@ -115,8 +115,8 @@ This analytic is to looks for file creation of sudoers.tmp file cause by editing
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_sudoers_tmp_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md
index cdb6c7fd4b..339e2ffa54 100644
--- a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md
+++ b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md
@@ -115,8 +115,8 @@ This analytic is to detect the execution of sudo or su command in linux operatin
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_sudo_or_su_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md
index d5b3d92b20..9eb88bf61d 100644
--- a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md
+++ b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md
@@ -115,8 +115,8 @@ This analytic is to detect the creation of doas.conf file in linux host platform
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_doas_conf_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-05-linux_doas_tool_execution.md b/docs/_posts/2022-01-05-linux_doas_tool_execution.md
index 2de453899f..a322917bc6 100644
--- a/docs/_posts/2022-01-05-linux_doas_tool_execution.md
+++ b/docs/_posts/2022-01-05-linux_doas_tool_execution.md
@@ -115,8 +115,8 @@ This analytic is to detect the doas tool execution in linux host platform. This
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_doas_tool_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md
index 2aa11354c6..9050778c1c 100644
--- a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md
+++ b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md
@@ -113,8 +113,8 @@ This analytic is to detect a possible attempt to dump or access the content of /
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_possible_access_to_credential_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md
index ccd0161f40..7a328f51ca 100644
--- a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md
+++ b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md
@@ -115,8 +115,8 @@ This analytic is to detect a possible access or modification of /etc/sudoers fil
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_possible_access_to_sudoers_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md
index 7a3d71fcb8..3116f02ed4 100644
--- a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md
+++ b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md
@@ -113,8 +113,8 @@ This analytic is to look for suspicious process command-line that might be acces
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_possible_access_or_modification_of_sshd_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md
index e48b498599..ee96e8edd4 100644
--- a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md
+++ b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md
@@ -113,8 +113,8 @@ This analytic is to look for possible ssh key file creation on ~/.ssh/ folder. T
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_possible_ssh_key_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md
index 713db23011..35a8742ac8 100644
--- a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md
+++ b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md
@@ -126,9 +126,9 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **powershell_-_connect_to_internet_with_hidden_window_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
index ee9b513261..58ff38a98a 100644
--- a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
+++ b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
@@ -109,8 +109,8 @@ The following hunting analytic identifies all processes requesting access into L
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **windows_hunting_system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
index cc2eb7766c..c48ad067c4 100644
--- a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
+++ b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
@@ -109,8 +109,8 @@ The following analytic identifies non SYSTEM accounts requesting access to lsass
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **windows_non-system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
index b9a6f99a07..bbc1eaf197 100644
--- a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
+++ b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
@@ -108,9 +108,9 @@ The following analytic uses a pretrained machine learning text classifier to det
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [potentially_malicious_code_on_cmdline_tokenize_score](https://github.com/splunk/security_content/blob/develop/macros/potentially_malicious_code_on_cmdline_tokenize_score.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **potentially_malicious_code_on_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
index 7cf91e628e..10fc37afbb 100644
--- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
+++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
@@ -112,9 +112,9 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **cmd_carry_out_string_command_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -145,6 +145,7 @@ False positives may be high based on legitimate scripted code in any environment
* [WhisperGate](/stories/whispergate)
* [Hermetic Wiper](/stories/hermetic_wiper)
* [Living Off The Land](/stories/living_off_the_land)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md
index a5ede8b26a..bc07278512 100644
--- a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md
+++ b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md
@@ -123,8 +123,8 @@ This analytic looks for the presence of suspicious commandline parameters typica
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **impacket_lateral_movement_commandline_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md
index d674b46386..77efddec03 100644
--- a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md
+++ b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md
@@ -119,9 +119,9 @@ Alternatively, may use regex per matching here https://regexr.com/662ov.
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **malicious_powershell_process_-_encoded_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
index 02fb93e350..b4a40a14d5 100644
--- a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
+++ b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
@@ -106,8 +106,8 @@ This analytic detects a suspicious process making a DNS query via known, abused
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **suspicious_process_dns_query_known_abuse_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
index 57a706f4f6..1ce9a54f4f 100644
--- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
+++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
@@ -119,8 +119,8 @@ The following analytic identifies native .net binaries within the Windows operat
#### Macros
The SPL above uses the following Macros:
* [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_dotnet_binary_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
index 921bf0c555..14da8b3f81 100644
--- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
+++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
@@ -118,8 +118,8 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro
#### Macros
The SPL above uses the following Macros:
* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_installutil_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
index 837ffae589..f0282edf5f 100644
--- a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
+++ b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
@@ -108,8 +108,8 @@ This analytic will identify excessive file deletion events in the Windows Defend
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **excessive_file_deletion_in_windefender_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md
index 343ee79b70..24d910afbf 100644
--- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md
+++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md
@@ -115,9 +115,9 @@ This analytic will identify the possible execution of ping sleep batch commands.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **ping_sleep_batch_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md
index 3abf7bcc8b..63f965312e 100644
--- a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md
+++ b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md
@@ -102,8 +102,8 @@ The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe ha
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_nirsoft_advancedrun_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
index 5784a8b047..5a80b1df2e 100644
--- a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
+++ b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
@@ -103,9 +103,9 @@ The following hunting analytic assists with identifying the proces execution of
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [is_nirsoft_software](https://github.com/splunk/security_content/blob/develop/macros/is_nirsoft_software.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_nirsoft_utilities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md
index 03327806bb..47944116d0 100644
--- a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md
+++ b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md
@@ -130,6 +130,7 @@ unknown
#### Associated Analytic story
* [Ransomware](/stories/ransomware)
* [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md
index e8ecd64163..8e3dd93cfa 100644
--- a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md
+++ b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md
@@ -136,6 +136,7 @@ admin or user may choose to disable windows defender product
#### Associated Analytic story
* [IceID](/stories/iceid)
* [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md
index 613b45ea6c..ec0d139879 100644
--- a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md
+++ b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md
@@ -136,6 +136,7 @@ user may choose to disable windows defender AV
#### Associated Analytic story
* [IceID](/stories/iceid)
* [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md
index 071f89f0f7..ff8afa4d65 100644
--- a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md
+++ b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md
@@ -136,6 +136,7 @@ admin or user may choose to disable windows defender product
#### Associated Analytic story
* [IceID](/stories/iceid)
* [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md
index 153296ecd2..d47dc7e78d 100644
--- a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md
+++ b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md
@@ -25,7 +25,7 @@ tags:
#### Description
-his analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
+This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
@@ -136,6 +136,7 @@ admin or user may choose to disable windows defender product
#### Associated Analytic story
* [IceID](/stories/iceid)
* [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md
index 172fb5e898..26e45f6eac 100644
--- a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md
+++ b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md
@@ -121,8 +121,8 @@ This correlation find exploitation of Log4Shell CVE-2021-44228 against systems u
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **log4shell_cve-2021-44228_exploitation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md
index cd12971e34..802f961654 100644
--- a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md
+++ b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md
@@ -150,6 +150,7 @@ There are many legitimate applications that must execute on system startup and w
* [IcedID](/stories/icedid)
* [Remcos](/stories/remcos)
* [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2022-01-27-disable_show_hidden_files.md b/docs/_posts/2022-01-27-disable_show_hidden_files.md
index 1fbb625a27..cdd4147341 100644
--- a/docs/_posts/2022-01-27-disable_show_hidden_files.md
+++ b/docs/_posts/2022-01-27-disable_show_hidden_files.md
@@ -145,6 +145,7 @@ unknown
#### Associated Analytic story
* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
* [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md
index 97b4f403b9..607d2f65a0 100644
--- a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md
+++ b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md
@@ -137,6 +137,7 @@ admin or user may choose to disable this windows features.
* [Ransomware](/stories/ransomware)
* [Revil Ransomware](/stories/revil_ransomware)
* [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
index 7799ba7e41..e89c702ca3 100644
--- a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
+++ b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
@@ -113,8 +113,8 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll.
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **windows_possible_credential_dumping_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
index afa35b8952..e9e34612d3 100644
--- a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
+++ b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
@@ -134,6 +134,7 @@ Unknown. Filter as needed.
#### Associated Analytic story
* [XMRig](/stories/xmrig)
* [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md
index 73f2bb9494..b4d42dcb83 100644
--- a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md
+++ b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md
@@ -108,8 +108,8 @@ The following analytic identifies `pkexec` spawning with no command-line argumen
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_pkexec_privilege_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md
index 373aab455c..ea2831e11f 100644
--- a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md
+++ b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md
@@ -109,8 +109,8 @@ The following analytic looks for the use of Mimikatz command line parameters lev
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **mimikatz_passtheticket_commandline_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md
index 4d24a25666..b5218c8b77 100644
--- a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md
+++ b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md
@@ -124,8 +124,8 @@ Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily ad
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **rubeus_command_line_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
index 40fc976731..f84dbd4d80 100644
--- a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
+++ b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
@@ -102,9 +102,9 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **certutil_download_with_urlcache_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
index 3ee1db0a58..b4a4ddd812 100644
--- a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
+++ b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
@@ -102,9 +102,9 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **certutil_download_with_verifyctl_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md
index aceafc0290..16040e64ed 100644
--- a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md
+++ b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md
@@ -108,8 +108,8 @@ The following analytic looks for a process accessing the winlogon.exe system pro
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **rubeus_kerberos_ticket_exports_through_winlogon_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md
index e5645065c1..250e164d6a 100644
--- a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md
+++ b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md
@@ -103,9 +103,9 @@ The following analytic identifies the use of Microsoft Remote Assistance, msra.e
#### Macros
The SPL above uses the following Macros:
+* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml)
> :information_source:
> **windows_remote_assistance_spawning_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
index 5f804c74bc..7722585244 100644
--- a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
+++ b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
@@ -111,9 +111,9 @@ The following analytic identifies Schtasks.exe creating a new task to start and
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_schtasks_create_run_as_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
index 7722a45d94..64239bc1a7 100644
--- a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
+++ b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
@@ -114,8 +114,8 @@ The following analytic identifies rundll32.exe loading an export function by ord
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **rundll_loading_dll_by_ordinal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md
index b8aee83d87..8dacc63d10 100644
--- a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md
+++ b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md
@@ -110,8 +110,8 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **kerberoasting_spn_request_with_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md
index f986444057..0cfb7e786f 100644
--- a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md
+++ b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md
@@ -108,8 +108,8 @@ This analytic is to look for dd command to overwrite file. This technique was ab
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_dd_file_overwrite_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md
index e5923bbaac..1ca1eaee9e 100644
--- a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md
+++ b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md
@@ -106,9 +106,9 @@ DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_diskshadow_proxy_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md
index c3e0bf98fc..e3ba39dbbc 100644
--- a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md
+++ b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md
@@ -114,8 +114,8 @@ The following analytic identifies the Windows Windows Remote Auto Dialer, rasaut
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_rasautou_dll_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md
index 12bd46fc7a..39f2b80d72 100644
--- a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md
+++ b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md
@@ -112,8 +112,8 @@ This analytic is to look for suspicious raw access read to drive where the maste
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **windows_raw_access_to_master_boot_record_drive_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md
index b8e76acd2d..51d1e73d56 100644
--- a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md
+++ b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md
@@ -111,8 +111,8 @@ The following analytic identifies regasm.exe with a network connection to a publ
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **detect_regasm_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md
index 6c6367c37c..663285a202 100644
--- a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md
+++ b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md
@@ -111,8 +111,8 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **detect_regsvcs_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md
index 4ee6ea7a4a..1cf612c716 100644
--- a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md
+++ b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md
@@ -109,8 +109,8 @@ This search is to detect modification of registry to bypass UAC windows feature.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **net_profiler_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md
index a68784e06b..1e3d6d93d3 100644
--- a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md
+++ b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md
@@ -103,8 +103,8 @@ This detection is to identify a suspicious process that tries to delete the proc
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **process_deleting_its_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-18-rundll32_dnsquery.md b/docs/_posts/2022-02-18-rundll32_dnsquery.md
index d2f3c5bda6..75b9319c65 100644
--- a/docs/_posts/2022-02-18-rundll32_dnsquery.md
+++ b/docs/_posts/2022-02-18-rundll32_dnsquery.md
@@ -106,8 +106,8 @@ This search is to detect a suspicious rundll32.exe process having a http connect
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **rundll32_dnsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
index f9ccc2a3bb..13c28723df 100644
--- a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
+++ b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
@@ -113,8 +113,8 @@ Monitor for changes of the ExecutionPolicy in the registry to the values "unrest
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md
index fd63b65fa0..6ac4eef9b9 100644
--- a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md
+++ b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md
@@ -115,8 +115,8 @@ The following analytic identifies the creation or deletion of a scheduled task u
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **scheduled_task_deleted_or_created_via_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -142,6 +142,7 @@ It is possible scripts or administrators may trigger this analytic. Filter as ne
* [NOBELIUM Group](/stories/nobelium_group)
* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
* [Living Off The Land](/stories/living_off_the_land)
+* [Azorult](/stories/azorult)
diff --git a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md
index eaff2cd6b9..96eedbf53b 100644
--- a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md
+++ b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md
@@ -109,8 +109,8 @@ This analytic is to look for wmi commandlines to execute or create process. This
#### Macros
The SPL above uses the following Macros:
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_wmi_process_call_create_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md
index ac188f0ae5..e336a11827 100644
--- a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md
+++ b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md
@@ -109,8 +109,8 @@ This analytic is to look for process commandline that contains named pipe. This
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_process_with_namedpipe_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-24-detect_empire_with_powershell_script_block_logging.md b/docs/_posts/2022-02-24-detect_empire_with_powershell_script_block_logging.md
new file mode 100644
index 0000000000..489425ca79
--- /dev/null
+++ b/docs/_posts/2022-02-24-detect_empire_with_powershell_script_block_logging.md
@@ -0,0 +1,168 @@
+---
+title: "Detect Empire with PowerShell Script Block Logging"
+excerpt: "Command and Scripting Interpreter
+, PowerShell
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-02-24
+toc: true
+toc_label: ""
+tags:
+ - Command and Scripting Interpreter
+ - PowerShell
+ - Execution
+ - Execution
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \
+This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-02-24
+- **Author**: Michael Haag, Splunk
+- **ID**: bc1dc6b8-c954-11eb-bade-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 (ScriptBlockText=*system.net.webclient* AND ScriptBlockText=*frombase64string*)
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `detect_empire_with_powershell_script_block_logging_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **detect_empire_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+False positives may only pertain to it not being related to Empire, but another framework. Filter as needed if any applications use the same pattern.
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 81.0 | 90 | 90 | The following behavior was identified and typically related to PowerShell-Empire on $Computer$ by $UserID$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+* [https://github.com/BC-SECURITY/Empire](https://github.com/BC-SECURITY/Empire)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/empire.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/empire.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-24-detect_mimikatz_with_powershell_script_block_logging.md b/docs/_posts/2022-02-24-detect_mimikatz_with_powershell_script_block_logging.md
new file mode 100644
index 0000000000..e4b8cd9522
--- /dev/null
+++ b/docs/_posts/2022-02-24-detect_mimikatz_with_powershell_script_block_logging.md
@@ -0,0 +1,167 @@
+---
+title: "Detect Mimikatz With PowerShell Script Block Logging"
+excerpt: "OS Credential Dumping
+, PowerShell
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-02-24
+toc: true
+toc_label: ""
+tags:
+ - OS Credential Dumping
+ - PowerShell
+ - Credential Access
+ - Execution
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+This analytic identifies common Mimikatz functions that may be identified in the script block, including `mimikatz`. This will catch the most basic use cases for Pass the Ticket, Pass the Hash and `-DumprCreds`. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-02-24
+- **Author**: Michael Haag, Splunk
+- **ID**: 8148c29c-c952-11eb-9255-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*, *kerberos::ptt*, *kerberos::golden*)
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `detect_mimikatz_with_powershell_script_block_logging_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **detect_mimikatz_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+False positives should be limited as the commands being identifies are quite specific to EventCode 4104 and Mimikatz. Filter as needed.
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 90.0 | 90 | 100 | The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $Computer$ by $UserID$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-24-get-foresttrust_with_powershell_script_block.md b/docs/_posts/2022-02-24-get-foresttrust_with_powershell_script_block.md
new file mode 100644
index 0000000000..5182816179
--- /dev/null
+++ b/docs/_posts/2022-02-24-get-foresttrust_with_powershell_script_block.md
@@ -0,0 +1,164 @@
+---
+title: "Get-ForestTrust with PowerShell Script Block"
+excerpt: "Domain Trust Discovery
+, PowerShell
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-02-24
+toc: true
+toc_label: ""
+tags:
+ - Domain Trust Discovery
+ - PowerShell
+ - Discovery
+ - Execution
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \
+This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-02-24
+- **Author**: Michael Haag, Splunk
+- **ID**: 70fac80e-0bf1-11ec-9ba0-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText = "*get-foresttrust*"
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `get_foresttrust_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **get-foresttrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* EventCode
+* ScriptBlockText
+* Path
+* Opcode
+* Computer
+* UserID
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+False positives may be present. Tune as needed.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 12.0 | 30 | 40 | Suspicious PowerShell Get-ForestTrust was identified on endpoint $Computer$ by user $UserID$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/](https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell-xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell-xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-25-powershell_domain_enumeration.md b/docs/_posts/2022-02-25-powershell_domain_enumeration.md
new file mode 100644
index 0000000000..3013b00e9f
--- /dev/null
+++ b/docs/_posts/2022-02-25-powershell_domain_enumeration.md
@@ -0,0 +1,167 @@
+---
+title: "PowerShell Domain Enumeration"
+excerpt: "Command and Scripting Interpreter
+, PowerShell
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-02-25
+toc: true
+toc_label: ""
+tags:
+ - Command and Scripting Interpreter
+ - PowerShell
+ - Execution
+ - Execution
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \
+This analytic identifies specific PowerShell modules typically used to enumerate an organizations domain or users. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-02-25
+- **Author**: Michael Haag, Splunk
+- **ID**: e1866ce2-ca22-11eb-8e44-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText IN (*get-netdomaintrust*, *get-netforesttrust*, *get-addomain*, *get-adgroupmember*, *get-domainuser*)
+| stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `powershell_domain_enumeration_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **powershell_domain_enumeration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+It is possible there will be false positives, filter as needed.
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 42.0 | 60 | 70 | A suspicious powershell script contains domain enumeration command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_domain_enumeration.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-25-powershell_enable_smb1protocol_feature.md b/docs/_posts/2022-02-25-powershell_enable_smb1protocol_feature.md
new file mode 100644
index 0000000000..05dd1e46ee
--- /dev/null
+++ b/docs/_posts/2022-02-25-powershell_enable_smb1protocol_feature.md
@@ -0,0 +1,163 @@
+---
+title: "Powershell Enable SMB1Protocol Feature"
+excerpt: "Obfuscated Files or Information
+, Indicator Removal from Tools
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-02-25
+toc: true
+toc_label: ""
+tags:
+ - Obfuscated Files or Information
+ - Indicator Removal from Tools
+ - Defense Evasion
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the compromise network system.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-02-25
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: afed80b2-d34b-11eb-a952-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion |
+
+| [T1027.005](https://attack.mitre.org/techniques/T1027/005/) | Indicator Removal from Tools | Defense Evasion |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText = "*Enable-WindowsOptionalFeature*" ScriptBlockText = "*SMB1Protocol*"
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `powershell_enable_smb1protocol_feature_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **powershell_enable_smb1protocol_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* EventCode
+* ScriptBlockText
+* Computer
+* UserID
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event.
+
+#### Known False Positives
+network operator may enable or disable this windows feature.
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+* [Ransomware](/stories/ransomware)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 25.0 | 50 | 50 | Powershell Enable SMB1Protocol Feature |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/](https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-25-powershell_fileless_process_injection_via_getprocaddress.md b/docs/_posts/2022-02-25-powershell_fileless_process_injection_via_getprocaddress.md
new file mode 100644
index 0000000000..161f350dd4
--- /dev/null
+++ b/docs/_posts/2022-02-25-powershell_fileless_process_injection_via_getprocaddress.md
@@ -0,0 +1,174 @@
+---
+title: "Powershell Fileless Process Injection via GetProcAddress"
+excerpt: "Command and Scripting Interpreter
+, Process Injection
+, PowerShell
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-02-25
+toc: true
+toc_label: ""
+tags:
+ - Command and Scripting Interpreter
+ - Process Injection
+ - PowerShell
+ - Execution
+ - Defense Evasion
+ - Privilege Escalation
+ - Execution
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+This analytic identifies `GetProcAddress` in the script block. This is not normal to be used by most PowerShell scripts and is typically unsafe/malicious. Many attack toolkits use GetProcAddress to obtain code execution. \
+In use, `$var_gpa = $var_unsafe_native_methods.GetMethod(GetProcAddress` and later referenced/executed elsewhere. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-02-25
+- **Author**: Michael Haag, Splunk
+- **ID**: a26d9db4-c883-11eb-9d75-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText=*getprocaddress*
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `powershell_fileless_process_injection_via_getprocaddress_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **powershell_fileless_process_injection_via_getprocaddress_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Limited false positives. Filter as needed.
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 48.0 | 60 | 80 | A suspicious powershell script contains GetProcAddress API in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-25-powershell_processing_stream_of_data.md b/docs/_posts/2022-02-25-powershell_processing_stream_of_data.md
new file mode 100644
index 0000000000..f037eba0bd
--- /dev/null
+++ b/docs/_posts/2022-02-25-powershell_processing_stream_of_data.md
@@ -0,0 +1,166 @@
+---
+title: "Powershell Processing Stream Of Data"
+excerpt: "Command and Scripting Interpreter
+, PowerShell
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-02-25
+toc: true
+toc_label: ""
+tags:
+ - Command and Scripting Interpreter
+ - PowerShell
+ - Execution
+ - Execution
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is processing compressed stream data. This is typically found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files that are stream flattened and will be deflated durnig execution. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-02-25
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 0d718b52-c9f1-11eb-bc61-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText = "*IO.Compression.*" OR ScriptBlockText = "*IO.StreamReader*" OR ScriptBlockText = "*]::Decompress*"
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `powershell_processing_stream_of_data_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **powershell_processing_stream_of_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* EventCode
+* ScriptBlockText
+* Computer
+* UserID
+* Score
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+powershell may used this function to process compressed data.
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 40.0 | 50 | 80 | A suspicious powershell script contains stream command in $ScriptBlockText$ commonly for processing compressed or to decompressed binary file with EventCode $EventCode$ in host $Computer$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9](https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9)
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/streamreader.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/streamreader.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_processing_stream_of_data.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-25-recon_using_wmi_class.md b/docs/_posts/2022-02-25-recon_using_wmi_class.md
new file mode 100644
index 0000000000..42740bd3da
--- /dev/null
+++ b/docs/_posts/2022-02-25-recon_using_wmi_class.md
@@ -0,0 +1,167 @@
+---
+title: "Recon Using WMI Class"
+excerpt: "Gather Victim Host Information
+, PowerShell
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-02-25
+toc: true
+toc_label: ""
+tags:
+ - Gather Victim Host Information
+ - PowerShell
+ - Reconnaissance
+ - Execution
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies suspicious PowerShell via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found where the adversary will identify services and system information on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-02-25
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 018c1972-ca07-11eb-9473-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 (ScriptBlockText= "*SELECT*" OR ScriptBlockText= "*Get-WmiObject*") AND (ScriptBlockText= "*Win32_Bios*" OR ScriptBlockText= "*Win32_OperatingSystem*" OR ScriptBlockText= "*Win32_Processor*" OR ScriptBlockText= "*Win32_ComputerSystem*" OR ScriptBlockText= "*Win32_ComputerSystemProduct*" OR ScriptBlockText= "*Win32_ShadowCopy*")
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `recon_using_wmi_class_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **recon_using_wmi_class_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* EventCode
+* ScriptBlockText
+* Computer
+* UserID
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+network administrator may used this command for checking purposes
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+* [Industroyer2](/stories/industroyer2)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 60.0 | 75 | 80 | A suspicious powershell script contains host recon command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/](https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/)
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+* [https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/](https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/recon_using_wmi_class.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md
index 87dfcd6ea1..7c5c0a2b02 100644
--- a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md
+++ b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md
@@ -114,8 +114,8 @@ This analytic is to look for suspicious file creation in the critical folder lik
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_file_without_extension_in_critical_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md
index 539abbfa7f..8585a4f9e0 100644
--- a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md
+++ b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md
@@ -112,8 +112,8 @@ This analytic is to look for suspicious raw access read to device disk partition
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **windows_raw_access_to_disk_volume_partition_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-26-serviceprincipalnames_discovery_with_powershell.md b/docs/_posts/2022-02-26-serviceprincipalnames_discovery_with_powershell.md
new file mode 100644
index 0000000000..765203e484
--- /dev/null
+++ b/docs/_posts/2022-02-26-serviceprincipalnames_discovery_with_powershell.md
@@ -0,0 +1,174 @@
+---
+title: "ServicePrincipalNames Discovery with PowerShell"
+excerpt: "Kerberoasting
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-02-26
+toc: true
+toc_label: ""
+tags:
+ - Kerberoasting
+ - Credential Access
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies `powershell.exe` usage, using Script Block Logging EventCode 4104, related to querying the domain for Service Principle Names. typically, this is a precursor activity related to kerberoasting or the silver ticket attack. \
+What is a ServicePrincipleName? \
+A service principal name (SPN) is a unique identifier of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account. This allows a client application to request that the service authenticate an account even if the client does not have the account name.\
+The following analytic identifies the use of KerberosRequestorSecurityToken class within the script block. Using .NET System.IdentityModel.Tokens.KerberosRequestorSecurityToken class in PowerShell is the equivelant of using setspn.exe. \
+During triage, review parallel processes for further suspicious activity.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-02-26
+- **Author**: Michael Haag, Splunk
+- **ID**: 13243068-2d38-11ec-8908-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1558.003](https://attack.mitre.org/techniques/T1558/003/) | Kerberoasting | Credential Access |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText="*KerberosRequestorSecurityToken*"
+| stats count min(_time) as firstTime max(_time) as lastTime by ScriptBlockText Opcode Computer UserID EventCode
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `serviceprincipalnames_discovery_with_powershell_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **serviceprincipalnames_discovery_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+False positives should be limited, however filter as needed.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $Computer$ by user $UserID$ attempting to identify service principle names. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names](https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names)
+* [https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8](https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8)
+* [https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting)
+* [https://strontic.github.io/xcyclopedia/library/setspn.exe-5C184D581524245DAD7A0A02B51FD2C2.html](https://strontic.github.io/xcyclopedia/library/setspn.exe-5C184D581524245DAD7A0A02B51FD2C2.html)
+* [https://attack.mitre.org/techniques/T1558/003/](https://attack.mitre.org/techniques/T1558/003/)
+* [https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spn-setspn-syntax.aspx](https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spn-setspn-syntax.aspx)
+* [https://web.archive.org/web/20220212163642/https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/](https://web.archive.org/web/20220212163642/https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/)
+* [https://blog.zsec.uk/paving-2-da-wholeset/](https://blog.zsec.uk/paving-2-da-wholeset/)
+* [https://msitpros.com/?p=3113](https://msitpros.com/?p=3113)
+* [https://adsecurity.org/?p=3466](https://adsecurity.org/?p=3466)
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-powershell_kerberos.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-powershell_kerberos.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md
index 574b009b8e..74b80bc8eb 100644
--- a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md
+++ b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md
@@ -103,8 +103,8 @@ This analytic will identify suspicious series of process executions. We have ob
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **excessive_distinct_processes_from_windows_temp_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-03-aws_createaccesskey.md b/docs/_posts/2022-03-03-aws_createaccesskey.md
index 9e1ff21eae..bad265d09a 100644
--- a/docs/_posts/2022-03-03-aws_createaccesskey.md
+++ b/docs/_posts/2022-03-03-aws_createaccesskey.md
@@ -113,8 +113,8 @@ This search looks for AWS CloudTrail events where a user A who has already permi
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_createaccesskey_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-03-aws_updateloginprofile.md b/docs/_posts/2022-03-03-aws_updateloginprofile.md
index 696c5ea753..8b8bb3f691 100644
--- a/docs/_posts/2022-03-03-aws_updateloginprofile.md
+++ b/docs/_posts/2022-03-03-aws_updateloginprofile.md
@@ -113,8 +113,8 @@ This search looks for AWS CloudTrail events where a user A who has already permi
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_updateloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-08-suspicious_msbuild_path.md b/docs/_posts/2022-03-08-suspicious_msbuild_path.md
index cdc1d04670..f3a0b01783 100644
--- a/docs/_posts/2022-03-08-suspicious_msbuild_path.md
+++ b/docs/_posts/2022-03-08-suspicious_msbuild_path.md
@@ -123,8 +123,8 @@ The following analytic identifies msbuild.exe executing from a non-standard path
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_msbuild_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md b/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md
index f693985285..ccc0b8dbdc 100644
--- a/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md
+++ b/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md
@@ -108,8 +108,8 @@ The following analytic identifies a process performing an outbound connection on
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **unknown_process_using_the_kerberos_protocol_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md
index a34980db99..166aa0dead 100644
--- a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md
@@ -113,9 +113,9 @@ The following analytic identifies regasm.exe with no command line arguments. Thi
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_regasm_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md
index 7451a3e1bf..2a33a397b7 100644
--- a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md
@@ -113,9 +113,9 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_regsvcs_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md
index 34da063428..ada2c79c91 100644
--- a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md
@@ -109,8 +109,8 @@ The following analytic identifies DLLHost.exe with no command line arguments wit
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **dllhost_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md
index 4be64bf6d4..c518f1efca 100644
--- a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md
@@ -109,8 +109,8 @@ The following analytic identifies gpupdate.exe with no command line arguments an
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **gpupdate_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md b/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md
index 54d27c0615..2b4295dc4f 100644
--- a/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md
+++ b/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md
@@ -105,8 +105,8 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **kerberos_service_ticket_request_using_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md
index 7d5b5c81d6..d7c1351544 100644
--- a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md
@@ -119,8 +119,8 @@ The following analytic identifies rundll32.exe with no command line arguments an
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **rundll32_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md
index e7b0675784..04a239f788 100644
--- a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md
+++ b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md
@@ -109,8 +109,8 @@ The following analytic identifies searchprotocolhost.exe with no command line ar
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **searchprotocolhost_with_no_command_line_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md
index 38499707fa..1e1a15cdee 100644
--- a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md
@@ -104,9 +104,9 @@ The following analytic identifies DLLHost.exe with no command line arguments. It
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_dllhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md
index b0cb0b9aa5..2f48fe3ae8 100644
--- a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md
@@ -104,9 +104,9 @@ The following analytic identifies gpupdate.exe with no command line arguments. I
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **suspicious_gpupdate_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md
index 330e87fee4..7df417a8ed 100644
--- a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md
@@ -119,8 +119,8 @@ The following analytic identifies rundll32.exe with no command line arguments. I
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_rundll32_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md
index 7ae0f68c7e..38bf86e1be 100644
--- a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md
@@ -104,8 +104,8 @@ The following analytic identifies searchprotocolhost.exe with no command line ar
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_searchprotocolhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md
index 02546a0eed..f012129af1 100644
--- a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md
+++ b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md
@@ -116,8 +116,8 @@ During triage review resulting network connections, file modifications, and para
#### Macros
The SPL above uses the following Macros:
* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_installutil_remote_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md
index 4eba7529a2..5204d6ee21 100644
--- a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md
+++ b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md
@@ -117,8 +117,8 @@ During triage review resulting network connections, file modifications, and para
#### Macros
The SPL above uses the following Macros:
* [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_installutil_uninstall_option_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md b/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md
index 68b0b97869..248502084b 100644
--- a/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md
+++ b/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md
@@ -102,8 +102,8 @@ This analytic identifies suspicious modification of ACL permission to a files or
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **modify_acl_permission_to_files_or_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md b/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md
index fce94f7e8c..daf52c2a5f 100644
--- a/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md
+++ b/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md
@@ -2,6 +2,7 @@
title: "GetLocalUser with PowerShell Script Block"
excerpt: "Account Discovery
, Local Account
+, PowerShell
"
categories:
- Endpoint
@@ -11,8 +12,10 @@ toc_label: ""
tags:
- Account Discovery
- Local Account
+ - PowerShell
- Discovery
- Discovery
+ - Execution
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
@@ -48,6 +51,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
| [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery |
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
@@ -113,6 +118,10 @@ The SPL above uses the following Macros:
#### Required field
* _time
+* EventCode
+* ScriptBlockText
+* Computer
+* UserID
#### How To Implement
@@ -123,6 +132,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
#### Associated Analytic story
* [Active Directory Discovery](/stories/active_directory_discovery)
+* [Malicious PowerShell](/stories/malicious_powershell)
@@ -131,7 +141,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
| Risk Score | Impact | Confidence | Message |
| ----------- | ----------- |--------------|--------------|
-| 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ |
+| 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $Computer$ by $user$ |
> :information_source:
@@ -140,6 +150,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
#### Reference
* [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
diff --git a/docs/_posts/2022-03-22-powershell_execute_com_object.md b/docs/_posts/2022-03-22-powershell_execute_com_object.md
index 18ed9ef03a..d817299c3a 100644
--- a/docs/_posts/2022-03-22-powershell_execute_com_object.md
+++ b/docs/_posts/2022-03-22-powershell_execute_com_object.md
@@ -2,6 +2,7 @@
title: "Powershell Execute COM Object"
excerpt: "Component Object Model Hijacking
, Event Triggered Execution
+, PowerShell
"
categories:
- Endpoint
@@ -11,10 +12,12 @@ toc_label: ""
tags:
- Component Object Model Hijacking
- Event Triggered Execution
+ - PowerShell
- Persistence
- Privilege Escalation
- Persistence
- Privilege Escalation
+ - Execution
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
@@ -51,6 +54,8 @@ This search is to detect a COM CLSID execution through powershell. This techniqu
| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation |
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
@@ -116,6 +121,9 @@ The SPL above uses the following Macros:
#### Required field
* _time
+* ScriptBlockText
+* Computer
+* EventCode
#### How To Implement
@@ -136,7 +144,7 @@ network operrator may use this command.
| Risk Score | Impact | Confidence | Message |
| ----------- | ----------- |--------------|--------------|
-| 5.0 | 10 | 50 | A suspicious powershell script contains COM CLSID command in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
+| 5.0 | 10 | 50 | A suspicious powershell script contains COM CLSID command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ |
> :information_source:
@@ -145,6 +153,7 @@ network operrator may use this command.
#### Reference
* [https://threadreaderapp.com/thread/1423361119926816776.html](https://threadreaderapp.com/thread/1423361119926816776.html)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
@@ -154,7 +163,6 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/pwh_com_object/windows-powershell-xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/pwh_com_object/windows-powershell-xml.log)
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-powershell.log)
diff --git a/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md b/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md
index b800532061..32b10e6e0d 100644
--- a/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md
+++ b/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md
@@ -114,9 +114,9 @@ The SPL above uses the following Macros:
#### Required field
* _time
* EventCode
-* Message
-* ComputerName
-* User
+* ScriptBlockText
+* Computer
+* UserID
#### How To Implement
@@ -136,7 +136,7 @@ powershell may used this function to store out object into memory.
| Risk Score | Impact | Confidence | Message |
| ----------- | ----------- |--------------|--------------|
-| 40.0 | 50 | 80 | A suspicious powershell script contains memorystream command in $Message$ as new object backstore with EventCode $EventCode$ in host $ComputerName$ |
+| 40.0 | 50 | 80 | A suspicious powershell script contains memorystream command in $ScriptBlockText$ as new object backstore with EventCode $EventCode$ in host $Computer$ |
> :information_source:
diff --git a/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md b/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md
index 41ca8c1dbb..c9a09b279a 100644
--- a/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md
+++ b/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md
@@ -109,9 +109,9 @@ The SPL above uses the following Macros:
#### Required field
* _time
* EventCode
-* Message
-* ComputerName
-* User
+* ScriptBlockText
+* Computer
+* UserID
#### How To Implement
@@ -132,7 +132,7 @@ network administrator may used this command for checking purposes
| Risk Score | Impact | Confidence | Message |
| ----------- | ----------- |--------------|--------------|
-| 56.0 | 70 | 80 | A suspicious powershell script contains AV recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
+| 56.0 | 70 | 80 | A suspicious powershell script contains AV recon command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ |
> :information_source:
@@ -145,6 +145,7 @@ network administrator may used this command for checking purposes
* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
@@ -154,7 +155,6 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1592/pwh_av_recon/windows-powershell-xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1592/pwh_av_recon/windows-powershell-xml.log)
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log)
diff --git a/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md b/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md
index e285770d5e..9aff5320c5 100644
--- a/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md
+++ b/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md
@@ -113,10 +113,11 @@ The SPL above uses the following Macros:
#### Required field
* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
* EventCode
-* Message
-* ComputerName
-* User
#### How To Implement
@@ -135,7 +136,7 @@ Administrators may leverage WinRM and `Invoke-Command` to start a process on rem
| Risk Score | Impact | Confidence | Message |
| ----------- | ----------- |--------------|--------------|
-| 45.0 | 90 | 50 | A process was started on a remote endpoint from $ComputerName by abusing WinRM using PowerShell.exe |
+| 45.0 | 90 | 50 | A process was started on a remote endpoint from $Computer$ by abusing WinRM using PowerShell.exe |
> :information_source:
diff --git a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md
index 42ee8d7ce7..424eff1d3a 100644
--- a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md
+++ b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md
@@ -111,8 +111,8 @@ This analytic is to detect a suspicious process terminating Lsass process. Lsass
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **windows_terminating_lsass_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md b/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md
index 9ae2aae28d..d6a31df127 100644
--- a/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md
+++ b/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md
@@ -123,8 +123,8 @@ The following analytic identifies the use of a delivered ISO file that has been
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_iso_lnk_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md
index c503983391..f5be1cf051 100644
--- a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md
+++ b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md
@@ -112,8 +112,8 @@ The following analytic assists with viewing all drivers being loaded by using Sy
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **windows_drivers_loaded_by_signature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-02-getnettcpconnection_with_powershell_script_block.md b/docs/_posts/2022-04-02-getnettcpconnection_with_powershell_script_block.md
new file mode 100644
index 0000000000..5057a097e8
--- /dev/null
+++ b/docs/_posts/2022-04-02-getnettcpconnection_with_powershell_script_block.md
@@ -0,0 +1,155 @@
+---
+title: "GetNetTcpconnection with PowerShell Script Block"
+excerpt: "System Network Connections Discovery
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-04-02
+toc: true
+toc_label: ""
+tags:
+ - System Network Connections Discovery
+ - Discovery
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-NetTcpconnection ` commandlet. This commandlet is used to return a listing of network connections on a compromised system. Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-04-02
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 091712ff-b02a-4d43-82ed-34765515d95d
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 (ScriptBlockText = "*Get-NetTcpconnection*")
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `getnettcpconnection_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **getnettcpconnection_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use this PowerShell commandlet for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | Network Connection discovery on $Computer$ by $user$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1049/](https://attack.mitre.org/techniques/T1049/)
+* [https://docs.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection?view=windowsserver2019-ps](https://docs.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection?view=windowsserver2019-ps)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/nettcpconnection.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/nettcpconnection.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md
index 008e97ef0a..cb85c01f90 100644
--- a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md
+++ b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md
@@ -113,8 +113,8 @@ This search detects a disabled security workflow in GitHub Actions. An attacker
#### Macros
The SPL above uses the following Macros:
-* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
> :information_source:
> **github_actions_disable_security_workflow_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md b/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md
index 16035560b4..20a44c84b6 100644
--- a/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md
+++ b/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md
@@ -115,8 +115,8 @@ This analytic looks for suspicious commandline that redirect the stdout or possi
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_stdout_redirection_to_dev_null_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md
index acd9989556..0393e4c84c 100644
--- a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md
+++ b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md
@@ -107,8 +107,8 @@ The following analytic detects programs that have been started by forfiles.exe.
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_indirect_command_execution_via_forfiles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md
index f7e1be5907..89de9e7418 100644
--- a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md
+++ b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md
@@ -107,8 +107,8 @@ The following analytic detects programs that have been started by pcalua.exe. pc
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_indirect_command_execution_via_pcalua_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-07-any_powershell_downloadfile.md b/docs/_posts/2022-04-07-any_powershell_downloadfile.md
index 47abcf6072..30bbaab9f1 100644
--- a/docs/_posts/2022-04-07-any_powershell_downloadfile.md
+++ b/docs/_posts/2022-04-07-any_powershell_downloadfile.md
@@ -117,9 +117,9 @@ The following analytic identifies the use of PowerShell downloading a file using
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **any_powershell_downloadfile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-07-any_powershell_downloadstring.md b/docs/_posts/2022-04-07-any_powershell_downloadstring.md
index b104cf8b1f..c2f2d33779 100644
--- a/docs/_posts/2022-04-07-any_powershell_downloadstring.md
+++ b/docs/_posts/2022-04-07-any_powershell_downloadstring.md
@@ -112,9 +112,9 @@ The following analytic identifies the use of PowerShell downloading a file using
#### Macros
The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
> :information_source:
> **any_powershell_downloadstring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-07-detect_html_help_renamed.md b/docs/_posts/2022-04-07-detect_html_help_renamed.md
index 2c83977abd..6acb966621 100644
--- a/docs/_posts/2022-04-07-detect_html_help_renamed.md
+++ b/docs/_posts/2022-04-07-detect_html_help_renamed.md
@@ -112,8 +112,8 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_html_help_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-07-detect_mshta_renamed.md b/docs/_posts/2022-04-07-detect_mshta_renamed.md
index bd17b43c17..6c7bb3deb7 100644
--- a/docs/_posts/2022-04-07-detect_mshta_renamed.md
+++ b/docs/_posts/2022-04-07-detect_mshta_renamed.md
@@ -112,8 +112,8 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_mshta_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-07-detect_renamed_psexec.md b/docs/_posts/2022-04-07-detect_renamed_psexec.md
index e8daa0b410..db349684ac 100644
--- a/docs/_posts/2022-04-07-detect_renamed_psexec.md
+++ b/docs/_posts/2022-04-07-detect_renamed_psexec.md
@@ -107,8 +107,8 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **detect_renamed_psexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md b/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md
index 6787b99a3d..8a944454e2 100644
--- a/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md
+++ b/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md
@@ -117,8 +117,8 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_microsoft_workflow_compiler_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-07-suspicious_msbuild_rename.md b/docs/_posts/2022-04-07-suspicious_msbuild_rename.md
index 65148f9078..c2a68c2137 100644
--- a/docs/_posts/2022-04-07-suspicious_msbuild_rename.md
+++ b/docs/_posts/2022-04-07-suspicious_msbuild_rename.md
@@ -122,8 +122,8 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_msbuild_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-07-suspicious_rundll32_rename.md b/docs/_posts/2022-04-07-suspicious_rundll32_rename.md
index b4c15fbba6..27def35b42 100644
--- a/docs/_posts/2022-04-07-suspicious_rundll32_rename.md
+++ b/docs/_posts/2022-04-07-suspicious_rundll32_rename.md
@@ -122,8 +122,8 @@ The following hunting analytic identifies renamed instances of rundll32.exe exec
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **suspicious_rundll32_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md b/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md
index 886e74fc2b..12f96affcf 100644
--- a/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md
+++ b/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md
@@ -115,8 +115,8 @@ The following analytic identifies a process attempting to delete a scheduled tas
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_registry_delete_task_sd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md
index ab77e3461d..2a31c7aba7 100644
--- a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md
+++ b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md
@@ -107,9 +107,9 @@ This search looks for the execution of `nltest.exe` with command-line arguments
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_nltest](https://github.com/splunk/security_content/blob/develop/macros/process_nltest.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_nltest](https://github.com/splunk/security_content/blob/develop/macros/process_nltest.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **nltest_domain_trust_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md b/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md
index 0d89850005..c2a8c673ef 100644
--- a/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md
+++ b/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md
@@ -117,8 +117,8 @@ The following analytic identifies a suspicious cron jobs modification using cron
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_adding_crontab_using_list_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md b/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md
index 7df59fa8ee..f5f77d7472 100644
--- a/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md
+++ b/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md
@@ -108,8 +108,8 @@ The following analytic identifies a suspicious deletion of a critical folder in
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_deleting_critical_directory_using_rm_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-22-linux_disable_services.md b/docs/_posts/2022-04-22-linux_disable_services.md
index 511db970ed..d099ecf726 100644
--- a/docs/_posts/2022-04-22-linux_disable_services.md
+++ b/docs/_posts/2022-04-22-linux_disable_services.md
@@ -108,8 +108,8 @@ The following analytic is to detect events that attempts to disable a service. T
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_disable_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-22-linux_shred_overwrite_command.md b/docs/_posts/2022-04-22-linux_shred_overwrite_command.md
index c0e42b6493..f1c6a95dc1 100644
--- a/docs/_posts/2022-04-22-linux_shred_overwrite_command.md
+++ b/docs/_posts/2022-04-22-linux_shred_overwrite_command.md
@@ -108,8 +108,8 @@ This analytic is to detect a shred process to overwrite a files in a linux machi
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_shred_overwrite_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-22-linux_stop_services.md b/docs/_posts/2022-04-22-linux_stop_services.md
index 9c2404013c..f9ba9a7b71 100644
--- a/docs/_posts/2022-04-22-linux_stop_services.md
+++ b/docs/_posts/2022-04-22-linux_stop_services.md
@@ -108,8 +108,8 @@ The following analytic is to detect events that attempt to stop or clear a servi
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_stop_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md b/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md
index 7249744d4d..b10e220124 100644
--- a/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md
+++ b/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md
@@ -107,8 +107,8 @@ The following analytic is to look for known processes killed by industroyer2 mal
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **windows_processes_killed_by_industroyer2_malware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-26-powershell_fileless_script_contains_base64_encoded_content.md b/docs/_posts/2022-04-26-powershell_fileless_script_contains_base64_encoded_content.md
new file mode 100644
index 0000000000..b38862bd59
--- /dev/null
+++ b/docs/_posts/2022-04-26-powershell_fileless_script_contains_base64_encoded_content.md
@@ -0,0 +1,172 @@
+---
+title: "Powershell Fileless Script Contains Base64 Encoded Content"
+excerpt: "Command and Scripting Interpreter
+, Obfuscated Files or Information
+, PowerShell
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-04-26
+toc: true
+toc_label: ""
+tags:
+ - Command and Scripting Interpreter
+ - Obfuscated Files or Information
+ - PowerShell
+ - Execution
+ - Defense Evasion
+ - Execution
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \
+This analytic identifies `FromBase64String` within the script block. A typical malicious instance will include additional code. \
+Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String(38uqIyMjQ6rG....` \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-04-26
+- **Author**: Michael Haag, Splunk
+- **ID**: 8acbc04c-c882-11eb-b060-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+| [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText=*frombase64string*
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `powershell_fileless_script_contains_base64_encoded_content_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **powershell_fileless_script_contains_base64_encoded_content_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCodes
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+False positives should be limited. Filter as needed.
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 56.0 | 70 | 80 | A suspicious powershell script contains base64 command in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-04-26-powershell_get_localgroup_discovery_with_script_block_logging.md b/docs/_posts/2022-04-26-powershell_get_localgroup_discovery_with_script_block_logging.md
new file mode 100644
index 0000000000..c95d548153
--- /dev/null
+++ b/docs/_posts/2022-04-26-powershell_get_localgroup_discovery_with_script_block_logging.md
@@ -0,0 +1,167 @@
+---
+title: "Powershell Get LocalGroup Discovery with Script Block Logging"
+excerpt: "Permission Groups Discovery
+, Local Groups
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-04-26
+toc: true
+toc_label: ""
+tags:
+ - Permission Groups Discovery
+ - Local Groups
+ - Discovery
+ - Discovery
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \
+This analytic identifies PowerShell cmdlet - `get-localgroup` being ran. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-04-26
+- **Author**: Michael Haag, Splunk
+- **ID**: d7c6ad22-155c-11ec-bb64-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery |
+
+| [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText = "*get-localgroup*"
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `powershell_get_localgroup_discovery_with_script_block_logging_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **powershell_get_localgroup_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+False positives may be present. Tune as needed.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | Local group discovery on $dest$ by $user$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html](https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html)
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md)
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getlocalgroup.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getlocalgroup.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md b/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md
index 78de749e75..41c9d503c8 100644
--- a/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md
+++ b/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md
@@ -111,8 +111,8 @@ The following query utilizes Windows Security EventCode 4698, A scheduled task w
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **windows_hidden_schedule_task_settings_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md b/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md
index 2c0de92432..0716084d03 100644
--- a/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md
+++ b/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md
@@ -107,8 +107,8 @@ The following analytic identifes a Computer Account creating a new Computer Acco
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **windows_computer_account_created_by_computer_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md b/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md
index b5599f262c..6508556aaa 100644
--- a/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md
+++ b/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md
@@ -107,8 +107,8 @@ The following analytic identifies a ComputerAccount requesting a Kerberos Ticket
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **windows_computer_account_requesting_kerberos_ticket_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md b/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md
index 8801b6f266..3d6baf3523 100644
--- a/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md
+++ b/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md
@@ -107,8 +107,8 @@ The following analytic identifies a local successful authentication event on a W
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **windows_kerberos_local_successful_logon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-28-windows_computer_account_with_spn.md b/docs/_posts/2022-04-28-windows_computer_account_with_spn.md
index 82539a9f8d..7c459b8206 100644
--- a/docs/_posts/2022-04-28-windows_computer_account_with_spn.md
+++ b/docs/_posts/2022-04-28-windows_computer_account_with_spn.md
@@ -109,8 +109,8 @@ The following analytic identifies two SPNs, HOST and RestrictedKrbHost, added us
#### Macros
The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
> :information_source:
> **windows_computer_account_with_spn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md b/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md
index 6a402c09d2..81557141a0 100644
--- a/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md
+++ b/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md
@@ -113,8 +113,8 @@ This analytic looks for suspicious process kworker commandline in a linux machin
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_kworker_process_in_writable_process_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-02-delete_shadowcopy_with_powershell.md b/docs/_posts/2022-05-02-delete_shadowcopy_with_powershell.md
new file mode 100644
index 0000000000..f8abf6e8cb
--- /dev/null
+++ b/docs/_posts/2022-05-02-delete_shadowcopy_with_powershell.md
@@ -0,0 +1,159 @@
+---
+title: "Delete ShadowCopy With PowerShell"
+excerpt: "Inhibit System Recovery
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Inhibit System Recovery
+ - Impact
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-05-02
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 5ee2bcd0-b2ff-11eb-bb34-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText= "*ShadowCopy*" (ScriptBlockText = "*Delete*" OR ScriptBlockText = "*Remove*")
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `delete_shadowcopy_with_powershell_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **delete_shadowcopy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event.
+
+#### Known False Positives
+unknown
+
+#### Associated Analytic story
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+* [Ransomware](/stories/ransomware)
+* [Revil Ransomware](/stories/revil_ransomware)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 81.0 | 90 | 90 | An attempt to delete ShadowCopy was performed using PowerShell on $Computer$ by $User$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations](https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations)
+* [https://www.techtarget.com/searchwindowsserver/tutorial/Set-up-PowerShell-script-block-logging-for-added-security](https://www.techtarget.com/searchwindowsserver/tutorial/Set-up-PowerShell-script-block-logging-for-added-security)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-exchange_powershell_module_usage.md b/docs/_posts/2022-05-02-exchange_powershell_module_usage.md
new file mode 100644
index 0000000000..805113cb30
--- /dev/null
+++ b/docs/_posts/2022-05-02-exchange_powershell_module_usage.md
@@ -0,0 +1,167 @@
+---
+title: "Exchange PowerShell Module Usage"
+excerpt: "Command and Scripting Interpreter
+, PowerShell
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Command and Scripting Interpreter
+ - PowerShell
+ - Execution
+ - Execution
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+### :warning: WARNING THIS IS A EXPERIMENTAL analytic
+We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported.
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies the usage of Exchange PowerShell modules that were recently used for a proof of concept related to ProxyShell. Currently, there is no active data shared or data we could re-produce relate to this part of the ProxyShell chain of exploits. \
+Inherently, the usage of the modules is not malicious, but reviewing parallel processes, and user, of the session will assist with determining the intent. \
+Module - New-MailboxExportRequest will begin the process of exporting contents of a primary mailbox or archive to a .pst file. \
+Module - New-managementroleassignment can assign a management role to a management role group, management role assignment policy, user, or universal security group (USG).
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Michael Haag
+- **ID**: 2d10095e-05ae-11ec-8fdf-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*")
+| stats count min(_time) as firstTime max(_time) as lastTime by lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `exchange_powershell_module_usage_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **exchange_powershell_module_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use this PowerShell commandlet for troubleshooting.
+
+#### Associated Analytic story
+* [ProxyShell](/stories/proxyshell)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps](https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps)
+* [https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps](https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps)
+* [https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html](https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html)
+* [https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell](https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell)
+* [https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/](https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/exchange_powershell_module_usage.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-get-domaintrust_with_powershell_script_block.md b/docs/_posts/2022-05-02-get-domaintrust_with_powershell_script_block.md
new file mode 100644
index 0000000000..4900c5466a
--- /dev/null
+++ b/docs/_posts/2022-05-02-get-domaintrust_with_powershell_script_block.md
@@ -0,0 +1,161 @@
+---
+title: "Get-DomainTrust with PowerShell Script Block"
+excerpt: "Domain Trust Discovery
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Domain Trust Discovery
+ - Discovery
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \
+This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Michael Haag, Splunk
+- **ID**: 89275e7e-0548-11ec-bf75-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText = "*get-domaintrust*"
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `get_domaintrust_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **get-domaintrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+It is possible certain system management frameworks utilize this command to gather trust information.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 12.0 | 30 | 40 | Suspicious PowerShell Get-DomainTrust was identified on endpoint $Computer$ by user $UserID$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/](https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/)
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaintrust.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaintrust.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-get_aduserresultantpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2022-05-02-get_aduserresultantpasswordpolicy_with_powershell_script_block.md
new file mode 100644
index 0000000000..9372d632c1
--- /dev/null
+++ b/docs/_posts/2022-05-02-get_aduserresultantpasswordpolicy_with_powershell_script_block.md
@@ -0,0 +1,157 @@
+---
+title: "Get ADUserResultantPasswordPolicy with Powershell Script Block"
+excerpt: "Password Policy Discovery
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Password Policy Discovery
+ - Discovery
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADUserResultantPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
+- **ID**: 737e1eb0-065a-11ec-921a-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText="*Get-ADUserResultantPasswordPolicy*"
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **get_aduserresultantpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+
+#### Known False Positives
+Administrators or power users may use this command for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 9.0 | 30 | 30 | powershell process having commandline $ScriptBlockText$ to query domain user password policy. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet)
+* [https://attack.mitre.org/techniques/T1201/](https://attack.mitre.org/techniques/T1201/)
+* [https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps](https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-get_domainpolicy_with_powershell_script_block.md b/docs/_posts/2022-05-02-get_domainpolicy_with_powershell_script_block.md
new file mode 100644
index 0000000000..d466d8ea96
--- /dev/null
+++ b/docs/_posts/2022-05-02-get_domainpolicy_with_powershell_script_block.md
@@ -0,0 +1,157 @@
+---
+title: "Get DomainPolicy with Powershell Script Block"
+excerpt: "Password Policy Discovery
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Password Policy Discovery
+ - Discovery
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: a360d2b2-065a-11ec-b0bf-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText ="*Get-DomainPolicy*"
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `get_domainpolicy_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **get_domainpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+
+#### Known False Positives
+Administrators or power users may use this command for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 30.0 | 50 | 60 | powershell process having commandline $ScriptBlockText$ to query domain policy. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet)
+* [https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/)
+* [https://attack.mitre.org/techniques/T1201/](https://attack.mitre.org/techniques/T1201/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domainpolicy.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domainpolicy.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-getadcomputer_with_powershell_script_block.md b/docs/_posts/2022-05-02-getadcomputer_with_powershell_script_block.md
new file mode 100644
index 0000000000..5a645d82a1
--- /dev/null
+++ b/docs/_posts/2022-05-02-getadcomputer_with_powershell_script_block.md
@@ -0,0 +1,155 @@
+---
+title: "GetAdComputer with PowerShell Script Block"
+excerpt: "Remote System Discovery
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Remote System Discovery
+ - Discovery
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: a9a1da02-8e27-4bf7-a348-f4389c9da487
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 (ScriptBlockText = "*Get-AdComputer*")
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `getadcomputer_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **getadcomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use this PowerShell commandlet for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | Remote system discovery enumeration on $Computer$ by $UserID$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
+* [https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps](https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-getdomaincomputer_with_powershell_script_block.md b/docs/_posts/2022-05-02-getdomaincomputer_with_powershell_script_block.md
new file mode 100644
index 0000000000..3639a1b2ca
--- /dev/null
+++ b/docs/_posts/2022-05-02-getdomaincomputer_with_powershell_script_block.md
@@ -0,0 +1,155 @@
+---
+title: "GetDomainComputer with PowerShell Script Block"
+excerpt: "Remote System Discovery
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Remote System Discovery
+ - Discovery
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainComputer` commandlet. `GetDomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: f64da023-b988-4775-8d57-38e512beb56e
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainComputer*")
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `getdomaincomputer_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **getdomaincomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use PowerView for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 24.0 | 30 | 80 | Remote system discovery with PowerView on $Computer$ by $user$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
+* [https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainComputer/](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainComputer/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-getdomaincontroller_with_powershell_script_block.md b/docs/_posts/2022-05-02-getdomaincontroller_with_powershell_script_block.md
new file mode 100644
index 0000000000..00262fb378
--- /dev/null
+++ b/docs/_posts/2022-05-02-getdomaincontroller_with_powershell_script_block.md
@@ -0,0 +1,155 @@
+---
+title: "GetDomainController with PowerShell Script Block"
+excerpt: "Remote System Discovery
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Remote System Discovery
+ - Discovery
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainController` commandlet. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 676b600a-a94d-4951-b346-11329431e6c1
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainController*")
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `getdomaincontroller_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **getdomaincontroller_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use this PowerShell commandlet for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 24.0 | 30 | 80 | Remote system discovery with PowerView on $Computer$ by $UserID$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
+* [https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdc.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdc.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-getdomaingroup_with_powershell_script_block.md b/docs/_posts/2022-05-02-getdomaingroup_with_powershell_script_block.md
new file mode 100644
index 0000000000..0e67852ad6
--- /dev/null
+++ b/docs/_posts/2022-05-02-getdomaingroup_with_powershell_script_block.md
@@ -0,0 +1,160 @@
+---
+title: "GetDomainGroup with PowerShell Script Block"
+excerpt: "Permission Groups Discovery
+, Domain Groups
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Permission Groups Discovery
+ - Domain Groups
+ - Discovery
+ - Discovery
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams and adversaries may leverage this function to enumerate domain groups for situational awareness and Active Directory Discovery.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 09725404-a44f-4ed3-9efa-8ed5d69e4c53
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery |
+
+| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainGroup*")
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `getdomaingroup_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **getdomaingroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use this PowerView functions for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | Domain group discovery enumeration using PowerView on $Computer$ by $UserID$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/)
+* [https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaingroup.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaingroup.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-getwmiobject_ds_computer_with_powershell_script_block.md b/docs/_posts/2022-05-02-getwmiobject_ds_computer_with_powershell_script_block.md
new file mode 100644
index 0000000000..ccfb12eb9b
--- /dev/null
+++ b/docs/_posts/2022-05-02-getwmiobject_ds_computer_with_powershell_script_block.md
@@ -0,0 +1,155 @@
+---
+title: "GetWmiObject Ds Computer with PowerShell Script Block"
+excerpt: "Remote System Discovery
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Remote System Discovery
+ - Discovery
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_Computer` class parameter leverages WMI to query for all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 29b99201-723c-4118-847a-db2b3d3fb8ea
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace root\\directory\\ldap*" AND ScriptBlockText="*class ds_computer*")
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `getwmiobject_ds_computer_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **getwmiobject_ds_computer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use this PowerShell commandlet for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | Remote system discovery enumeration on $Computer$ by $UserID$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
+* [https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-getwmiobject_ds_group_with_powershell_script_block.md b/docs/_posts/2022-05-02-getwmiobject_ds_group_with_powershell_script_block.md
new file mode 100644
index 0000000000..49d81886a6
--- /dev/null
+++ b/docs/_posts/2022-05-02-getwmiobject_ds_group_with_powershell_script_block.md
@@ -0,0 +1,160 @@
+---
+title: "GetWmiObject Ds Group with PowerShell Script Block"
+excerpt: "Permission Groups Discovery
+, Domain Groups
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Permission Groups Discovery
+ - Domain Groups
+ - Discovery
+ - Discovery
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 67740bd3-1506-469c-b91d-effc322cc6e5
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery |
+
+| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace root\\directory\\ldap*" AND ScriptBlockText="*class ds_group*")
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `getwmiobject_ds_group_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **getwmiobject_ds_group_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use this PowerShell commandlet for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | Domain group discovery enumeration using PowerShell on $Computer$ by $UserID$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/)
+* [https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-getwmiobject_ds_user_with_powershell_script_block.md b/docs/_posts/2022-05-02-getwmiobject_ds_user_with_powershell_script_block.md
new file mode 100644
index 0000000000..09b5fbcc7e
--- /dev/null
+++ b/docs/_posts/2022-05-02-getwmiobject_ds_user_with_powershell_script_block.md
@@ -0,0 +1,161 @@
+---
+title: "GetWmiObject DS User with PowerShell Script Block"
+excerpt: "Domain Account
+, Account Discovery
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Domain Account
+ - Account Discovery
+ - Discovery
+ - Discovery
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_User` class parameter leverages WMI to query for all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain users for situational awareness and Active Directory Discovery.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
+- **ID**: fabd364e-04f3-11ec-b34b-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery |
+
+| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText = "*get-wmiobject*" ScriptBlockText = "*ds_user*" ScriptBlockText = "*-namespace*" ScriptBlockText = "*root\\directory\\ldap*"
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `getwmiobject_ds_user_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **getwmiobject_ds_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+he following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+
+#### Known False Positives
+Administrators or power users may use this command for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 25.0 | 50 | 50 | powershell process having commandline $ScriptBlockText$ for user enumeration |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://www.blackhillsinfosec.com/red-blue-purple/](https://www.blackhillsinfosec.com/red-blue-purple/)
+* [https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace](https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-getwmiobject_user_account_with_powershell_script_block.md b/docs/_posts/2022-05-02-getwmiobject_user_account_with_powershell_script_block.md
new file mode 100644
index 0000000000..87d8164f20
--- /dev/null
+++ b/docs/_posts/2022-05-02-getwmiobject_user_account_with_powershell_script_block.md
@@ -0,0 +1,165 @@
+---
+title: "GetWmiObject User Account with PowerShell Script Block"
+excerpt: "Account Discovery
+, Local Account
+, PowerShell
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Account Discovery
+ - Local Account
+ - PowerShell
+ - Discovery
+ - Discovery
+ - Execution
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters. The `Win32_UserAccount` parameter is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 640b0eda-0429-11ec-accd-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
+
+| [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 (ScriptBlockText="*Get-WmiObject*" AND ScriptBlockText="*Win32_UserAccount*")
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
+| `security_content_ctime(firstTime)`
+| `getwmiobject_user_account_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **getwmiobject_user_account_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* EventCode
+* ScriptBlockText
+* Computer
+* UserID
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use this PowerShell commandlet for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $Computer$ by $UserID$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-mailsniper_invoke_functions.md b/docs/_posts/2022-05-02-mailsniper_invoke_functions.md
new file mode 100644
index 0000000000..6a6a5d308d
--- /dev/null
+++ b/docs/_posts/2022-05-02-mailsniper_invoke_functions.md
@@ -0,0 +1,161 @@
+---
+title: "Mailsniper Invoke functions"
+excerpt: "Email Collection
+, Local Email Collection
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Email Collection
+ - Local Email Collection
+ - Collection
+ - Collection
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-05-02
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: a36972c8-b894-11eb-9f78-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection |
+
+| [T1114.001](https://attack.mitre.org/techniques/T1114/001/) | Local Email Collection | Collection |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText IN ("*Invoke-GlobalO365MailSearch*", "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*", "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*")
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `mailsniper_invoke_functions_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **mailsniper_invoke_functions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the powershell logs from your endpoints. make sure you enable needed registry to monitor this event.
+
+#### Known False Positives
+unknown
+
+#### Associated Analytic story
+* [Data Exfiltration](/stories/data_exfiltration)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 72.0 | 90 | 80 | mailsniper.ps1 functions $ScriptBlockText$ executed on a $Computer$ by user $user$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/](https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/mailsniper_invoke_functions.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-powershell_4104_hunting.md b/docs/_posts/2022-05-02-powershell_4104_hunting.md
new file mode 100644
index 0000000000..5cd3577ba1
--- /dev/null
+++ b/docs/_posts/2022-05-02-powershell_4104_hunting.md
@@ -0,0 +1,341 @@
+---
+title: "PowerShell 4104 Hunting"
+excerpt: "Command and Scripting Interpreter
+, PowerShell
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Command and Scripting Interpreter
+ - PowerShell
+ - Execution
+ - Execution
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following Hunting analytic assists with identifying suspicious PowerShell execution using Script Block Logging, or EventCode 4104. This analytic is not meant to be ran hourly, but occasionally to identify malicious or suspicious PowerShell. This analytic is a combination of work completed by Alex Teixeira and Splunk Threat Research Team.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Michael Haag, Splunk
+- **ID**: d6f2b006-0041-11ec-8885-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104
+| eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"), "4", 0)
+| eval enccom=if(match(ScriptBlockText,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}
+|[A-Za-z0-9+\/]{3}=
+|[A-Za-z0-9+\/]{2}==)") OR match(ScriptBlockText, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0)
+| eval suspcmdlet=if(match(ScriptBlockText, "(?i)Add-Exfiltration
+|Add-Persistence
+|Add-RegBackdoor
+|Add-ScrnSaveBackdoor
+|Check-VM
+|Do-Exfiltration
+|Enabled-DuplicateToken
+|Exploit-Jboss
+|Find-Fruit
+|Find-GPOLocation
+|Find-TrustedDocuments
+|Get-ApplicationHost
+|Get-ChromeDump
+|Get-ClipboardContents
+|Get-FoxDump
+|Get-GPPPassword
+|Get-IndexedItem
+|Get-Keystrokes
+|LSASecret
+|Get-PassHash
+|Get-RegAlwaysInstallElevated
+|Get-RegAutoLogon
+|Get-RickAstley
+|Get-Screenshot
+|Get-SecurityPackages
+|Get-ServiceFilePermission
+|Get-ServicePermission
+|Get-ServiceUnquoted
+|Get-SiteListPassword
+|Get-System
+|Get-TimedScreenshot
+|Get-UnattendedInstallFile
+|Get-Unconstrained
+|Get-VaultCredential
+|Get-VulnAutoRun
+|Get-VulnSchTask
+|Gupt-Backdoor
+|HTTP-Login
+|Install-SSP
+|Install-ServiceBinary
+|Invoke-ACLScanner
+|Invoke-ADSBackdoor
+|Invoke-ARPScan
+|Invoke-AllChecks
+|Invoke-BackdoorLNK
+|Invoke-BypassUAC
+|Invoke-CredentialInjection
+|Invoke-DCSync
+|Invoke-DllInjection
+|Invoke-DowngradeAccount
+|Invoke-EgressCheck
+|Invoke-Inveigh
+|Invoke-InveighRelay
+|Invoke-Mimikittenz
+|Invoke-NetRipper
+|Invoke-NinjaCopy
+|Invoke-PSInject
+|Invoke-Paranoia
+|Invoke-PortScan
+|Invoke-PoshRat
+|Invoke-PostExfil
+|Invoke-PowerDump
+|Invoke-PowerShellTCP
+|Invoke-PsExec
+|Invoke-PsUaCme
+|Invoke-ReflectivePEInjection
+|Invoke-ReverseDNSLookup
+|Invoke-RunAs
+|Invoke-SMBScanner
+|Invoke-SSHCommand
+|Invoke-Service
+|Invoke-Shellcode
+|Invoke-Tater
+|Invoke-ThunderStruck
+|Invoke-Token
+|Invoke-UserHunter
+|Invoke-VoiceTroll
+|Invoke-WScriptBypassUAC
+|Invoke-WinEnum
+|MailRaider
+|New-HoneyHash
+|Out-Minidump
+|Port-Scan
+|PowerBreach
+|PowerUp
+|PowerView
+|Remove-Update
+|Set-MacAttribute
+|Set-Wallpaper
+|Show-TargetScreen
+|Start-CaptureServer
+|VolumeShadowCopyTools
+|NEEEEWWW
+|(Computer
+|User)Property
+|CachedRDPConnection
+|get-net\S+
+|invoke-\S+hunter
+|Install-Service
+|get-\S+(credent
+|password)
+|remoteps
+|Kerberos.*(policy
+|ticket)
+|netfirewall
+|Uninstall-Windows
+|Verb\s+Runas
+|AmsiBypass
+|nishang
+|Invoke-Interceptor
+|EXEonRemote
+|NetworkRelay
+|PowerShelludp
+|PowerShellIcmp
+|CreateShortcut
+|copy-vss
+|invoke-dll
+|invoke-mass
+|out-shortcut
+|Invoke-ShellCommand"),1,0)
+| eval base64 = if(match(lower(ScriptBlockText),"frombase64"), "4", 0)
+| eval empire=if(match(lower(ScriptBlockText),"system.net.webclient") AND match(lower(ScriptBlockText), "frombase64string") ,5,0)
+| eval mimikatz=if(match(lower(ScriptBlockText),"mimikatz") OR match(lower(ScriptBlockText), "-dumpcr") OR match(lower(ScriptBlockText), "SEKURLSA::Pth") OR match(lower(ScriptBlockText), "kerberos::ptt") OR match(lower(ScriptBlockText), "kerberos::golden") ,5,0)
+| eval iex = if(match(lower(ScriptBlockText),"iex"), "2", 0)
+| eval webclient=if(match(lower(ScriptBlockText),"http") OR match(lower(ScriptBlockText),"web(client
+|request)") OR match(lower(ScriptBlockText),"socket") OR match(lower(ScriptBlockText),"download(file
+|string)") OR match(lower(ScriptBlockText),"bitstransfer") OR match(lower(ScriptBlockText),"internetexplorer.application") OR match(lower(ScriptBlockText),"xmlhttp"),5,0)
+| eval get = if(match(lower(ScriptBlockText),"get-"), "1", 0)
+| eval rundll32 = if(match(lower(ScriptBlockText),"rundll32"), "4", 0)
+| eval suspkeywrd=if(match(ScriptBlockText, "(?i)(bitstransfer
+|mimik
+|metasp
+|AssemblyBuilderAccess
+|Reflection\.Assembly
+|shellcode
+|injection
+|cnvert
+|shell\.application
+|start-process
+|Rc4ByteStream
+|System\.Security\.Cryptography
+|lsass\.exe
+|localadmin
+|LastLoggedOn
+|hijack
+|BackupPrivilege
+|ngrok
+|comsvcs
+|backdoor
+|brute.?force
+|Port.?Scan
+|Exfiltration
+|exploit
+|DisableRealtimeMonitoring
+|beacon)"),1,0)
+| eval syswow64 = if(match(lower(ScriptBlockText),"syswow64"), "3", 0)
+| eval httplocal = if(match(lower(ScriptBlockText),"http://127.0.0.1"), "4", 0)
+| eval reflection = if(match(lower(ScriptBlockText),"reflection"), "1", 0)
+| eval invokewmi=if(match(lower(ScriptBlockText), "(?i)(wmiobject
+|WMIMethod
+|RemoteWMI
+|PowerShellWmi
+|wmicommand)"),5,0)
+| eval downgrade=if(match(ScriptBlockText, "(?i)([-]ve*r*s*i*o*n*\s+2)") OR match(lower(ScriptBlockText),"powershell -version"),3,0)
+| eval compressed=if(match(ScriptBlockText, "(?i)GZipStream
+|::Decompress
+|IO.Compression
+|write-zip
+|(expand
+|compress)-Archive"),5,0)
+| eval invokecmd = if(match(lower(ScriptBlockText),"invoke-command"), "4", 0)
+| addtotals fieldname=Score DoIt, enccom, suspcmdlet, suspkeywrd, compressed, downgrade, mimikatz, iex, empire, rundll32, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get
+| stats values(Score) by DoIt, enccom, compressed, downgrade, iex, mimikatz, rundll32, empire, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get, suspcmdlet, suspkeywrd
+| `powershell_4104_hunting_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+
+> :information_source:
+> **powershell_4104_hunting_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+
+#### Known False Positives
+Limited false positives. May filter as needed.
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $Computer$ by user $user$ executing suspicious commands. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md](https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md)
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell)
+* [https://github.com/marcurdy/dfir-toolset/blob/master/Powershell%20Blueteam.txt](https://github.com/marcurdy/dfir-toolset/blob/master/Powershell%20Blueteam.txt)
+* [https://devblogs.microsoft.com/powershell/powershell-the-blue-team/](https://devblogs.microsoft.com/powershell/powershell-the-blue-team/)
+* [https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1)
+* [https://www.mandiant.com/resources/greater-visibilityt](https://www.mandiant.com/resources/greater-visibilityt)
+* [https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/](https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_4104_hunting.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-powershell_creating_thread_mutex.md b/docs/_posts/2022-05-02-powershell_creating_thread_mutex.md
new file mode 100644
index 0000000000..814d838666
--- /dev/null
+++ b/docs/_posts/2022-05-02-powershell_creating_thread_mutex.md
@@ -0,0 +1,168 @@
+---
+title: "Powershell Creating Thread Mutex"
+excerpt: "Obfuscated Files or Information
+, Indicator Removal from Tools
+, PowerShell
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Obfuscated Files or Information
+ - Indicator Removal from Tools
+ - PowerShell
+ - Defense Evasion
+ - Defense Evasion
+ - Execution
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using the `mutex` function. This function is commonly seen in some obfuscated PowerShell scripts to make sure that only one instance of there process is running on a compromise machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 637557ec-ca08-11eb-bd0a-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion |
+
+| [T1027.005](https://attack.mitre.org/techniques/T1027/005/) | Indicator Removal from Tools | Defense Evasion |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText = "*Threading.Mutex*"
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `powershell_creating_thread_mutex_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **powershell_creating_thread_mutex_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* EventCode
+* ScriptBlockText
+* Computer
+* UserID
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+powershell developer may used this function in their script for instance checking too.
+
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 40.0 | 50 | 80 | A suspicious powershell script contains Thread Mutex in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/](https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/)
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_creating_thread_mutex.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-powershell_loading_dotnet_into_memory_via_reflection.md b/docs/_posts/2022-05-02-powershell_loading_dotnet_into_memory_via_reflection.md
new file mode 100644
index 0000000000..2f73515400
--- /dev/null
+++ b/docs/_posts/2022-05-02-powershell_loading_dotnet_into_memory_via_reflection.md
@@ -0,0 +1,167 @@
+---
+title: "PowerShell Loading DotNET into Memory via Reflection"
+excerpt: "Command and Scripting Interpreter
+, PowerShell
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Command and Scripting Interpreter
+ - PowerShell
+ - Execution
+ - Execution
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+This analytic identifies the use of PowerShell loading .net assembly via reflection. This is commonly found in malicious PowerShell usage, including Empire and Cobalt Strike. In addition, the `load(` value may be modifed by removing `(` and it will identify more events to review. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Michael Haag, Splunk
+- **ID**: 85bc3f30-ca28-11eb-bd21-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*", "*reflection.assembly*")
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `powershell_loading_dotnet_into_memory_via_reflection_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **powershell_loading_dotnet_into_memory_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+False positives should be limited as day to day scripts do not use this method.
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 56.0 | 70 | 80 | A suspicious powershell script contains reflective class assembly command in $ScriptBlockText$ to load .net code in memory with EventCode $EventCode$ in host $Computer$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0](https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0)
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-powershell_remove_windows_defender_directory.md b/docs/_posts/2022-05-02-powershell_remove_windows_defender_directory.md
new file mode 100644
index 0000000000..a53b226b49
--- /dev/null
+++ b/docs/_posts/2022-05-02-powershell_remove_windows_defender_directory.md
@@ -0,0 +1,167 @@
+---
+title: "Powershell Remove Windows Defender Directory"
+excerpt: "Disable or Modify Tools
+, Impair Defenses
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Disable or Modify Tools
+ - Impair Defenses
+ - Defense Evasion
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This analytic will identify a suspicious PowerShell command used to delete the Windows Defender folder. This technique was seen used by the WhisperGate malware campaign where it used Nirsofts advancedrun.exe to gain administrative privileges to then execute a PowerShell command to delete the Windows Defender folder. This is a good indicator the offending process is trying corrupt a Windows Defender installation.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-05-02
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: adf47620-79fa-11ec-b248-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
+
+| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText = "*rmdir *" AND ScriptBlockText = "*\\Microsoft\\Windows Defender*"
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `powershell_remove_windows_defender_directory_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **powershell_remove_windows_defender_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+unknown
+
+#### Associated Analytic story
+* [WhisperGate](/stories/whispergate)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 90.0 | 100 | 90 | suspicious powershell script $ScriptBlockText$ was executed on the $Computer$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/](https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-wmi_recon_running_process_or_services.md b/docs/_posts/2022-05-02-wmi_recon_running_process_or_services.md
new file mode 100644
index 0000000000..207622e563
--- /dev/null
+++ b/docs/_posts/2022-05-02-wmi_recon_running_process_or_services.md
@@ -0,0 +1,159 @@
+---
+title: "WMI Recon Running Process Or Services"
+excerpt: "Gather Victim Host Information
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+ - Gather Victim Host Information
+ - Reconnaissance
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found in malware and APT events where the adversary will map all running security applications or services on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: b5cd5526-cce7-11eb-b3bd-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText= "*SELECT*" AND (ScriptBlockText="*Win32_Process*" OR ScriptBlockText="*Win32_Service*")
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `wmi_recon_running_process_or_services_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **wmi_recon_running_process_or_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+network administrator may used this command for checking purposes
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 30.0 | 30 | 100 | Suspicious powerShell script execution by $user$ on $Computer$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/](https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/)
+* [https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/](https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/)
+* [https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/WMI-events.md](https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/WMI-events.md)
+* [https://in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/](https://in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/wmi_recon_running_process_or_services.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-03-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md b/docs/_posts/2022-05-03-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md
new file mode 100644
index 0000000000..f483a96387
--- /dev/null
+++ b/docs/_posts/2022-05-03-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md
@@ -0,0 +1,161 @@
+---
+title: "Disabled Kerberos Pre-Authentication Discovery With Get-ADUser"
+excerpt: "Steal or Forge Kerberos Tickets
+, AS-REP Roasting
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-03
+toc: true
+toc_label: ""
+tags:
+ - Steal or Forge Kerberos Tickets
+ - AS-REP Roasting
+ - Credential Access
+ - Credential Access
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADUser` commandlet with specific parameters. `Get-ADUser` is part of the Active Directory PowerShell module used to manage Windows Active Directory networks. As the name suggests, `Get-ADUser` is used to query for domain users. With the appropiate parameters, Get-ADUser allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-03
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 114c6bfe-9406-11ec-bcce-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1558](https://attack.mitre.org/techniques/T1558/) | Steal or Forge Kerberos Tickets | Credential Access |
+
+| [T1558.004](https://attack.mitre.org/techniques/T1558/004/) | AS-REP Roasting | Credential Access |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+ `powershell` EventCode=4104 (ScriptBlockText = "*Get-ADUser*" AND ScriptBlockText="*4194304*")
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **disabled_kerberos_pre-authentication_discovery_with_get-aduser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use search for accounts with Kerberos Pre Authentication disabled for legitimate purposes.
+
+#### Associated Analytic story
+* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 54.0 | 60 | 90 | Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1558/004/](https://attack.mitre.org/techniques/T1558/004/)
+* [https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html](https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html)
+* [https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/](https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-03-disabled_kerberos_pre-authentication_discovery_with_powerview.md b/docs/_posts/2022-05-03-disabled_kerberos_pre-authentication_discovery_with_powerview.md
new file mode 100644
index 0000000000..e00de9eaed
--- /dev/null
+++ b/docs/_posts/2022-05-03-disabled_kerberos_pre-authentication_discovery_with_powerview.md
@@ -0,0 +1,161 @@
+---
+title: "Disabled Kerberos Pre-Authentication Discovery With PowerView"
+excerpt: "Steal or Forge Kerberos Tickets
+, AS-REP Roasting
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-05-03
+toc: true
+toc_label: ""
+tags:
+ - Steal or Forge Kerberos Tickets
+ - AS-REP Roasting
+ - Credential Access
+ - Credential Access
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet with specific parameters. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows Active Directory networks. As the name suggests, `Get-DomainUser` is used to identify domain users and combining it with `-PreauthNotRequired` allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-03
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: b0b34e2c-90de-11ec-baeb-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1558](https://attack.mitre.org/techniques/T1558/) | Steal or Forge Kerberos Tickets | Credential Access |
+
+| [T1558.004](https://attack.mitre.org/techniques/T1558/004/) | AS-REP Roasting | Credential Access |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+ `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainUser*" AND ScriptBlockText="*PreauthNotRequired*")
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)`
+| `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **disabled_kerberos_pre-authentication_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use PowerView for troubleshooting
+
+#### Associated Analytic story
+* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 54.0 | 60 | 90 | Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1558/004/](https://attack.mitre.org/techniques/T1558/004/)
+* [https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html](https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html)
+* [https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/](https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md b/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md
index f52fd0bab9..7127c9061b 100644
--- a/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md
+++ b/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md
@@ -120,8 +120,8 @@ The following analytic identifes a new kernel driver being added to Windows usin
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_service_create_kernel_mode_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md b/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md
index 0b8b7e8e93..2f657018cd 100644
--- a/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md
+++ b/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md
@@ -108,8 +108,8 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **cobalt_strike_named_pipes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-16-windows_system_file_on_disk.md b/docs/_posts/2022-05-16-windows_system_file_on_disk.md
index 10dde422ad..a4469a0c63 100644
--- a/docs/_posts/2022-05-16-windows_system_file_on_disk.md
+++ b/docs/_posts/2022-05-16-windows_system_file_on_disk.md
@@ -108,8 +108,8 @@ The following hunting analytic will assist with identifying new .sys files intro
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_system_file_on_disk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md b/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md
index 861526d197..a393a209b4 100644
--- a/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md
+++ b/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md
@@ -121,8 +121,8 @@ This search looks for AWS CloudTrail events where a user created a policy versio
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_create_policy_version_to_allow_all_resources_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md b/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md
index e14e37df10..faa65f5472 100644
--- a/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md
+++ b/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md
@@ -115,8 +115,8 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **schtasks_scheduling_job_on_remote_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md b/docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md
index ce1a1bab2a..c0228632f6 100644
--- a/docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md
+++ b/docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md
@@ -124,8 +124,8 @@ The Splunk platform contains built-in search processing language (SPL) safeguard
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **splunk_command_and_scripting_interpreter_risky_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-26-linux_at_application_execution.md b/docs/_posts/2022-05-26-linux_at_application_execution.md
index d4d3ae7e0d..6ab7c3618b 100644
--- a/docs/_posts/2022-05-26-linux_at_application_execution.md
+++ b/docs/_posts/2022-05-26-linux_at_application_execution.md
@@ -117,8 +117,8 @@ The following analytic identifies a suspicious process creation of At applicatio
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_at_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md b/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md
index 225f6cd674..460b2cc15f 100644
--- a/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md
+++ b/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md
@@ -117,8 +117,8 @@ This analytic looks for suspicious commandline that may use to append user entry
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_possible_append_command_to_at_allow_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md b/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md
index 2257853953..d75ccf9983 100644
--- a/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md
+++ b/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md
@@ -114,8 +114,8 @@ The following analytic identifies the use of the risky command - Delete - that m
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **splunk_command_and_scripting_interpreter_delete_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-30-windows_office_product_spawning_msdt.md b/docs/_posts/2022-05-30-windows_office_product_spawning_msdt.md
index 478360f8bf..d88c00db39 100644
--- a/docs/_posts/2022-05-30-windows_office_product_spawning_msdt.md
+++ b/docs/_posts/2022-05-30-windows_office_product_spawning_msdt.md
@@ -118,8 +118,8 @@ The following analytic identifies a Microsoft Office product spawning the Window
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_office_product_spawning_msdt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md b/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md
index 174eac3cf3..b18ce4fe3e 100644
--- a/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md
+++ b/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md
@@ -112,8 +112,8 @@ The following detection identifies the module load of mshtml.dll into an Office
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **mshtml_module_load_in_office_product_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md b/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md
index a841bd35e8..d62428fbc2 100644
--- a/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md
+++ b/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md
@@ -112,8 +112,8 @@ This analytic identifies a process making a DNS query to Discord, a well known i
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **suspicious_process_with_discord_dns_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-01-unload_sysmon_filter_driver.md b/docs/_posts/2022-06-01-unload_sysmon_filter_driver.md
index d9e39f36c3..4678bd2d68 100644
--- a/docs/_posts/2022-06-01-unload_sysmon_filter_driver.md
+++ b/docs/_posts/2022-06-01-unload_sysmon_filter_driver.md
@@ -112,8 +112,8 @@ Attackers often disable security tools to avoid detection. This search looks for
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **unload_sysmon_filter_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md
index 2a5120831a..e4ce581afd 100644
--- a/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md
+++ b/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md
@@ -106,8 +106,8 @@ this search is designed to detect suspicious wermgr.exe process that tries to co
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **wermgr_process_connecting_to_ip_check_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_hunting_path_traversal.md b/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_hunting_path_traversal.md
index 5cf67ffda2..45e5636f24 100644
--- a/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_hunting_path_traversal.md
+++ b/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_hunting_path_traversal.md
@@ -113,8 +113,8 @@ The following analytic identifies path traversal command-line execution and shou
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_command_and_scripting_interpreter_hunting_path_traversal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_path_traversal_exec.md b/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_path_traversal_exec.md
index 2fc3ac0770..7d1376be5b 100644
--- a/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_path_traversal_exec.md
+++ b/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_path_traversal_exec.md
@@ -108,8 +108,8 @@ The following analytic identifies path traversal command-line execution. This te
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_command_and_scripting_interpreter_path_traversal_exec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-01-windows_installutil_credential_theft.md b/docs/_posts/2022-06-01-windows_installutil_credential_theft.md
index 08612d4668..41f5193809 100644
--- a/docs/_posts/2022-06-01-windows_installutil_credential_theft.md
+++ b/docs/_posts/2022-06-01-windows_installutil_credential_theft.md
@@ -110,8 +110,8 @@ During triage review resulting network connections, file modifications, and para
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **windows_installutil_credential_theft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md b/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md
index 1b2f7f7471..dfadb5ea68 100644
--- a/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md
+++ b/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md
@@ -106,8 +106,8 @@ This search is to detect potential DNS exfiltration using nslookup application.
#### Macros
The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
> :information_source:
> **excessive_usage_of_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-03-java_writing_jsp_file.md b/docs/_posts/2022-06-03-java_writing_jsp_file.md
index d3e2e2bd8d..2179360efe 100644
--- a/docs/_posts/2022-06-03-java_writing_jsp_file.md
+++ b/docs/_posts/2022-06-03-java_writing_jsp_file.md
@@ -118,8 +118,8 @@ The following analytic identifies the process java writing a .jsp to disk. This
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **java_writing_jsp_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-03-linux_iptables_firewall_modification.md b/docs/_posts/2022-06-03-linux_iptables_firewall_modification.md
index c8c2e104f4..8712816018 100644
--- a/docs/_posts/2022-06-03-linux_iptables_firewall_modification.md
+++ b/docs/_posts/2022-06-03-linux_iptables_firewall_modification.md
@@ -121,8 +121,8 @@ This analytic looks for suspicious commandline that modify the iptables firewall
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **linux_iptables_firewall_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_context_menu.md b/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_context_menu.md
index 62bf07e929..055066a576 100644
--- a/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_context_menu.md
+++ b/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_context_menu.md
@@ -112,8 +112,8 @@ The search looks for the deletion of Windows Defender context menu within the re
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_impair_defense_delete_win_defender_context_menu_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_profile_registry.md b/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_profile_registry.md
index 2ee02c8b43..13f5c42b38 100644
--- a/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_profile_registry.md
+++ b/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_profile_registry.md
@@ -112,8 +112,8 @@ The search looks for the deletion of Windows Defender main profile within the re
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_impair_defense_delete_win_defender_profile_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-07-windows_impair_defenses_disable_win_defender_auto_logging.md b/docs/_posts/2022-06-07-windows_impair_defenses_disable_win_defender_auto_logging.md
index d1dc25d726..1dc2c0cb10 100644
--- a/docs/_posts/2022-06-07-windows_impair_defenses_disable_win_defender_auto_logging.md
+++ b/docs/_posts/2022-06-07-windows_impair_defenses_disable_win_defender_auto_logging.md
@@ -112,8 +112,8 @@ The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger s
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_impair_defenses_disable_win_defender_auto_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-13-windows_msiexec_spawn_discovery_command.md b/docs/_posts/2022-06-13-windows_msiexec_spawn_discovery_command.md
index bf1f48f10d..13556e097f 100644
--- a/docs/_posts/2022-06-13-windows_msiexec_spawn_discovery_command.md
+++ b/docs/_posts/2022-06-13-windows_msiexec_spawn_discovery_command.md
@@ -108,8 +108,8 @@ The following analytic identifies MSIExec spawning multiple discovery commands,
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_msiexec_spawn_discovery_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-14-windows_msiexec_dllregisterserver.md b/docs/_posts/2022-06-14-windows_msiexec_dllregisterserver.md
index dbe69e5b23..3ad5ce4a1d 100644
--- a/docs/_posts/2022-06-14-windows_msiexec_dllregisterserver.md
+++ b/docs/_posts/2022-06-14-windows_msiexec_dllregisterserver.md
@@ -108,9 +108,9 @@ The following analytic identifies the usage of msiexec.exe using the /y switch p
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_msiexec](https://github.com/splunk/security_content/blob/develop/macros/process_msiexec.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_msiexec_dllregisterserver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-14-windows_msiexec_unregister_dllregisterserver.md b/docs/_posts/2022-06-14-windows_msiexec_unregister_dllregisterserver.md
index e326fbba0b..cbeb3d8cca 100644
--- a/docs/_posts/2022-06-14-windows_msiexec_unregister_dllregisterserver.md
+++ b/docs/_posts/2022-06-14-windows_msiexec_unregister_dllregisterserver.md
@@ -108,9 +108,9 @@ The following analytic identifies the usage of msiexec.exe using the /z switch p
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_msiexec](https://github.com/splunk/security_content/blob/develop/macros/process_msiexec.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_msiexec_unregister_dllregisterserver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-16-detect_risky_spl_using_pretrained_ml_model.md b/docs/_posts/2022-06-16-detect_risky_spl_using_pretrained_ml_model.md
new file mode 100644
index 0000000000..6bc96fbb5e
--- /dev/null
+++ b/docs/_posts/2022-06-16-detect_risky_spl_using_pretrained_ml_model.md
@@ -0,0 +1,167 @@
+---
+title: "Detect Risky SPL using Pretrained ML Model"
+excerpt: "Command and Scripting Interpreter
+"
+categories:
+ - Application
+last_modified_at: 2022-06-16
+toc: true
+toc_label: ""
+tags:
+ - Command and Scripting Interpreter
+ - Execution
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - CVE-2022-32154
+ - Splunk_Audit
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic uses a pretrained machine learning text classifier to detect potentially risky commands. The model is trained independently and then the model file is packaged within ESCU for usage. A command is deemed risky based on the presence of certain trigger keywords, along with the context and the role of the user (please see references). The model uses custom features to predict whether a SPL is risky using text classification. The model takes as input the command text, user and search type and outputs a risk score between [0,1]. A high score indicates higher likelihood of a command being risky. This model is on-prem only.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Splunk_Audit](https://docs.splunk.com/Documentation/CIM/latest/User/SplunkAudit)
+- **Last Updated**: 2022-06-16
+- **Author**: Abhinav Mishra, Kumar Sharad, Namratha Sreekanta and Xiao Lin, Splunk
+- **ID**: b4aefb5f-1037-410d-a149-1e091288ba33
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Actions on Objectives
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.AE
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 6
+
+
+
+
+
+
+
+ CVE
+
+
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2022-32154](https://nvd.nist.gov/vuln/detail/CVE-2022-32154) | Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and potentially risky commands (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands) for more information. Note that the attack is browser-based and an attacker cannot exploit it at will. | 4.0 |
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.user Search_Activity.search_type
+| eval spl_text = 'Search_Activity.search'. " " .'Search_Activity.user'. " " .'Search_Activity.search_type'
+| dedup spl_text
+| apply risky_spl_pre_trained_model
+| where risk_score > 0.5
+| `drop_dm_object_name(Search_Activity)`
+| table search, user, search_type, risk_score
+| `detect_risky_spl_using_pretrained_ml_model_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **detect_risky_spl_using_pretrained_ml_model_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Search_Activity.search
+* Search_Activity.user
+* Search_Activity.search_type
+
+
+#### How To Implement
+This detection depends on the MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need to be ingesting logs which include Search_Activity.search, Search_Activity.user, Search_Activity.search_type from your endpoints. The risk score threshold should be adjusted based on the environment. The detection uses a custom MLTK model hence we need a few more steps for deployment, as outlined here - https://gist.github.com/ksharad-splunk/be2a62227966049047f5e5c4f2adcabb.
+
+#### Known False Positives
+False positives may be present if suspicious behavior is observed, as determined by frequent usage of risky keywords.
+
+#### Associated Analytic story
+* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 20.0 | 50 | 40 | A potentially risky Splunk command has been run by $user$, kindly review. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning](https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt](https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/detect_risky_spl_using_pretrained_ml_model.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-16-windows_msiexec_remote_download.md b/docs/_posts/2022-06-16-windows_msiexec_remote_download.md
index 9eb65b46da..42ead5cf1b 100644
--- a/docs/_posts/2022-06-16-windows_msiexec_remote_download.md
+++ b/docs/_posts/2022-06-16-windows_msiexec_remote_download.md
@@ -108,9 +108,9 @@ The following analytic identifies msiexec.exe with http in the command-line. Thi
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_msiexec](https://github.com/splunk/security_content/blob/develop/macros/process_msiexec.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_msiexec_remote_download_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-16-windows_msiexec_with_network_connections.md b/docs/_posts/2022-06-16-windows_msiexec_with_network_connections.md
index 564457c1da..d0b36e3649 100644
--- a/docs/_posts/2022-06-16-windows_msiexec_with_network_connections.md
+++ b/docs/_posts/2022-06-16-windows_msiexec_with_network_connections.md
@@ -112,9 +112,9 @@ The following analytic identifies MSIExec with any network connection over port
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_msiexec](https://github.com/splunk/security_content/blob/develop/macros/process_msiexec.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **windows_msiexec_with_network_connections_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-21-aws_ecr_container_scanning_findings_high.md b/docs/_posts/2022-06-21-aws_ecr_container_scanning_findings_high.md
index 0fff8fa536..68334536f8 100644
--- a/docs/_posts/2022-06-21-aws_ecr_container_scanning_findings_high.md
+++ b/docs/_posts/2022-06-21-aws_ecr_container_scanning_findings_high.md
@@ -119,8 +119,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
#### Macros
The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
> :information_source:
> **aws_ecr_container_scanning_findings_high_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-21-windows_gather_victim_network_info_through_ip_check_web_services.md b/docs/_posts/2022-06-21-windows_gather_victim_network_info_through_ip_check_web_services.md
new file mode 100644
index 0000000000..44652880cc
--- /dev/null
+++ b/docs/_posts/2022-06-21-windows_gather_victim_network_info_through_ip_check_web_services.md
@@ -0,0 +1,169 @@
+---
+title: "Windows Gather Victim Network Info Through Ip Check Web Services"
+excerpt: "IP Addresses
+, Gather Victim Network Information
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-21
+toc: true
+toc_label: ""
+tags:
+ - IP Addresses
+ - Gather Victim Network Information
+ - Reconnaissance
+ - Reconnaissance
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies process that attempts to connect to a known IP web services. This technique is commonly used by trickbot and other malware to perform reconnaissance against the infected machine and look for its IP address.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-21
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 70f7c952-0758-46d6-9148-d8969c4481d1
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1590.005](https://attack.mitre.org/techniques/T1590/005/) | IP Addresses | Reconnaissance |
+
+| [T1590](https://attack.mitre.org/techniques/T1590/) | Gather Victim Network Information | Reconnaissance |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`sysmon` EventCode=22 QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org", "*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net", "*iplogger.org*", "*ip-api.com*")
+| stats min(_time) as firstTime max(_time) as lastTime count by Image ProcessId QueryName QueryStatus QueryResults Computer EventCode
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_gather_victim_network_info_through_ip_check_web_services_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+
+> :information_source:
+> **windows_gather_victim_network_info_through_ip_check_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Image
+* ProcessId
+* QueryName
+* QueryStatus
+* QueryResults
+* Computer
+* EventCode
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA.
+
+#### Known False Positives
+Filter internet browser application to minimize the false positive of this detection.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 25.0 | 50 | 50 | process connecting IP location web services on $Computer$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-21-windows_remote_services_allow_rdp_in_firewall.md b/docs/_posts/2022-06-21-windows_remote_services_allow_rdp_in_firewall.md
new file mode 100644
index 0000000000..9f289eb00b
--- /dev/null
+++ b/docs/_posts/2022-06-21-windows_remote_services_allow_rdp_in_firewall.md
@@ -0,0 +1,171 @@
+---
+title: "Windows Remote Services Allow Rdp In Firewall"
+excerpt: "Remote Desktop Protocol
+, Remote Services
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-21
+toc: true
+toc_label: ""
+tags:
+ - Remote Desktop Protocol
+ - Remote Services
+ - Lateral Movement
+ - Lateral Movement
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is to identify a modification in the Windows firewall to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer to remotely access the compromised or targeted host by allowing this protocol in firewall. Even this protocol might be allowed in some production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through firewall which is also common traits of attack to start lateral movement.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-21
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 9170cb54-ea15-41e1-9dfc-9f3363ce9b02
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement |
+
+| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "netsh.exe" OR Processes.original_file_name= "netsh.exe") AND Processes.process = "*firewall*" AND Processes.process = "*add*" AND Processes.process = "*protocol=TCP*" AND Processes.process = "*localport=3389*" AND Processes.process = "*action=allow*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_remote_services_allow_rdp_in_firewall_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_remote_services_allow_rdp_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.process_name
+* Processes.process
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.process_id
+* Processes.parent_process_id
+* Processes.dest
+* Processes.user
+
+
+#### How To Implement
+To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+#### Known False Positives
+administrators may enable or disable this feature that may cause some false positive.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | new firewall rules was added to allow rdp connection to $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-21-windows_remote_services_allow_remote_assistance.md b/docs/_posts/2022-06-21-windows_remote_services_allow_remote_assistance.md
new file mode 100644
index 0000000000..1467125892
--- /dev/null
+++ b/docs/_posts/2022-06-21-windows_remote_services_allow_remote_assistance.md
@@ -0,0 +1,170 @@
+---
+title: "Windows Remote Services Allow Remote Assistance"
+excerpt: "Remote Desktop Protocol
+, Remote Services
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-21
+toc: true
+toc_label: ""
+tags:
+ - Remote Desktop Protocol
+ - Remote Services
+ - Lateral Movement
+ - Lateral Movement
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is to identify a modification in the Windows registry to enable remote desktop assistance on a targeted machine. This technique was seen in several adversaries, malware or red teamer like azorult to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This Anomaly behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common. And as per stated in microsoft documentation the default value of this registry is false that makes this a good indicator of suspicious behavior.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-21
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 9bce3a97-bc97-4e89-a1aa-ead151c82fbb
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement |
+
+| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal Server\\fAllowToGetHelp*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
+| `drop_dm_object_name(Registry)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_remote_services_allow_remote_assistance_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_remote_services_allow_remote_assistance_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+administrators may enable or disable this feature that may cause some false positive.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | the registry for rdp protocol was modified to enable in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp](https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp)
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_remote_services_allow_remote_assistance.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-21-windows_remote_services_rdp_enable.md b/docs/_posts/2022-06-21-windows_remote_services_rdp_enable.md
new file mode 100644
index 0000000000..ffd7f8fac5
--- /dev/null
+++ b/docs/_posts/2022-06-21-windows_remote_services_rdp_enable.md
@@ -0,0 +1,169 @@
+---
+title: "Windows Remote Services Rdp Enable"
+excerpt: "Remote Desktop Protocol
+, Remote Services
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-21
+toc: true
+toc_label: ""
+tags:
+ - Remote Desktop Protocol
+ - Remote Services
+ - Lateral Movement
+ - Lateral Movement
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is to identify a modification in the Windows registry to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-21
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 8fbd2e88-4ea5-40b9-9217-fd0855e08cc0
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement |
+
+| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
+| `drop_dm_object_name(Registry)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_remote_services_rdp_enable_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_remote_services_rdp_enable_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+administrators may enable or disable this feature that may cause some false positive.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | the registry for rdp protocol was modified to enable in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://www.hybrid-analysis.com/sample/9d6611c2779316f1ef4b4a6edcfdfb5e770fe32b31ec2200df268c3bd236ed75?environmentId=100](https://www.hybrid-analysis.com/sample/9d6611c2779316f1ef4b4a6edcfdfb5e770fe32b31ec2200df268c3bd236ed75?environmentId=100)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_remote_services_rdp_enable.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-21-windows_service_stop_by_deletion.md b/docs/_posts/2022-06-21-windows_service_stop_by_deletion.md
new file mode 100644
index 0000000000..fe4e2a8944
--- /dev/null
+++ b/docs/_posts/2022-06-21-windows_service_stop_by_deletion.md
@@ -0,0 +1,168 @@
+---
+title: "Windows Service Stop By Deletion"
+excerpt: "Service Stop
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-21
+toc: true
+toc_label: ""
+tags:
+ - Service Stop
+ - Impact
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue there objective and evade detections.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-21
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 196ff536-58d9-4d1b-9686-b176b04e430b
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = sc.exe OR Processes.original_file_name = sc.exe) Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_service_stop_by_deletion_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_service_stop_by_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.process_name
+* Processes.process
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.process_id
+* Processes.parent_process_id
+* Processes.dest
+* Processes.user
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+#### Known False Positives
+It is possible administrative scripts may start/stop/delete services. Filter as needed.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to delete a service. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_service_stop_by_deletion.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-22-windows_modify_registry_disable_toast_notifications.md b/docs/_posts/2022-06-22-windows_modify_registry_disable_toast_notifications.md
new file mode 100644
index 0000000000..d49d990792
--- /dev/null
+++ b/docs/_posts/2022-06-22-windows_modify_registry_disable_toast_notifications.md
@@ -0,0 +1,165 @@
+---
+title: "Windows Modify Registry Disable Toast Notifications"
+excerpt: "Modify Registry
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-22
+toc: true
+toc_label: ""
+tags:
+ - Modify Registry
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is to identify a modification in the Windows registry to disable toast notifications. This Windows Operating System feature is responsible for alerting or notifying user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion and execution.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-22
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: ed4eeacb-8d5a-488e-bc97-1ce6ded63b84
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*" Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
+| `drop_dm_object_name(Registry)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_modify_registry_disable_toast_notifications_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_modify_registry_disable_toast_notifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+administrators may enable or disable this feature that may cause some false positive.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | the registry for DisallowRun settings was modified to enable in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp](https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp)
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-22-windows_modify_registry_disable_windows_security_center_notif.md b/docs/_posts/2022-06-22-windows_modify_registry_disable_windows_security_center_notif.md
new file mode 100644
index 0000000000..7c5be7d25a
--- /dev/null
+++ b/docs/_posts/2022-06-22-windows_modify_registry_disable_windows_security_center_notif.md
@@ -0,0 +1,165 @@
+---
+title: "Windows Modify Registry Disable Windows Security Center Notif"
+excerpt: "Modify Registry
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-22
+toc: true
+toc_label: ""
+tags:
+ - Modify Registry
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is to identify a modification in the Windows registry to disable windows center notifications. This Windows Operating System feature is responsible for alerting or notifying user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion and execution.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-22
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 27ed3e79-6d86-44dd-b9ab-524451c97a7b
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*" Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
+| `drop_dm_object_name(Registry)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_modify_registry_disable_windows_security_center_notif_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_modify_registry_disable_windows_security_center_notif_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+administrators may enable or disable this feature that may cause some false positive.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | the registry for security center notification settings was modified to disable mode in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp](https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp)
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-22-windows_modify_registry_disabling_wer_settings.md b/docs/_posts/2022-06-22-windows_modify_registry_disabling_wer_settings.md
new file mode 100644
index 0000000000..0539f5fe14
--- /dev/null
+++ b/docs/_posts/2022-06-22-windows_modify_registry_disabling_wer_settings.md
@@ -0,0 +1,165 @@
+---
+title: "Windows Modify Registry Disabling WER Settings"
+excerpt: "Modify Registry
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-22
+toc: true
+toc_label: ""
+tags:
+ - Modify Registry
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies a modification in the Windows registry to disable Windows error reporting settings. This Windows feature allows the user to report bugs, errors, failure or problems encountered in specific application or processes. Adversaries use this technique to hide any error or failure that some of its malicious components trigger.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-22
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 21cbcaf1-b51f-496d-a0c1-858ff3070452
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\disable*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
+| `drop_dm_object_name(Registry)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_modify_registry_disabling_wer_settings_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_modify_registry_disabling_wer_settings_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | the registry for WER settings was modified to be disabled on $dest$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp](https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp)
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-22-windows_modify_registry_disallow_windows_app.md b/docs/_posts/2022-06-22-windows_modify_registry_disallow_windows_app.md
new file mode 100644
index 0000000000..aaef9baf7c
--- /dev/null
+++ b/docs/_posts/2022-06-22-windows_modify_registry_disallow_windows_app.md
@@ -0,0 +1,164 @@
+---
+title: "Windows Modify Registry DisAllow Windows App"
+excerpt: "Modify Registry
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-22
+toc: true
+toc_label: ""
+tags:
+ - Modify Registry
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies modification in the Windows registry to prevent user running specific computer programs that could aid them in manually removing malware or detecting it using security products. This technique was recently identified in Azorult malware where it uses this registry value to prevent several AV products to execute on the compromised host machine.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-22
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 4bc788d3-c83a-48c5-a4e2-e0c6dba57889
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
+| `drop_dm_object_name(Registry)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_modify_registry_disallow_windows_app_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_modify_registry_disallow_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+Administrators may enable or disable this feature that may cause some false positive. Filter as needed.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | The registry for DisallowRun settings was modified to enable in $dest$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_modify_registry_disallow_windows_app.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-22-windows_modify_registry_suppress_win_defender_notif.md b/docs/_posts/2022-06-22-windows_modify_registry_suppress_win_defender_notif.md
new file mode 100644
index 0000000000..6607e67ca9
--- /dev/null
+++ b/docs/_posts/2022-06-22-windows_modify_registry_suppress_win_defender_notif.md
@@ -0,0 +1,165 @@
+---
+title: "Windows Modify Registry Suppress Win Defender Notif"
+excerpt: "Modify Registry
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-22
+toc: true
+toc_label: ""
+tags:
+ - Modify Registry
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is to identify a modification in the Windows registry to suppress windows defender notification. This technique was abuse by adversaries and threat actor to bypassed windows defender on the targeted host. Azorult malware is one of the malware use this technique that also disable toast notification and other windows features as part of its malicious behavior.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-22
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: e3b42daf-fff4-429d-bec8-2a199468cea9
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\UX Configuration\\Notification_Suppress*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
+| `drop_dm_object_name(Registry)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_modify_registry_suppress_win_defender_notif_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_modify_registry_suppress_win_defender_notif_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+administrators may enable or disable this feature that may cause some false positive.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | the registry for suppresing windows fdefender notification settings was modified to disabled in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp](https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp)
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-22-windows_powerview_kerberos_service_ticket_request.md b/docs/_posts/2022-06-22-windows_powerview_kerberos_service_ticket_request.md
index fb91675dfa..60344e0f16 100644
--- a/docs/_posts/2022-06-22-windows_powerview_kerberos_service_ticket_request.md
+++ b/docs/_posts/2022-06-22-windows_powerview_kerberos_service_ticket_request.md
@@ -102,8 +102,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
#### Search
```
-`powershell` EventCode=4104 Message=*Get-DomainSPNTicket*
-| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User
+`powershell` EventCode=4104 ScriptBlockText=*Get-DomainSPNTicket*
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_powerview_kerberos_service_ticket_request_filter`
@@ -120,9 +120,8 @@ The SPL above uses the following Macros:
#### Required field
* _time
* EventCode
-* Result_Code
-* Account_Name
-* Client_Address
+* Computer
+* ScriptBlockText
#### How To Implement
@@ -141,7 +140,7 @@ False positive may include Administrators using PowerView for troubleshooting an
| Risk Score | Impact | Confidence | Message |
| ----------- | ----------- |--------------|--------------|
-| 27.0 | 30 | 90 | PowerView commandlets used for requesting SPN service ticket executed on $Computer_Name$ |
+| 27.0 | 30 | 90 | PowerView commandlets used for requesting SPN service ticket executed on $Computer$ |
> :information_source:
@@ -162,7 +161,7 @@ Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/powerview/windows-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/powerview/windows-powershell.log)
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/powerview/windows-powershell-xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/powerview/windows-powershell-xml.log)
diff --git a/docs/_posts/2022-06-22-windows_powerview_spn_discovery.md b/docs/_posts/2022-06-22-windows_powerview_spn_discovery.md
index 0e9505a207..5349d48409 100644
--- a/docs/_posts/2022-06-22-windows_powerview_spn_discovery.md
+++ b/docs/_posts/2022-06-22-windows_powerview_spn_discovery.md
@@ -121,9 +121,8 @@ The SPL above uses the following Macros:
#### Required field
* _time
* EventCode
-* Result_Code
-* Account_Name
-* Client_Address
+* Computer
+* ScriptBlockText
#### How To Implement
@@ -142,7 +141,7 @@ False positive may include Administrators using PowerView for troubleshooting an
| Risk Score | Impact | Confidence | Message |
| ----------- | ----------- |--------------|--------------|
-| 27.0 | 30 | 90 | PowerView commandlets used for SPN discovery executed on $Computer_Name$ |
+| 27.0 | 30 | 90 | PowerView commandlets used for SPN discovery executed on $Computer$ |
> :information_source:
diff --git a/docs/_posts/2022-06-22-windows_remote_access_software_rms_registry.md b/docs/_posts/2022-06-22-windows_remote_access_software_rms_registry.md
new file mode 100644
index 0000000000..0f11829f51
--- /dev/null
+++ b/docs/_posts/2022-06-22-windows_remote_access_software_rms_registry.md
@@ -0,0 +1,165 @@
+---
+title: "Windows Remote Access Software RMS Registry"
+excerpt: "Remote Access Software
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-22
+toc: true
+toc_label: ""
+tags:
+ - Remote Access Software
+ - Command And Control
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is to identify a modification or creation of Windows registry related to the Remote Manipulator System (RMS) Remote Admin tool. RMS is a legitimate tool developed by russian organization TektonIT and has been observed being abused by adversaries to gain remote access to the targeted host. Azorult malware utilized RMS to gain remote access.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-22
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: e5b7b5a9-e471-4be8-8c5d-4083983ba329
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1219](https://attack.mitre.org/techniques/T1219/) | Remote Access Software | Command And Control |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SYSTEM\\Remote Manipulator System*" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
+| `drop_dm_object_name(Registry)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_remote_access_software_rms_registry_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_remote_access_software_rms_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+administrators may enable or disable this feature that may cause some false positive.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 90.0 | 100 | 90 | the registry related to RMS tool is created in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+* [https://malpedia.caad.fkie.fraunhofer.de/details/win.rms](https://malpedia.caad.fkie.fraunhofer.de/details/win.rms)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_remote_access_software_rms_registry.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-23-windows_modify_registry_disable_win_defender_raw_write_notif.md b/docs/_posts/2022-06-23-windows_modify_registry_disable_win_defender_raw_write_notif.md
new file mode 100644
index 0000000000..ebc12480cd
--- /dev/null
+++ b/docs/_posts/2022-06-23-windows_modify_registry_disable_win_defender_raw_write_notif.md
@@ -0,0 +1,165 @@
+---
+title: "Windows Modify Registry Disable Win Defender Raw Write Notif"
+excerpt: "Modify Registry
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-23
+toc: true
+toc_label: ""
+tags:
+ - Modify Registry
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies a modification in the Windows registry to disable Windows Defender raw write notification feature. This policy controls whether raw volume write notifications are sent to behavior monitoring or not. This registry was recently identified in Azorult malware to bypass Windows Defender detections or behavior monitoring in terms of volume write.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-23
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 0e5e25c3-32f4-46f7-ba4a-5b95c3b90f5b
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Real-Time Protection\\DisableRawWriteNotification*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest
+| `drop_dm_object_name(Registry)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_modify_registry_disable_win_defender_raw_write_notif_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_modify_registry_disable_win_defender_raw_write_notif_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+Administrators may enable or disable this feature that may cause some false positive. Filter as needed.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | The registry for raw write notification settings was modified to disable in $dest$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://admx.help/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::real-time_protection_disablerawwritenotification](https://admx.help/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::real-time_protection_disablerawwritenotification)
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-23-windows_valid_account_with_never_expires_password.md b/docs/_posts/2022-06-23-windows_valid_account_with_never_expires_password.md
new file mode 100644
index 0000000000..1cd8558d2c
--- /dev/null
+++ b/docs/_posts/2022-06-23-windows_valid_account_with_never_expires_password.md
@@ -0,0 +1,171 @@
+---
+title: "Windows Valid Account With Never Expires Password"
+excerpt: "Service Stop
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-23
+toc: true
+toc_label: ""
+tags:
+ - Service Stop
+ - Impact
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies net.exe updating user account policies for password requirement with non-expiring password. This technique was seen in several adversaries and malware like Azorult to maintain the foothold (persistence), gaining privilege escalation, defense evasion and possible for lateral movement for specific users or created user account on the targeted host. This TTP detections is a good pivot to see further what other events that users executes on the machines.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-23
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 73a931db-1830-48b3-8296-cd9cfa09c3c8
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="* accounts *" AND Processes.process="* /maxpwage:unlimited" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_valid_account_with_never_expires_password_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_valid_account_with_never_expires_password_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+#### Known False Positives
+This behavior is not commonly seen in production environment and not advisable, filter as needed.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 100.0 | 100 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to make non-expiring password on host user accounts. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+* [https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/net-commands-on-operating-systems](https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/net-commands-on-operating-systems)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_valid_account_with_never_expires_password.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-24-windows_application_layer_protocol_rms_radmin_tool_namedpipe.md b/docs/_posts/2022-06-24-windows_application_layer_protocol_rms_radmin_tool_namedpipe.md
new file mode 100644
index 0000000000..d7f5b149ab
--- /dev/null
+++ b/docs/_posts/2022-06-24-windows_application_layer_protocol_rms_radmin_tool_namedpipe.md
@@ -0,0 +1,164 @@
+---
+title: "Windows Application Layer Protocol RMS Radmin Tool Namedpipe"
+excerpt: "Application Layer Protocol
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-24
+toc: true
+toc_label: ""
+tags:
+ - Application Layer Protocol
+ - Command And Control
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies the use of default or publicly known named pipes used by RMX remote admin tool. A named pipe is a named, one-way or duplex pipe for communication between the pipe server and one or more pipe clients. RMX Tool uses named pipes in many way as part of its communication for its server and client component. This tool was abuse by several adversaries and malware like Azorult to collect data to the targeted host. This TTP is a good indicator that this tool was install in production premise and need to check if the user has a valid reason why it need to install this legitimate application.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-24
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: b62a6040-49f4-47c8-b3f6-fc1adb952a33
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1071](https://attack.mitre.org/techniques/T1071/) | Application Layer Protocol | Command And Control |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`sysmon` EventCode IN (17, 18) EventType IN ( "CreatePipe", "ConnectPipe") PipeName IN ("\\RManFUSServerNotify32", "\\RManFUSCallbackNotify32", "\\RMSPrint*")
+| stats min(_time) as firstTime max(_time) as lastTime count by Image EventType ProcessId PipeName Computer UserID
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_application_layer_protocol_rms_radmin_tool_namedpipe_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+
+> :information_source:
+> **windows_application_layer_protocol_rms_radmin_tool_namedpipe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Image
+* EventType
+* ProcessId
+* PipeName
+* Computer
+* UserID
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+#### Known False Positives
+False positives may be present. Filter based on pipe name or process.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 81.0 | 90 | 90 | possible RMS admin tool named pipe was created in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+* [https://attack.mitre.org/techniques/T1071/](https://attack.mitre.org/techniques/T1071/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-24-windows_impair_defense_add_xml_applocker_rules.md b/docs/_posts/2022-06-24-windows_impair_defense_add_xml_applocker_rules.md
new file mode 100644
index 0000000000..cc408d6a95
--- /dev/null
+++ b/docs/_posts/2022-06-24-windows_impair_defense_add_xml_applocker_rules.md
@@ -0,0 +1,170 @@
+---
+title: "Windows Impair Defense Add Xml Applocker Rules"
+excerpt: "Disable or Modify Tools
+, Impair Defenses
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-24
+toc: true
+toc_label: ""
+tags:
+ - Disable or Modify Tools
+ - Impair Defenses
+ - Defense Evasion
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is to identify a process that imports applocker xml policy using PowerShell commandlet. This technique was seen in Azorult malware where it drop an xml Applocker policy that will deny several AV products and further executed the PowerShell Applocker commandlet.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-24
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 467ed9d9-8035-470e-ad5e-ae5189283033
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
+
+| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` AND Processes.process="*Import-Module Applocker*" AND Processes.process="*Set-AppLockerPolicy *" AND Processes.process="* -XMLPolicy *" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_impair_defense_add_xml_applocker_rules_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_impair_defense_add_xml_applocker_rules_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+Administrators may execute this command that may cause some false positive.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 25.0 | 50 | 50 | Applocker importing xml policy command was executed in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-24-windows_impair_defense_deny_security_software_with_applocker.md b/docs/_posts/2022-06-24-windows_impair_defense_deny_security_software_with_applocker.md
new file mode 100644
index 0000000000..adda0f0a97
--- /dev/null
+++ b/docs/_posts/2022-06-24-windows_impair_defense_deny_security_software_with_applocker.md
@@ -0,0 +1,175 @@
+---
+title: "Windows Impair Defense Deny Security Software With Applocker"
+excerpt: "Disable or Modify Tools
+, Impair Defenses
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-24
+toc: true
+toc_label: ""
+tags:
+ - Disable or Modify Tools
+ - Impair Defenses
+ - Defense Evasion
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies a modification in the Windows registry by the Applocker utility that contains details or registry data values related to denying the execution of several security products. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV products and then loaded by using PowerShell Applocker commandlet.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-24
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: e0b6ca60-9e29-4450-b51a-bba0abae2313
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
+
+| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy Objects\\*" AND Registry.registry_path= "*}Machine\\Software\\Policies\\Microsoft\\Windows\\SrpV2*") OR Registry.registry_path="*\\Software\\Policies\\Microsoft\\Windows\\SrpV2*" AND Registry.registry_value_data = "*Action\=\"Deny\"*" AND Registry.registry_value_data IN("*O=SYMANTEC*","*O=MCAFEE*","*O=KASPERSKY*","*O=BLEEPING COMPUTER*", "*O=PANDA SECURITY*","*O=SYSTWEAK SOFTWARE*", "*O=TREND MICRO*", "*O=AVAST*", "*O=GRIDINSOFT*", "*O=MICROSOFT*", "*O=NANO SECURITY*", "*O=SUPERANTISPYWARE.COM*", "*O=DOCTOR WEB*", "*O=MALWAREBYTES*", "*O=ESET*", "*O=AVIRA*", "*O=WEBROOT*") by Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.registry_key_name Registry.dest
+| `drop_dm_object_name(Registry)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_impair_defense_deny_security_software_with_applocker_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_impair_defense_deny_security_software_with_applocker_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+False positives may be present based on organization use of Applocker. Filter as needed.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 100.0 | 100 | 100 | Applocker registry modification to deny the action of several AV products on $dest$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+* [https://www.microsoftpressstore.com/articles/article.aspx?p=2228450&seqNum=11](https://www.microsoftpressstore.com/articles/article.aspx?p=2228450&seqNum=11)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-24-windows_modify_registry_regedit_silent_reg_import.md b/docs/_posts/2022-06-24-windows_modify_registry_regedit_silent_reg_import.md
new file mode 100644
index 0000000000..37d6241173
--- /dev/null
+++ b/docs/_posts/2022-06-24-windows_modify_registry_regedit_silent_reg_import.md
@@ -0,0 +1,170 @@
+---
+title: "Windows Modify Registry Regedit Silent Reg Import"
+excerpt: "Modify Registry
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-24
+toc: true
+toc_label: ""
+tags:
+ - Modify Registry
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies modification of Windows registry using regedit.exe application with silent mode parameter. regedit.exe windows application is commonly used as GUI app to check or modify registry. This application is also has undocumented command-line parameter and one of those are silent mode parameter that performs action without stopping for confirmation with dialog box. Importing registry from .reg files need to monitor in a production environment since it can be used adversaries to import RMS registry in compromised host.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-24
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 824dd598-71be-4203-bc3b-024f4cda340e
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="regedit.exe" OR Processes.original_file_name="regedit.exe") AND Processes.process="* /s *" AND Processes.process="*.reg*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_modify_registry_regedit_silent_reg_import_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_modify_registry_regedit_silent_reg_import_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+Administrators may execute this command that may cause some false positive. Filter as needed.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | The regedit app was executed with silet mode parameter to import .reg file on $dest$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+* [https://www.techtarget.com/searchwindowsserver/tip/Command-line-options-for-Regeditexe](https://www.techtarget.com/searchwindowsserver/tip/Command-line-options-for-Regeditexe)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-24-windows_remote_service_rdpwinst_tool_execution.md b/docs/_posts/2022-06-24-windows_remote_service_rdpwinst_tool_execution.md
new file mode 100644
index 0000000000..7c0dcff0eb
--- /dev/null
+++ b/docs/_posts/2022-06-24-windows_remote_service_rdpwinst_tool_execution.md
@@ -0,0 +1,174 @@
+---
+title: "Windows Remote Service Rdpwinst Tool Execution"
+excerpt: "Remote Desktop Protocol
+, Remote Services
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-24
+toc: true
+toc_label: ""
+tags:
+ - Remote Desktop Protocol
+ - Remote Services
+ - Lateral Movement
+ - Lateral Movement
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies RDPWInst.exe tool, which is a RDP wrapper library tool designed to enable remote desktop host support and concurrent RDP session on reduced functionality system. Unfortunately, this open project was abused by adversaries to enable RDP connection to the targeted host for remote access and potentially be for lateral movement.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-24
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: c8127f87-c7c9-4036-89ed-8fe4b30e678c
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement |
+
+| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="RDPWInst.exe" OR Processes.original_file_name="RDPWInst.exe") AND Processes.process IN ("* -i*", "* -s*", "* -o*", "* -w*", "* -r*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_remote_service_rdpwinst_tool_execution_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_remote_service_rdpwinst_tool_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+This tool was designed for home usage and not commonly seen in production environment. Filter as needed.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 81.0 | 90 | 90 | Rdpwinst.exe executed on $dest$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-28-outbound_network_connection_from_java_using_default_ports.md b/docs/_posts/2022-06-28-outbound_network_connection_from_java_using_default_ports.md
index f615c98d58..94f1061cf6 100644
--- a/docs/_posts/2022-06-28-outbound_network_connection_from_java_using_default_ports.md
+++ b/docs/_posts/2022-06-28-outbound_network_connection_from_java_using_default_ports.md
@@ -113,8 +113,8 @@ A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that
#### Macros
The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
> :information_source:
> **outbound_network_connection_from_java_using_default_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-28-windows_odbcconf_load_dll.md b/docs/_posts/2022-06-28-windows_odbcconf_load_dll.md
new file mode 100644
index 0000000000..c2c36b461e
--- /dev/null
+++ b/docs/_posts/2022-06-28-windows_odbcconf_load_dll.md
@@ -0,0 +1,170 @@
+---
+title: "Windows Odbcconf Load DLL"
+excerpt: "Odbcconf
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-28
+toc: true
+toc_label: ""
+tags:
+ - Odbcconf
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies odbcconf.exe, Windows Open Database Connectivity utility, utilizing the action function of regsvr to load a DLL. An example will look like - odbcconf.exe /A { REGSVR T1218-2.dll }. During triage, review parent process, parallel procesess and file modifications.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-28
+- **Author**: Michael Haag, Splunk
+- **ID**: 141e7fca-a9f0-40fd-a539-9aac8be41f1b
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1218.008](https://attack.mitre.org/techniques/T1218/008/) | Odbcconf | Defense Evasion |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe Processes.process IN ("*/a *", "*-a*") Processes.process="*regsvr*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_odbcconf_load_dll_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_odbcconf_load_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed.
+
+#### Associated Analytic story
+* [Living Off The Land](/stories/living_off_the_land)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 42.0 | 60 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html](https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html)
+* [https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw](https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_odbcconf_load_dll.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-29-remote_system_discovery_with_adsisearcher.md b/docs/_posts/2022-06-29-remote_system_discovery_with_adsisearcher.md
new file mode 100644
index 0000000000..1850a59000
--- /dev/null
+++ b/docs/_posts/2022-06-29-remote_system_discovery_with_adsisearcher.md
@@ -0,0 +1,154 @@
+---
+title: "Remote System Discovery with Adsisearcher"
+excerpt: "Remote System Discovery
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-29
+toc: true
+toc_label: ""
+tags:
+ - Remote System Discovery
+ - Discovery
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain computers for situational awareness and Active Directory Discovery.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-06-29
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 70803451-0047-4e12-9d63-77fa7eb8649c
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText = "*adsisearcher*" AND ScriptBlockText = "*objectcategory=computer*" AND ScriptBlockText IN ("*findAll()*","*findOne()*")
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
+| `security_content_ctime(firstTime)`
+| `remote_system_discovery_with_adsisearcher_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **remote_system_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* EventCode
+* ScriptBlockText
+* Computer
+* UserID
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use Adsisearcher for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | Remote system discovery enumeration on $Computer$ by $user$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
+* [https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/](https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-29-windows_execute_arbitrary_commands_with_msdt.md b/docs/_posts/2022-06-29-windows_execute_arbitrary_commands_with_msdt.md
new file mode 100644
index 0000000000..8e2345bdb3
--- /dev/null
+++ b/docs/_posts/2022-06-29-windows_execute_arbitrary_commands_with_msdt.md
@@ -0,0 +1,179 @@
+---
+title: "Windows Execute Arbitrary Commands with MSDT"
+excerpt: "System Binary Proxy Execution
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-29
+toc: true
+toc_label: ""
+tags:
+ - System Binary Proxy Execution
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - CVE-2022-30190
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-29
+- **Author**: Michael Haag, Teoderick Contreras, Splunk
+- **ID**: e1d5145f-38fe-42b9-a5d5-457796715f97
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2022-30190](https://nvd.nist.gov/vuln/detail/CVE-2022-30190) | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability. | 9.3 |
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe Processes.process IN ("*msdt*","*ms-msdt:*","*ms-msdt:/id*","*ms-msdt:-id*","*/id*") AND (Processes.process="*IT_BrowseForFile=*" OR Processes.process="*IT_RebrowseForFile=*" OR Processes.process="*.xml*") AND Processes.process="*PCWDiagnostic*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_execute_arbitrary_commands_with_msdt_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_execute_arbitrary_commands_with_msdt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives may be present, filter as needed. Added .xml to potentially capture any answer file usage. Remove as needed.
+
+#### Associated Analytic story
+* [Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190](/stories/microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 100.0 | 100 | 100 | A parent process $parent_process_name$ has spawned a child process $process_name$ on host $dest$ possibly indicative of indirect command execution. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://isc.sans.edu/diary/rss/28694](https://isc.sans.edu/diary/rss/28694)
+* [https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e](https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e)
+* [https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A](https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A)
+* [https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/](https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/)
+* [https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection](https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection)
+* [https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html](https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-30-windows_odbcconf_hunting.md b/docs/_posts/2022-06-30-windows_odbcconf_hunting.md
new file mode 100644
index 0000000000..f8fde50f98
--- /dev/null
+++ b/docs/_posts/2022-06-30-windows_odbcconf_hunting.md
@@ -0,0 +1,170 @@
+---
+title: "Windows Odbcconf Hunting"
+excerpt: "Odbcconf
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-30
+toc: true
+toc_label: ""
+tags:
+ - Odbcconf
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies Odbcconf.exe running in the environment to assist with identifying tuning higher fidelity analytics related to Odbcconf.exe.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-30
+- **Author**: Michael Haag, Splunk
+- **ID**: 0562ad4b-fdaa-4882-b12f-7b8e0034cd72
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1218.008](https://attack.mitre.org/techniques/T1218/008/) | Odbcconf | Defense Evasion |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_odbcconf_hunting_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_odbcconf_hunting_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives will be present as this is meant to assist with filtering and tuning.
+
+#### Associated Analytic story
+* [Living Off The Land](/stories/living_off_the_land)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 6.0 | 30 | 20 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html](https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html)
+* [https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw](https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_odbcconf_hunting.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-30-windows_odbcconf_load_response_file.md b/docs/_posts/2022-06-30-windows_odbcconf_load_response_file.md
new file mode 100644
index 0000000000..cf4d7d60ee
--- /dev/null
+++ b/docs/_posts/2022-06-30-windows_odbcconf_load_response_file.md
@@ -0,0 +1,170 @@
+---
+title: "Windows Odbcconf Load Response File"
+excerpt: "Odbcconf
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-30
+toc: true
+toc_label: ""
+tags:
+ - Odbcconf
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies the odbcconf.exe, Windows Open Database Connectivity utility, loading up a resource file. The file extension is arbitrary and may be named anything. The resource file itself may have different commands supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. During triage, review file modifications and parallel processes.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-30
+- **Author**: Michael Haag, Splunk
+- **ID**: 1acafff9-1347-4b40-abae-f35aa4ba85c1
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1218.008](https://attack.mitre.org/techniques/T1218/008/) | Odbcconf | Defense Evasion |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe Processes.process IN ("*-f *","*/f *") Processes.process="*.rsp*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_odbcconf_load_response_file_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_odbcconf_load_response_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed.
+
+#### Associated Analytic story
+* [Living Off The Land](/stories/living_off_the_land)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 42.0 | 60 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html](https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html)
+* [https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw](https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-rsp.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-rsp.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_odbcconf_load_response_file.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-30-windows_powershell_import_applocker_policy.md b/docs/_posts/2022-06-30-windows_powershell_import_applocker_policy.md
new file mode 100644
index 0000000000..f569b01de2
--- /dev/null
+++ b/docs/_posts/2022-06-30-windows_powershell_import_applocker_policy.md
@@ -0,0 +1,160 @@
+---
+title: "Windows Powershell Import Applocker Policy"
+excerpt: "PowerShell
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-06-30
+toc: true
+toc_label: ""
+tags:
+ - PowerShell
+ - Execution
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is to identify the imports of Windows PowerShell Applocker commandlets. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV product and then loaded using PowerShell Applocker commandlet.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-30
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 102af98d-0ca3-4aa4-98d6-7ab2b98b955a
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+`powershell` EventCode=4104 ScriptBlockText="*Import-Module Applocker*" ScriptBlockText="*Set-AppLockerPolicy *" ScriptBlockText="* -XMLPolicy *"
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_powershell_import_applocker_policy_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **windows_powershell_import_applocker_policy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Computer
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+administrators may execute this command that may cause some false positive.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | A PowerShell script contains Import Applocker Policy command $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/import_applocker_policy/windows-powershell-xml2.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/import_applocker_policy/windows-powershell-xml2.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_powershell_import_applocker_policy.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-07-office_product_writing_cab_or_inf.md b/docs/_posts/2022-07-07-office_product_writing_cab_or_inf.md
new file mode 100644
index 0000000000..e83936c782
--- /dev/null
+++ b/docs/_posts/2022-07-07-office_product_writing_cab_or_inf.md
@@ -0,0 +1,177 @@
+---
+title: "Office Product Writing cab or inf"
+excerpt: "Phishing
+, Spearphishing Attachment
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-07-07
+toc: true
+toc_label: ""
+tags:
+ - Phishing
+ - Spearphishing Attachment
+ - Initial Access
+ - Initial Access
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - CVE-2021-40444
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies behavior related to CVE-2021-40444. Whereas the malicious document will load ActiveX and download the remote payload (.inf, .cab). During triage, review parallel processes and further activity on endpoint to identify additional patterns. Retrieve the file modifications and analyze further.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-07-07
+- **Author**: Michael Haag, Splunk
+- **ID**: f48cd1d4-125a-11ec-a447-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access |
+
+| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 |
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid
+| `drop_dm_object_name(Processes)`
+|rename process_guid as proc_guid
+| join proc_guid, _time [
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.inf","*.cab") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid
+| `drop_dm_object_name(Filesystem)`
+|rename process_guid as proc_guid
+| fields _time dest file_create_time file_name file_path process_name process_path process proc_guid]
+| dedup file_create_time
+| table dest, process_name, process, file_create_time, file_name, file_path, proc_guid
+| `office_product_writing_cab_or_inf_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **office_product_writing_cab_or_inf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* dest
+* process_name
+* process
+* file_create_time
+* file_name
+* file_path
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node.
+
+#### Known False Positives
+The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
+
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+* [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 80.0 | 80 | 100 | An instance of $process_name$ was identified on $dest$ writing an inf or cab file to this. This is not typical of $process_name$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://twitter.com/vxunderground/status/1436326057179860992?s=20](https://twitter.com/vxunderground/status/1436326057179860992?s=20)
+* [https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/](https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/)
+* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444)
+* [https://twitter.com/RonnyTNL/status/1436334640617373699?s=20](https://twitter.com/RonnyTNL/status/1436334640617373699?s=20)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/office_product_writing_cab_or_inf.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-07-suspicious_image_creation_in_appdata_folder.md b/docs/_posts/2022-07-07-suspicious_image_creation_in_appdata_folder.md
new file mode 100644
index 0000000000..0fae19c71b
--- /dev/null
+++ b/docs/_posts/2022-07-07-suspicious_image_creation_in_appdata_folder.md
@@ -0,0 +1,163 @@
+---
+title: "Suspicious Image Creation In Appdata Folder"
+excerpt: "Screen Capture
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-07-07
+toc: true
+toc_label: ""
+tags:
+ - Screen Capture
+ - Collection
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search is to detect a suspicious creation of image in appdata folder made by process that also has a file reference in appdata folder. This technique was seen in remcos rat that capture screenshot of the compromised machine and place it in the appdata and will be send to its C2 server. This TTP is really a good indicator to check that process because it is in suspicious folder path and image files are not commonly created by user in this folder path.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-07-07
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: f6f904c4-1ac0-11ec-806b-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid
+| `drop_dm_object_name(Processes)`
+|rename process_guid as proc_guid
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path= "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid
+| `drop_dm_object_name(Filesystem)`
+|rename process_guid as proc_guid
+| fields _time dest file_create_time file_name file_path process_name process_path process proc_guid]
+| `suspicious_image_creation_in_appdata_folder_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **suspicious_image_creation_in_appdata_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* dest
+* file_create_time
+* file_name
+* file_path
+* process_name
+* process_path
+* process
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+#### Known False Positives
+unknown
+
+#### Associated Analytic story
+* [Remcos](/stories/remcos)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | process $process_name$ creating image file $file_path$ in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://success.trendmicro.com/dcx/s/solution/1123281-remcos-malware-information?language=en_US](https://success.trendmicro.com/dcx/s/solution/1123281-remcos-malware-information?language=en_US)
+* [https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/](https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-07-suspicious_wav_file_in_appdata_folder.md b/docs/_posts/2022-07-07-suspicious_wav_file_in_appdata_folder.md
new file mode 100644
index 0000000000..4c596a0e71
--- /dev/null
+++ b/docs/_posts/2022-07-07-suspicious_wav_file_in_appdata_folder.md
@@ -0,0 +1,163 @@
+---
+title: "Suspicious WAV file in Appdata Folder"
+excerpt: "Screen Capture
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-07-07
+toc: true
+toc_label: ""
+tags:
+ - Screen Capture
+ - Collection
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This analytic is to detect a suspicious creation of .wav file in appdata folder. This behavior was seen in Remcos RAT malware where it put the audio recording in the appdata\audio folde as part of data collection. this recording can be send to its C2 server as part of its exfiltration to the compromised machine. creation of wav files in this folder path is not a ussual disk place used by user to save audio format file.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-07-07
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 5be109e6-1ac5-11ec-b421-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid
+| `drop_dm_object_name(Processes)`
+|rename process_guid as proc_guid
+| join proc_guid, _time [
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid
+| `drop_dm_object_name(Filesystem)`
+|rename process_guid as proc_guid
+| fields file_name file_path process_name process_path process dest file_create_time _time proc_guid]
+| `suspicious_wav_file_in_appdata_folder_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **suspicious_wav_file_in_appdata_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* dest
+* file_create_time
+* file_name
+* file_path
+* process_name
+* process_path
+* process
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, file_name, file_path and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+#### Known False Positives
+unknown
+
+#### Associated Analytic story
+* [Remcos](/stories/remcos)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | process $process_name$ creating image file $file_path$ in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://success.trendmicro.com/dcx/s/solution/1123281-remcos-malware-information?language=en_US](https://success.trendmicro.com/dcx/s/solution/1123281-remcos-malware-information?language=en_US)
+* [https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/](https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon_wav.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon_wav.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-07-windows_binary_proxy_execution_mavinject_dll_injection.md b/docs/_posts/2022-07-07-windows_binary_proxy_execution_mavinject_dll_injection.md
new file mode 100644
index 0000000000..69a4b75aec
--- /dev/null
+++ b/docs/_posts/2022-07-07-windows_binary_proxy_execution_mavinject_dll_injection.md
@@ -0,0 +1,176 @@
+---
+title: "Windows Binary Proxy Execution Mavinject DLL Injection"
+excerpt: "Mavinject
+, System Binary Proxy Execution
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-07-07
+toc: true
+toc_label: ""
+tags:
+ - Mavinject
+ - System Binary Proxy Execution
+ - Defense Evasion
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution (ex. C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL). In addition to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import descriptor injection via its /HMODULE command-line parameter (ex. mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an import table entry consisting of the specified DLL into the module at the given base address. During triage, review file modifcations and parallel processes.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-07-07
+- **Author**: Michael Haag, Splunk
+- **ID**: ccf4b61b-1b26-4f2e-a089-f2009c569c57
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1218.013](https://attack.mitre.org/techniques/T1218/013/) | Mavinject | Defense Evasion |
+
+| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mavinject.exe Processes.process IN ("*injectrunning*", "*hmodule=0x*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_binary_proxy_execution_mavinject_dll_injection_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_binary_proxy_execution_mavinject_dll_injection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives may be present, filter on DLL name or parent process.
+
+#### Associated Analytic story
+* [Living Off The Land](/stories/living_off_the_land)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting load a DLL. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1218/013/](https://attack.mitre.org/techniques/T1218/013/)
+* [https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e](https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e)
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-1---mavinject---inject-dll-into-running-process](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-1---mavinject---inject-dll-into-running-process)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.013/atomic_red_team/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.013/atomic_red_team/windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-08-living_off_the_land.md b/docs/_posts/2022-07-08-living_off_the_land.md
new file mode 100644
index 0000000000..134210e727
--- /dev/null
+++ b/docs/_posts/2022-07-08-living_off_the_land.md
@@ -0,0 +1,177 @@
+---
+title: "Living Off The Land"
+excerpt: "Ingress Tool Transfer
+, Exploit Public-Facing Application
+, Command and Scripting Interpreter
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-07-08
+toc: true
+toc_label: ""
+tags:
+ - Ingress Tool Transfer
+ - Exploit Public-Facing Application
+ - Command and Scripting Interpreter
+ - Command And Control
+ - Initial Access
+ - Execution
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Risk
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following correlation identifies a distinct amount of analytics associated with the Living Off The Land analytic story that identify potentially suspicious behavior.
+
+- **Type**: [Correlation](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Risk](https://docs.splunk.com/Documentation/CIM/latest/User/Risk)
+- **Last Updated**: 2022-07-08
+- **Author**: Michael Haag, Splunk
+- **ID**: 1be30d80-3a39-4df9-9102-64a467b24abc
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control |
+
+| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Reconnaissance
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Risk.All_Risk where All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.annotations.mitre_attack.mitre_tactic source
+| `drop_dm_object_name(All_Risk)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| stats values(source) as detection_name values(annotations.mitre_attack.mitre_tactic) as tactics values(firstTime) as firstTime values(lastTime) as lastTime dc(annotations.mitre_attack.mitre_tactic) as distinct_tactics dc(source) as distinct_detection_name by risk_object
+| where distinct_detection_name >= 2
+| `living_off_the_land_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **living_off_the_land_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* All_Risk.analyticstories
+* All_Risk.risk_object_type
+* All_Risk.risk_object
+* All_Risk.annotations.mitre_attack.mitre_tactic
+* source
+
+
+#### How To Implement
+To implement this correlation search a user needs to enable all detections in the Living Off The Land Analytic Story and confirm it is generating risk events. A simple search `index=risk analyticstories="Living Off The Land"` should contain events.
+
+#### Known False Positives
+There are no known false positive for this search, but it could contain false positives as multiple detections can trigger and not have successful exploitation. Modify the static value distinct_detection_name to a higher value. It is also required to tune analytics that are also tagged to ensure volume is never too much.
+
+#### Associated Analytic story
+* [Living Off The Land](/stories/living_off_the_land)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 63.0 | 90 | 70 | An increase of Living Off The Land behavior has been detected on $affected_systems$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://www.splunk.com/en_us/blog/security/living-off-the-land-threat-research-february-2022-release.html](https://www.splunk.com/en_us/blog/security/living-off-the-land-threat-research-february-2022-release.html)
+* [https://research.splunk.com/stories/living_off_the_land/](https://research.splunk.com/stories/living_off_the_land/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1218/living_off_the_land/lolbinrisk.log](https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1218/living_off_the_land/lolbinrisk.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/living_off_the_land.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-11-windows_identify_protocol_handlers.md b/docs/_posts/2022-07-11-windows_identify_protocol_handlers.md
new file mode 100644
index 0000000000..99444ee6e1
--- /dev/null
+++ b/docs/_posts/2022-07-11-windows_identify_protocol_handlers.md
@@ -0,0 +1,183 @@
+---
+title: "Windows Identify Protocol Handlers"
+excerpt: "Command and Scripting Interpreter
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-07-11
+toc: true
+toc_label: ""
+tags:
+ - Command and Scripting Interpreter
+ - Execution
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings). To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL in the property to limit the scope of this query to similar handlers as ms-msdt.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-07-11
+- **Author**: Michael Haag, Splunk
+- **ID**: bd5c311e-a6ea-48ae-a289-19a3398e3648
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.process_name Processes.process
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `drop_dm_object_name(Processes)`
+| lookup windows_protocol_handlers handler AS process OUTPUT handler ishandler
+| where ishandler="TRUE"
+| `windows_identify_protocol_handlers_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_identify_protocol_handlers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Lookups
+The SPL above uses the following Lookups:
+
+* [windows_protocol_handlers](https://github.com/splunk/security_content/blob/develop/lookups/windows_protocol_handlers.yml) with [data](https://github.com/splunk/security_content/tree/develop/lookups/windows_protocol_handlers.csv)
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives will be found. https and http is a URL Protocol handler that will trigger this analytic. Tune based on process or command-line.
+
+#### Associated Analytic story
+* [Living Off The Land](/stories/living_off_the_land)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 6.0 | 30 | 20 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing a protocol handler. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://www.oreilly.com/library/view/learning-java/1565927184/apas02.html](https://www.oreilly.com/library/view/learning-java/1565927184/apas02.html)
+* [https://blogs.windows.com/msedgedev/2022/01/20/getting-started-url-protocol-handlers-microsoft-edge/](https://blogs.windows.com/msedgedev/2022/01/20/getting-started-url-protocol-handlers-microsoft-edge/)
+* [https://github.com/Mr-Un1k0d3r/PoisonHandler](https://github.com/Mr-Un1k0d3r/PoisonHandler)
+* [https://www.mdsec.co.uk/2021/03/phishing-users-to-take-a-test/](https://www.mdsec.co.uk/2021/03/phishing-users-to-take-a-test/)
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-5---protocolhandlerexe-downloaded-a-suspicious-file](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-5---protocolhandlerexe-downloaded-a-suspicious-file)
+* [https://techcommunity.microsoft.com/t5/windows-it-pro-blog/disabling-the-msix-ms-appinstaller-protocol-handler/ba-p/3119479](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/disabling-the-msix-ms-appinstaller-protocol-handler/ba-p/3119479)
+* [https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug](https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug)
+* [https://parsiya.net/blog/2021-03-17-attack-surface-analysis-part-2-custom-protocol-handlers/](https://parsiya.net/blog/2021-03-17-attack-surface-analysis-part-2-custom-protocol-handlers/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/protocol_handlers/protocolhandlers.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/protocol_handlers/protocolhandlers.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_identify_protocol_handlers.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-12-spring4shell_payload_url_request.md b/docs/_posts/2022-07-12-spring4shell_payload_url_request.md
new file mode 100644
index 0000000000..e1c61a9c8d
--- /dev/null
+++ b/docs/_posts/2022-07-12-spring4shell_payload_url_request.md
@@ -0,0 +1,180 @@
+---
+title: "Spring4Shell Payload URL Request"
+excerpt: "Web Shell
+, Server Software Component
+, Exploit Public-Facing Application
+"
+categories:
+ - Web
+last_modified_at: 2022-07-12
+toc: true
+toc_label: ""
+tags:
+ - Web Shell
+ - Server Software Component
+ - Exploit Public-Facing Application
+ - Persistence
+ - Persistence
+ - Initial Access
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - CVE-2022-22965
+ - Web
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is static indicators related to CVE-2022-22963, Spring4Shell. The 3 indicators provide an amount of fidelity that source IP is attemping to exploit a web shell on the destination. The filename and cmd are arbitrary in this exploitation. Java will write a JSP to disk and a process will spawn from Java based on the cmd passed. This is indicative of typical web shell activity.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
+- **Last Updated**: 2022-07-12
+- **Author**: Michael Haag, Splunk
+- **ID**: 9d44d649-7d67-4559-95c1-8022ff49420b
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1505.003](https://attack.mitre.org/techniques/T1505/003/) | Web Shell | Persistence |
+
+| [T1505](https://attack.mitre.org/techniques/T1505/) | Server Software Component | Persistence |
+
+| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2022-22965](https://nvd.nist.gov/vuln/detail/CVE-2022-22965) | A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. | 7.5 |
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats count from datamodel=Web where Web.http_method IN ("GET") Web.url IN ("*tomcatwar.jsp*","*poc.jsp*","*shell.jsp*") by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype
+| `drop_dm_object_name("Web")`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `spring4shell_payload_url_request_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **spring4shell_payload_url_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Web.http_method
+* Web.url
+* Web.url_length
+* Web.src
+* Web.dest
+* Web.http_user_agent
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel.
+
+#### Known False Positives
+The jsp file names are static names used in current proof of concept code. =
+
+#### Associated Analytic story
+* [Spring4Shell CVE-2022-22965](/stories/spring4shell_cve-2022-22965)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 36.0 | 60 | 60 | A URL was requested related to Spring4Shell POC code on $dest$ by $src$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/](https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/)
+* [https://github.com/TheGejr/SpringShell](https://github.com/TheGejr/SpringShell)
+* [https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability](https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/spring4shell_nginx.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/spring4shell_nginx.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/web/spring4shell_payload_url_request.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-15-certutil_exe_certificate_extraction.md b/docs/_posts/2022-07-15-certutil_exe_certificate_extraction.md
new file mode 100644
index 0000000000..f26825b569
--- /dev/null
+++ b/docs/_posts/2022-07-15-certutil_exe_certificate_extraction.md
@@ -0,0 +1,158 @@
+---
+title: "Certutil exe certificate extraction"
+excerpt: ""
+categories:
+ - Endpoint
+last_modified_at: 2022-07-15
+toc: true
+toc_label: ""
+tags:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Last Updated**: 2022-07-15
+- **Author**: Rod Soto, Splunk
+- **ID**: 337a46be-600f-11eb-ae93-0242ac130002
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Installation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `certutil_exe_certificate_extraction_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **certutil_exe_certificate_extraction_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+
+#### Known False Positives
+Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services.
+
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
+* [Living Off The Land](/stories/living_off_the_land)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 63.0 | 90 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack](https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack)
+* [https://strontic.github.io/xcyclopedia/library/certutil.exe-09A8A29BAA3A451713FD3D07943B4A43.html](https://strontic.github.io/xcyclopedia/library/certutil.exe-09A8A29BAA3A451713FD3D07943B4A43.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/certutil_exe_certificate_extraction.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-15-powershell_disable_security_monitoring.md b/docs/_posts/2022-07-15-powershell_disable_security_monitoring.md
new file mode 100644
index 0000000000..0aff23150f
--- /dev/null
+++ b/docs/_posts/2022-07-15-powershell_disable_security_monitoring.md
@@ -0,0 +1,171 @@
+---
+title: "Powershell Disable Security Monitoring"
+excerpt: "Disable or Modify Tools
+, Impair Defenses
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-07-15
+toc: true
+toc_label: ""
+tags:
+ - Disable or Modify Tools
+ - Impair Defenses
+ - Defense Evasion
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Last Updated**: 2022-07-15
+- **Author**: Michael Haag, Splunk
+- **ID**: c148a894-dd93-11eb-bf2a-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
+
+| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process="*set-mppreference*" AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*","*DisableBehaviorMonitoring*","*drtm *","*dioavp *","*dscrptsc *","*dbaf *","*dbm *") by Processes.dest Processes.user Processes.parent_process Processes.original_file_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `powershell_disable_security_monitoring_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **powershell_disable_security_monitoring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+Limited false positives. However, tune based on scripts that may perform this action.
+
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+* [Revil Ransomware](/stories/revil_ransomware)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 25.0 | 50 | 50 | |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell)
+* [https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps](https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_disable_security_monitoring.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-15-windows_mof_event_triggered_execution_via_wmi.md b/docs/_posts/2022-07-15-windows_mof_event_triggered_execution_via_wmi.md
new file mode 100644
index 0000000000..97d58f137b
--- /dev/null
+++ b/docs/_posts/2022-07-15-windows_mof_event_triggered_execution_via_wmi.md
@@ -0,0 +1,174 @@
+---
+title: "Windows MOF Event Triggered Execution via WMI"
+excerpt: "Windows Management Instrumentation Event Subscription
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-07-15
+toc: true
+toc_label: ""
+tags:
+ - Windows Management Instrumentation Event Subscription
+ - Persistence
+ - Privilege Escalation
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following anaytic identifies MOFComp.exe loading a MOF file. The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Typically, MOFComp.exe does not reach out to the public internet or load a MOF file from User Profile paths. A filter and consumer is typically registered in WMI. Review parallel processes and query WMI subscriptions to gather artifacts. The default path of mofcomp.exe is C:\Windows\System32\wbem.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-07-15
+- **Author**: Michael Haag, Splunk
+- **ID**: e59b5a73-32bf-4467-a585-452c36ae10c1
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1546.003](https://attack.mitre.org/techniques/T1546/003/) | Windows Management Instrumentation Event Subscription | Persistence, Privilege Escalation |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+* DE.CM
+
+
+
+
+
+
+
+ CIS20
+
+
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name IN ("cmd.exe", "powershell.exe") Processes.process_name=mofcomp.exe) OR (Processes.process_name=mofcomp.exe Processes.process IN ("*\\AppData\\Local\\*","*\\Users\\Public\\*", "*\\WINDOWS\\Temp\\*")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `windows_mof_event_triggered_execution_via_wmi_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_mof_event_triggered_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives may be present from automation based applications (SCCM), filtering may be required. In addition, break the query out based on volume of usage. Filter process names or f
+
+#### Associated Analytic story
+* [Living Off The Land](/stories/living_off_the_land)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 64.0 | 80 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ loading a MOF file. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1546/003/](https://attack.mitre.org/techniques/T1546/003/)
+* [https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/](https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/)
+* [https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp](https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp)
+* [https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/](https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/)
+* [https://www.sakshamdixit.com/wmi-events/](https://www.sakshamdixit.com/wmi-events/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/mofcomp.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/mofcomp.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-19-allow_inbound_traffic_by_firewall_rule_registry.md b/docs/_posts/2022-07-19-allow_inbound_traffic_by_firewall_rule_registry.md
new file mode 100644
index 0000000000..b75d110ed0
--- /dev/null
+++ b/docs/_posts/2022-07-19-allow_inbound_traffic_by_firewall_rule_registry.md
@@ -0,0 +1,176 @@
+---
+title: "Allow Inbound Traffic By Firewall Rule Registry"
+excerpt: "Remote Desktop Protocol
+, Remote Services
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-07-19
+toc: true
+toc_label: ""
+tags:
+ - Remote Desktop Protocol
+ - Remote Services
+ - Lateral Movement
+ - Lateral Movement
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Last Updated**: 2022-07-19
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 0a46537c-be02-11eb-92ca-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement |
+
+| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data = "*
+|Action=Allow
+|*" Registry.registry_value_data = "*
+|Dir=In
+|*" Registry.registry_value_data = "*
+|LPort=*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data
+| `drop_dm_object_name(Registry)`
+|rename process_guid as proc_guid
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid
+| `drop_dm_object_name(Processes)`
+|rename process_guid as proc_guid
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name]
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name
+| `allow_inbound_traffic_by_firewall_rule_registry_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **allow_inbound_traffic_by_firewall_rule_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_path
+* Registry.registry_value_name
+* Registry.registry_key_name
+* Registry.registry_value_data
+* Registry.action
+* Registry.dest
+* Registry.user
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered.
+
+#### Associated Analytic story
+* [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 25.0 | 50 | 50 | Suspicious firewall allow rule modifications were detected via the registry on endpoint $dest$ by user $user$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps](https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log)
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-19-wmic_noninteractive_app_uninstallation.md b/docs/_posts/2022-07-19-wmic_noninteractive_app_uninstallation.md
new file mode 100644
index 0000000000..7b073bc0b0
--- /dev/null
+++ b/docs/_posts/2022-07-19-wmic_noninteractive_app_uninstallation.md
@@ -0,0 +1,169 @@
+---
+title: "Wmic NonInteractive App Uninstallation"
+excerpt: "Disable or Modify Tools
+, Impair Defenses
+"
+categories:
+ - Endpoint
+last_modified_at: 2022-07-19
+toc: true
+toc_label: ""
+tags:
+ - Disable or Modify Tools
+ - Impair Defenses
+ - Defense Evasion
+ - Defense Evasion
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-07-19
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: bff0e7a0-317f-11ec-ab4e-acde48001122
+
+
+#### Annotations
+
+
+ ATT&CK
+
+
+
+
+| ID | Technique | Tactic |
+| -------------- | ---------------- |-------------------- |
+| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
+
+| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+
+
+
+
+
+ Kill Chain Phase
+
+
+
+* Exploitation
+
+
+
+
+
+
+
+ NIST
+
+
+
+
+
+
+
+
+
+ CIS20
+
+
+
+
+
+
+
+
+
+ CVE
+
+
+
+
+
+
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe Processes.process="* product *" Processes.process="*where name*" Processes.process="*call uninstall*" Processes.process="*/nointeractive*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id
+| `drop_dm_object_name(Processes)`
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)`
+| `wmic_noninteractive_app_uninstallation_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **wmic_noninteractive_app_uninstallation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+Third party application may use this approach to uninstall applications.
+
+#### Associated Analytic story
+* [IceID](/stories/iceid)
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score | Impact | Confidence | Message |
+| ----------- | ----------- |--------------|--------------|
+| 25.0 | 50 | 50 | Wmic $process_name$ with command-line $process$ on $dest$ attempting to uninstall software. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.
+
+#### Reference
+
+* [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_stories/active_directory_discovery.md b/docs/_stories/active_directory_discovery.md
index c1db9d6cd8..a47fe11c82 100644
--- a/docs/_stories/active_directory_discovery.md
+++ b/docs/_stories/active_directory_discovery.md
@@ -60,7 +60,7 @@ Once an attacker obtains an initial foothold in an Active Directory environment,
| [Get DomainUser with PowerShell](/endpoint/get_domainuser_with_powershell/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery)| TTP |
| [Get DomainUser with PowerShell Script Block](/endpoint/get_domainuser_with_powershell_script_block/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery)| TTP |
| [Get-ForestTrust with PowerShell](/endpoint/get-foresttrust_with_powershell/) | [Domain Trust Discovery](/tags/#domain-trust-discovery)| TTP |
-| [Get-ForestTrust with PowerShell Script Block](/endpoint/get-foresttrust_with_powershell_script_block/) | [Domain Trust Discovery](/tags/#domain-trust-discovery)| TTP |
+| [Get-ForestTrust with PowerShell Script Block](/endpoint/get-foresttrust_with_powershell_script_block/) | [Domain Trust Discovery](/tags/#domain-trust-discovery), [PowerShell](/tags/#powershell)| TTP |
| [Get WMIObject Group Discovery](/endpoint/get_wmiobject_group_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups)| Hunting |
| [Get WMIObject Group Discovery with Script Block Logging](/endpoint/get_wmiobject_group_discovery_with_script_block_logging/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups)| Hunting |
| [GetAdComputer with PowerShell](/endpoint/getadcomputer_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery)| Hunting |
@@ -76,7 +76,7 @@ Once an attacker obtains an initial foothold in an Active Directory environment,
| [GetDomainGroup with PowerShell](/endpoint/getdomaingroup_with_powershell/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups)| TTP |
| [GetDomainGroup with PowerShell Script Block](/endpoint/getdomaingroup_with_powershell_script_block/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups)| TTP |
| [GetLocalUser with PowerShell](/endpoint/getlocaluser_with_powershell/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account)| Hunting |
-| [GetLocalUser with PowerShell Script Block](/endpoint/getlocaluser_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account)| Hunting |
+| [GetLocalUser with PowerShell Script Block](/endpoint/getlocaluser_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account), [PowerShell](/tags/#powershell)| Hunting |
| [GetNetTcpconnection with PowerShell](/endpoint/getnettcpconnection_with_powershell/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery)| Hunting |
| [GetNetTcpconnection with PowerShell Script Block](/endpoint/getnettcpconnection_with_powershell_script_block/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery)| Hunting |
| [GetWmiObject Ds Computer with PowerShell](/endpoint/getwmiobject_ds_computer_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery)| TTP |
@@ -86,7 +86,7 @@ Once an attacker obtains an initial foothold in an Active Directory environment,
| [GetWmiObject DS User with PowerShell](/endpoint/getwmiobject_ds_user_with_powershell/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery)| TTP |
| [GetWmiObject DS User with PowerShell Script Block](/endpoint/getwmiobject_ds_user_with_powershell_script_block/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery)| TTP |
| [GetWmiObject User Account with PowerShell](/endpoint/getwmiobject_user_account_with_powershell/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account)| Hunting |
-| [GetWmiObject User Account with PowerShell Script Block](/endpoint/getwmiobject_user_account_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account)| Hunting |
+| [GetWmiObject User Account with PowerShell Script Block](/endpoint/getwmiobject_user_account_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account), [PowerShell](/tags/#powershell)| Hunting |
| [Local Account Discovery with Net](/endpoint/local_account_discovery_with_net/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account)| Hunting |
| [Local Account Discovery With Wmic](/endpoint/local_account_discovery_with_wmic/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account)| Hunting |
| [Net Localgroup Discovery](/endpoint/net_localgroup_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups)| Hunting |
diff --git a/docs/_stories/active_directory_lateral_movement.md b/docs/_stories/active_directory_lateral_movement.md
index 12fee30468..f7b2e57295 100644
--- a/docs/_stories/active_directory_lateral_movement.md
+++ b/docs/_stories/active_directory_lateral_movement.md
@@ -44,8 +44,8 @@ If there is evidence of lateral movement, it is imperative for analysts to colle
| [Executable File Written in Administrative SMB Share](/endpoint/executable_file_written_in_administrative_smb_share/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares)| TTP |
| [Impacket Lateral Movement Commandline Parameters](/endpoint/impacket_lateral_movement_commandline_parameters/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service)| TTP |
| [Interactive Session on Remote Endpoint with PowerShell](/endpoint/interactive_session_on_remote_endpoint_with_powershell/) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management)| TTP |
-| [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model)| TTP |
-| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell)| TTP |
+| [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [MMC](/tags/#mmc)| TTP |
+| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell), [MMC](/tags/#mmc)| TTP |
| [Remote Process Instantiation via DCOM and PowerShell](/endpoint/remote_process_instantiation_via_dcom_and_powershell/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model)| TTP |
| [Remote Process Instantiation via DCOM and PowerShell Script Block](/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model)| TTP |
| [Remote Process Instantiation via WinRM and PowerShell](/endpoint/remote_process_instantiation_via_winrm_and_powershell/) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management)| TTP |
diff --git a/docs/_stories/azorult.md b/docs/_stories/azorult.md
new file mode 100644
index 0000000000..de9440d619
--- /dev/null
+++ b/docs/_stories/azorult.md
@@ -0,0 +1,100 @@
+---
+title: "Azorult"
+last_modified_at: 2022-06-09
+toc: true
+toc_label: ""
+tags:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
+ - Endpoint
+ - Actions on Objectives
+ - Delivery
+ - Exploitation
+ - Installation
+ - Reconnaissance
+---
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+Leverage searches that allow you to detect and investigate unusual activities that might relate to the Azorult malware including firewall modification, icacl execution, spawning more process, botnet c2 communication, defense evasion and etc. The AZORULT malware was first discovered in 2016 to be an information stealer that steals browsing history, cookies, ID/passwords, cryptocurrency information and more. It can also be a downloader of other malware. A variant of this malware was able to create a new, hidden administrator account on the machine to set a registry key to establish a Remote Desktop Protocol (RDP) connection. Exploit kits such as Fallout Exploit Kit (EK) and phishing mails with social engineering technique are one of the major infection vectors of the AZORult malware. The current malspam and phishing emails use fake product order requests, invoice documents and payment information requests. This Trojan-Spyware connects to command and control (C&C) servers of attacker to send and receive information.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-09
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: efed5343-4ac2-42b1-a16d-da2428d0ce94
+
+#### Narrative
+
+Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption is the goal.
+
+#### Detections
+
+| Name | Technique | Type |
+| ----------- | ----------- |--------------|
+| [Allow Inbound Traffic By Firewall Rule Registry](/endpoint/allow_inbound_traffic_by_firewall_rule_registry/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services)| TTP |
+| [Allow Operation with Consent Admin](/endpoint/allow_operation_with_consent_admin/) | [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [CHCP Command Execution](/endpoint/chcp_command_execution/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP |
+| [CMD Carry Out String Command Parameter](/endpoint/cmd_carry_out_string_command_parameter/) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting |
+| [Create local admin accounts using net exe](/endpoint/create_local_admin_accounts_using_net_exe/) | [Local Account](/tags/#local-account), [Create Account](/tags/#create-account)| TTP |
+| [Detect Use of cmd exe to Launch Script Interpreters](/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell)| TTP |
+| [Disable Defender BlockAtFirstSeen Feature](/endpoint/disable_defender_blockatfirstseen_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Defender Enhanced Notification](/endpoint/disable_defender_enhanced_notification/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Defender Spynet Reporting](/endpoint/disable_defender_spynet_reporting/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Defender Submit Samples Consent Feature](/endpoint/disable_defender_submit_samples_consent_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Show Hidden Files](/endpoint/disable_show_hidden_files/) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Hide Artifacts](/tags/#hide-artifacts), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Excessive Attempt To Disable Services](/endpoint/excessive_attempt_to_disable_services/) | [Service Stop](/tags/#service-stop)| Anomaly |
+| [Excessive Usage Of Cacls App](/endpoint/excessive_usage_of_cacls_app/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification)| Anomaly |
+| [Excessive Usage Of Net App](/endpoint/excessive_usage_of_net_app/) | [Account Access Removal](/tags/#account-access-removal)| Anomaly |
+| [Excessive Usage Of SC Service Utility](/endpoint/excessive_usage_of_sc_service_utility/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution)| Anomaly |
+| [Excessive Usage Of Taskkill](/endpoint/excessive_usage_of_taskkill/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Anomaly |
+| [Executables Or Script Creation In Suspicious Path](/endpoint/executables_or_script_creation_in_suspicious_path/) | [Masquerading](/tags/#masquerading)| TTP |
+| [Firewall Allowed Program Enable](/endpoint/firewall_allowed_program_enable/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses)| Anomaly |
+| [Hide User Account From Sign-In Screen](/endpoint/hide_user_account_from_sign-in_screen/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification)| TTP |
+| [Icacls Deny Command](/endpoint/icacls_deny_command/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification)| TTP |
+| [Net Localgroup Discovery](/endpoint/net_localgroup_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups)| Hunting |
+| [Network Connection Discovery With Net](/endpoint/network_connection_discovery_with_net/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery)| Hunting |
+| [Non Firefox Process Access Firefox Profile Dir](/endpoint/non_firefox_process_access_firefox_profile_dir/) | [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers)| Anomaly |
+| [Processes launching netsh](/endpoint/processes_launching_netsh/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP |
+| [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process)| TTP |
+| [Scheduled Task Deleted Or Created via CMD](/endpoint/scheduled_task_deleted_or_created_via_cmd/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP |
+| [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly |
+| [Windows Application Layer Protocol RMS Radmin Tool Namedpipe](/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe/) | [Application Layer Protocol](/tags/#application-layer-protocol)| TTP |
+| [Windows Defender Exclusion Registry Entry](/endpoint/windows_defender_exclusion_registry_entry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Windows Gather Victim Network Info Through Ip Check Web Services](/endpoint/windows_gather_victim_network_info_through_ip_check_web_services/) | [IP Addresses](/tags/#ip-addresses), [Gather Victim Network Information](/tags/#gather-victim-network-information)| Hunting |
+| [Windows Impair Defense Add Xml Applocker Rules](/endpoint/windows_impair_defense_add_xml_applocker_rules/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Hunting |
+| [Windows Impair Defense Deny Security Software With Applocker](/endpoint/windows_impair_defense_deny_security_software_with_applocker/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Windows Modify Registry Disable Toast Notifications](/endpoint/windows_modify_registry_disable_toast_notifications/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows Modify Registry Disable Win Defender Raw Write Notif](/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows Modify Registry Disable Windows Security Center Notif](/endpoint/windows_modify_registry_disable_windows_security_center_notif/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows Modify Registry Disabling WER Settings](/endpoint/windows_modify_registry_disabling_wer_settings/) | [Modify Registry](/tags/#modify-registry)| TTP |
+| [Windows Modify Registry DisAllow Windows App](/endpoint/windows_modify_registry_disallow_windows_app/) | [Modify Registry](/tags/#modify-registry)| TTP |
+| [Windows Modify Registry Regedit Silent Reg Import](/endpoint/windows_modify_registry_regedit_silent_reg_import/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows Modify Registry Suppress Win Defender Notif](/endpoint/windows_modify_registry_suppress_win_defender_notif/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows Powershell Import Applocker Policy](/endpoint/windows_powershell_import_applocker_policy/) | [PowerShell](/tags/#powershell)| TTP |
+| [Windows Remote Access Software RMS Registry](/endpoint/windows_remote_access_software_rms_registry/) | [Remote Access Software](/tags/#remote-access-software)| TTP |
+| [Windows Remote Service Rdpwinst Tool Execution](/endpoint/windows_remote_service_rdpwinst_tool_execution/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services)| TTP |
+| [Windows Remote Services Allow Rdp In Firewall](/endpoint/windows_remote_services_allow_rdp_in_firewall/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services)| Anomaly |
+| [Windows Remote Services Allow Remote Assistance](/endpoint/windows_remote_services_allow_remote_assistance/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services)| Anomaly |
+| [Windows Remote Services Rdp Enable](/endpoint/windows_remote_services_rdp_enable/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services)| TTP |
+| [Windows Service Stop By Deletion](/endpoint/windows_service_stop_by_deletion/) | [Service Stop](/tags/#service-stop)| TTP |
+| [Windows Valid Account With Never Expires Password](/endpoint/windows_valid_account_with_never_expires_password/) | [Service Stop](/tags/#service-stop)| TTP |
+| [Wmic NonInteractive App Uninstallation](/endpoint/wmic_noninteractive_app_uninstallation/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Hunting |
+
+#### Reference
+
+* [https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null](https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null)
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/stories/azorult.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_stories/container_implantation_monitoring_and_investigation.md b/docs/_stories/container_implantation_monitoring_and_investigation.md
index d39b89f55d..a8a5a7c554 100644
--- a/docs/_stories/container_implantation_monitoring_and_investigation.md
+++ b/docs/_stories/container_implantation_monitoring_and_investigation.md
@@ -7,7 +7,6 @@ tags:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
- - Exploitation
---
[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -30,8 +29,6 @@ Container Registrys provide a way for organizations to keep customized images of
| Name | Technique | Type |
| ----------- | ----------- |--------------|
-| [GCP GCR container uploaded](/deprecated/gcp_gcr_container_uploaded/) | [Implant Internal Image](/tags/#implant-internal-image)| Hunting |
-| [New container uploaded to AWS ECR](/cloud/new_container_uploaded_to_aws_ecr/) | [Implant Internal Image](/tags/#implant-internal-image)| Hunting |
#### Reference
diff --git a/docs/_stories/disabling_security_tools.md b/docs/_stories/disabling_security_tools.md
index 1316ad27c7..33a01aa290 100644
--- a/docs/_stories/disabling_security_tools.md
+++ b/docs/_stories/disabling_security_tools.md
@@ -43,7 +43,7 @@ Attackers employ a variety of tactics in order to avoid detection and operate wi
* [https://attack.mitre.org/wiki/Technique/T1089](https://attack.mitre.org/wiki/Technique/T1089)
* [https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/](https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/)
-* [https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf](https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf)
+* [https://web.archive.org/web/20220425194457/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf](https://web.archive.org/web/20220425194457/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf)
diff --git a/docs/_stories/hermetic_wiper.md b/docs/_stories/hermetic_wiper.md
index 9aa678645f..a604392772 100644
--- a/docs/_stories/hermetic_wiper.md
+++ b/docs/_stories/hermetic_wiper.md
@@ -45,7 +45,7 @@ Hermetic Wiper is destructive malware operation found by Sentinel One targeting
| [Change Default File Association](/endpoint/change_default_file_association/) | [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution)| TTP |
| [CMD Carry Out String Command Parameter](/endpoint/cmd_carry_out_string_command_parameter/) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting |
| [Detect Empire with PowerShell Script Block Logging](/endpoint/detect_empire_with_powershell_script_block_logging/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
-| [Detect Mimikatz With PowerShell Script Block Logging](/endpoint/detect_mimikatz_with_powershell_script_block_logging/) | [OS Credential Dumping](/tags/#os-credential-dumping)| TTP |
+| [Detect Mimikatz With PowerShell Script Block Logging](/endpoint/detect_mimikatz_with_powershell_script_block_logging/) | [OS Credential Dumping](/tags/#os-credential-dumping), [PowerShell](/tags/#powershell)| TTP |
| [ETW Registry Disabled](/endpoint/etw_registry_disabled/) | [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses)| TTP |
| [Executable File Written in Administrative SMB Share](/endpoint/executable_file_written_in_administrative_smb_share/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares)| TTP |
| [Executables Or Script Creation In Suspicious Path](/endpoint/executables_or_script_creation_in_suspicious_path/) | [Masquerading](/tags/#masquerading)| TTP |
@@ -56,19 +56,19 @@ Hermetic Wiper is destructive malware operation found by Sentinel One targeting
| [Malicious PowerShell Process With Obfuscation Techniques](/endpoint/malicious_powershell_process_with_obfuscation_techniques/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
| [MSI Module Loaded by Non-System Binary](/endpoint/msi_module_loaded_by_non-system_binary/) | [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow)| Hunting |
| [Overwriting Accessibility Binaries](/endpoint/overwriting_accessibility_binaries/) | [Event Triggered Execution](/tags/#event-triggered-execution), [Accessibility Features](/tags/#accessibility-features)| TTP |
-| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell)| TTP |
+| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell), [MMC](/tags/#mmc)| TTP |
| [PowerShell 4104 Hunting](/endpoint/powershell_4104_hunting/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| Hunting |
| [PowerShell - Connect To Internet With Hidden Window](/endpoint/powershell_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting |
| [PowerShell Domain Enumeration](/endpoint/powershell_domain_enumeration/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
| [Powershell Enable SMB1Protocol Feature](/endpoint/powershell_enable_smb1protocol_feature/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools)| TTP |
-| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution)| TTP |
+| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [PowerShell](/tags/#powershell)| TTP |
| [Powershell Fileless Process Injection via GetProcAddress](/endpoint/powershell_fileless_process_injection_via_getprocaddress/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [PowerShell](/tags/#powershell)| TTP |
| [Powershell Fileless Script Contains Base64 Encoded Content](/endpoint/powershell_fileless_script_contains_base64_encoded_content/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [PowerShell](/tags/#powershell)| TTP |
| [PowerShell Loading DotNET into Memory via Reflection](/endpoint/powershell_loading_dotnet_into_memory_via_reflection/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
| [Powershell Processing Stream Of Data](/endpoint/powershell_processing_stream_of_data/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
| [Powershell Using memory As Backing Store](/endpoint/powershell_using_memory_as_backing_store/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP |
| [Recon AVProduct Through Pwh or WMI](/endpoint/recon_avproduct_through_pwh_or_wmi/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
-| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
+| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information), [PowerShell](/tags/#powershell)| TTP |
| [Registry Keys Used For Privilege Escalation](/endpoint/registry_keys_used_for_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Event Triggered Execution](/tags/#event-triggered-execution)| TTP |
| [Regsvr32 Silent and Install Param Dll Loading](/endpoint/regsvr32_silent_and_install_param_dll_loading/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly |
| [Runas Execution in CommandLine](/endpoint/runas_execution_in_commandline/) | [Access Token Manipulation](/tags/#access-token-manipulation), [Token Impersonation/Theft](/tags/#token-impersonation/theft)| Hunting |
diff --git a/docs/_stories/hidden_cobra_malware.md b/docs/_stories/hidden_cobra_malware.md
index 90eca71f14..3d81551f91 100644
--- a/docs/_stories/hidden_cobra_malware.md
+++ b/docs/_stories/hidden_cobra_malware.md
@@ -51,7 +51,7 @@ Among other searches in this Analytic Story is a detection search that looks for
#### Reference
* [https://web.archive.org/web/20191220004307/https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity](https://web.archive.org/web/20191220004307/https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity)
-* [https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf](https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf)
+* [https://web.archive.org/web/20220421112536/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf](https://web.archive.org/web/20220421112536/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf)
diff --git a/docs/_stories/industroyer2.md b/docs/_stories/industroyer2.md
index aebbdb8692..d14ba34e91 100644
--- a/docs/_stories/industroyer2.md
+++ b/docs/_stories/industroyer2.md
@@ -47,7 +47,7 @@ Industroyer2 is part of continuous attack to ukraine targeting energy facilities
| [Linux Shred Overwrite Command](/endpoint/linux_shred_overwrite_command/) | [Data Destruction](/tags/#data-destruction)| TTP |
| [Linux Stop Services](/endpoint/linux_stop_services/) | [Service Stop](/tags/#service-stop)| TTP |
| [Linux System Network Discovery](/endpoint/linux_system_network_discovery/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery)| Anomaly |
-| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
+| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information), [PowerShell](/tags/#powershell)| TTP |
| [Schtasks Run Task On Demand](/endpoint/schtasks_run_task_on_demand/) | [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP |
| [Suspicious Process File Path](/endpoint/suspicious_process_file_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process)| TTP |
| [Windows Hidden Schedule Task Settings](/endpoint/windows_hidden_schedule_task_settings/) | [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP |
diff --git a/docs/_stories/living_off_the_land.md b/docs/_stories/living_off_the_land.md
index c3278cd696..d9fd58ec4f 100644
--- a/docs/_stories/living_off_the_land.md
+++ b/docs/_stories/living_off_the_land.md
@@ -8,9 +8,11 @@ tags:
- Splunk Enterprise Security
- Splunk Cloud
- Endpoint
+ - Risk
- Actions on Objectives
- Exploitation
- Installation
+ - Reconnaissance
---
[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -20,7 +22,7 @@ tags:
Leverage analytics that allow you to identify the presence of an adversary leveraging native applications within your environment.
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Risk](https://docs.splunk.com/Documentation/CIM/latest/User/Risk)
- **Last Updated**: 2022-03-16
- **Author**: Lou Stella, Splunk
- **ID**: 6f7982e2-900b-11ec-a54a-acde48001122
@@ -64,9 +66,10 @@ Living Off The Land refers to an adversary methodology of using native applicati
| [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP |
| [Esentutl SAM Copy](/endpoint/esentutl_sam_copy/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping)| Hunting |
| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Living Off The Land](/endpoint/living_off_the_land/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Correlation |
| [MacOS LOLbin](/endpoint/macos_lolbin/) | [Unix Shell](/tags/#unix-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP |
| [MacOS plutil](/endpoint/macos_plutil/) | [Plist File Modification](/tags/#plist-file-modification)| TTP |
-| [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model)| TTP |
+| [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [MMC](/tags/#mmc)| TTP |
| [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP |
| [Ntdsutil Export NTDS](/endpoint/ntdsutil_export_ntds/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP |
| [Reg exe Manipulating Windows Services Registry Keys](/endpoint/reg_exe_manipulating_windows_services_registry_keys/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow)| TTP |
@@ -100,7 +103,9 @@ Living Off The Land refers to an adversary methodology of using native applicati
| [Suspicious Rundll32 dllregisterserver](/endpoint/suspicious_rundll32_dllregisterserver/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP |
| [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly |
| [Svchost LOLBAS Execution Process Spawn](/endpoint/svchost_lolbas_execution_process_spawn/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Scheduled Task](/tags/#scheduled-task)| TTP |
+| [Windows Binary Proxy Execution Mavinject DLL Injection](/endpoint/windows_binary_proxy_execution_mavinject_dll_injection/) | [Mavinject](/tags/#mavinject), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP |
| [Windows Diskshadow Proxy Execution](/endpoint/windows_diskshadow_proxy_execution/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP |
+| [Windows Identify Protocol Handlers](/endpoint/windows_identify_protocol_handlers/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting |
| [Windows Indirect Command Execution Via forfiles](/endpoint/windows_indirect_command_execution_via_forfiles/) | [Indirect Command Execution](/tags/#indirect-command-execution)| TTP |
| [Windows Indirect Command Execution Via pcalua](/endpoint/windows_indirect_command_execution_via_pcalua/) | [Indirect Command Execution](/tags/#indirect-command-execution)| TTP |
| [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP |
@@ -108,6 +113,10 @@ Living Off The Land refers to an adversary methodology of using native applicati
| [Windows InstallUtil Uninstall Option](/endpoint/windows_installutil_uninstall_option/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP |
| [Windows InstallUtil Uninstall Option with Network](/endpoint/windows_installutil_uninstall_option_with_network/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP |
| [Windows InstallUtil URL in Command Line](/endpoint/windows_installutil_url_in_command_line/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP |
+| [Windows MOF Event Triggered Execution via WMI](/endpoint/windows_mof_event_triggered_execution_via_wmi/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription)| TTP |
+| [Windows Odbcconf Hunting](/endpoint/windows_odbcconf_hunting/) | [Odbcconf](/tags/#odbcconf)| Hunting |
+| [Windows Odbcconf Load DLL](/endpoint/windows_odbcconf_load_dll/) | [Odbcconf](/tags/#odbcconf)| TTP |
+| [Windows Odbcconf Load Response File](/endpoint/windows_odbcconf_load_response_file/) | [Odbcconf](/tags/#odbcconf)| TTP |
| [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
#### Reference
diff --git a/docs/_stories/malicious_powershell.md b/docs/_stories/malicious_powershell.md
index 048722cb11..afa4018a1b 100644
--- a/docs/_stories/malicious_powershell.md
+++ b/docs/_stories/malicious_powershell.md
@@ -50,23 +50,26 @@ Most recently we have added new content related to PowerShell Script Block loggi
| [Any Powershell DownloadFile](/endpoint/any_powershell_downloadfile/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer)| TTP |
| [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer)| TTP |
| [Detect Empire with PowerShell Script Block Logging](/endpoint/detect_empire_with_powershell_script_block_logging/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
-| [Detect Mimikatz With PowerShell Script Block Logging](/endpoint/detect_mimikatz_with_powershell_script_block_logging/) | [OS Credential Dumping](/tags/#os-credential-dumping)| TTP |
+| [Detect Mimikatz With PowerShell Script Block Logging](/endpoint/detect_mimikatz_with_powershell_script_block_logging/) | [OS Credential Dumping](/tags/#os-credential-dumping), [PowerShell](/tags/#powershell)| TTP |
+| [GetLocalUser with PowerShell Script Block](/endpoint/getlocaluser_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account), [PowerShell](/tags/#powershell)| Hunting |
+| [GetWmiObject User Account with PowerShell Script Block](/endpoint/getwmiobject_user_account_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account), [PowerShell](/tags/#powershell)| Hunting |
| [Malicious PowerShell Process - Encoded Command](/endpoint/malicious_powershell_process_-_encoded_command/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information)| Hunting |
| [Malicious PowerShell Process With Obfuscation Techniques](/endpoint/malicious_powershell_process_with_obfuscation_techniques/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
-| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell)| TTP |
+| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell), [MMC](/tags/#mmc)| TTP |
| [PowerShell 4104 Hunting](/endpoint/powershell_4104_hunting/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| Hunting |
| [PowerShell - Connect To Internet With Hidden Window](/endpoint/powershell_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting |
-| [Powershell Creating Thread Mutex](/endpoint/powershell_creating_thread_mutex/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools)| TTP |
+| [Powershell Creating Thread Mutex](/endpoint/powershell_creating_thread_mutex/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [PowerShell](/tags/#powershell)| TTP |
| [PowerShell Domain Enumeration](/endpoint/powershell_domain_enumeration/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
| [Powershell Enable SMB1Protocol Feature](/endpoint/powershell_enable_smb1protocol_feature/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools)| TTP |
-| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution)| TTP |
+| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [PowerShell](/tags/#powershell)| TTP |
| [Powershell Fileless Process Injection via GetProcAddress](/endpoint/powershell_fileless_process_injection_via_getprocaddress/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [PowerShell](/tags/#powershell)| TTP |
| [Powershell Fileless Script Contains Base64 Encoded Content](/endpoint/powershell_fileless_script_contains_base64_encoded_content/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [PowerShell](/tags/#powershell)| TTP |
| [PowerShell Loading DotNET into Memory via Reflection](/endpoint/powershell_loading_dotnet_into_memory_via_reflection/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
| [Powershell Processing Stream Of Data](/endpoint/powershell_processing_stream_of_data/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
| [Powershell Using memory As Backing Store](/endpoint/powershell_using_memory_as_backing_store/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP |
| [Recon AVProduct Through Pwh or WMI](/endpoint/recon_avproduct_through_pwh_or_wmi/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
-| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
+| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information), [PowerShell](/tags/#powershell)| TTP |
+| [ServicePrincipalNames Discovery with PowerShell](/endpoint/serviceprincipalnames_discovery_with_powershell/) | [Kerberoasting](/tags/#kerberoasting)| TTP |
| [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
| [Unloading AMSI via Reflection](/endpoint/unloading_amsi_via_reflection/) | [Impair Defenses](/tags/#impair-defenses), [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP |
| [WMI Recon Running Process Or Services](/endpoint/wmi_recon_running_process_or_services/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
diff --git a/docs/_stories/ransomware.md b/docs/_stories/ransomware.md
index e6626f3fa5..ece4ff2fdd 100644
--- a/docs/_stories/ransomware.md
+++ b/docs/_stories/ransomware.md
@@ -70,7 +70,7 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e
| [Permission Modification using Takeown App](/endpoint/permission_modification_using_takeown_app/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification)| TTP |
| [Powershell Disable Security Monitoring](/endpoint/powershell_disable_security_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
| [Powershell Enable SMB1Protocol Feature](/endpoint/powershell_enable_smb1protocol_feature/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools)| TTP |
-| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution)| TTP |
+| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [PowerShell](/tags/#powershell)| TTP |
| [Prevent Automatic Repair Mode using Bcdedit](/endpoint/prevent_automatic_repair_mode_using_bcdedit/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery)| TTP |
| [Recon AVProduct Through Pwh or WMI](/endpoint/recon_avproduct_through_pwh_or_wmi/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
| [Recursive Delete of Directory In Batch CMD](/endpoint/recursive_delete_of_directory_in_batch_cmd/) | [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host)| TTP |
diff --git a/docs/_stories/splunk_vulnerabilities.md b/docs/_stories/splunk_vulnerabilities.md
index 112db56d1a..91fc04e7cb 100644
--- a/docs/_stories/splunk_vulnerabilities.md
+++ b/docs/_stories/splunk_vulnerabilities.md
@@ -34,6 +34,7 @@ This analytic story includes detections that focus on attacker behavior targeted
| Name | Technique | Type |
| ----------- | ----------- |--------------|
+| [Detect Risky SPL using Pretrained ML Model](/application/detect_risky_spl_using_pretrained_ml_model/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Anomaly |
| [Path traversal SPL injection](/application/path_traversal_spl_injection/) | [File and Directory Discovery](/tags/#file-and-directory-discovery)| TTP |
| [Splunk Command and Scripting Interpreter Delete Usage](/application/splunk_command_and_scripting_interpreter_delete_usage/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Anomaly |
| [Splunk Command and Scripting Interpreter Risky Commands](/application/splunk_command_and_scripting_interpreter_risky_commands/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting |
diff --git a/docs/_stories/windows_defense_evasion_tactics.md b/docs/_stories/windows_defense_evasion_tactics.md
index c9cdd4b3f0..8abb5678a2 100644
--- a/docs/_stories/windows_defense_evasion_tactics.md
+++ b/docs/_stories/windows_defense_evasion_tactics.md
@@ -64,7 +64,7 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve
| [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
| [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
| [Suspicious Reg exe Process](/endpoint/suspicious_reg_exe_process/) | [Modify Registry](/tags/#modify-registry)| TTP |
-| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [MMC](/tags/#mmc)| TTP |
| [Windows Command and Scripting Interpreter Hunting Path Traversal](/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting |
| [Windows Command and Scripting Interpreter Path Traversal Exec](/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP |
| [Windows Defender Exclusion Registry Entry](/endpoint/windows_defender_exclusion_registry_entry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json
index cf6253f311..3ae393b8e1 100644
--- a/docs/mitre-map/coverage.json
+++ b/docs/mitre-map/coverage.json
@@ -4,16 +4,16 @@
"description": "security_content detection coverage",
"domain": "mitre-enterprise",
"techniques": [
+ {
+ "techniqueID": "T1059",
+ "score": 46,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/detect_risky_spl_using_pretrained_ml_model.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/living_off_the_land.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_writing_dynamicwrapperx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_identify_protocol_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml"
+ },
{
"techniqueID": "T1083",
"score": 1,
"comment": "https://github.com/splunk/security_content/blob/develop/detections/application/path_traversal_spl_injection.yml"
},
- {
- "techniqueID": "T1059",
- "score": 43,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_writing_dynamicwrapperx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml"
- },
{
"techniqueID": "T1587.003",
"score": 2,
@@ -116,8 +116,8 @@
},
{
"techniqueID": "T1562",
- "score": 53,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_iptables_firewall_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_registry_delete_task_sd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml"
+ "score": 55,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_iptables_firewall_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_registry_delete_task_sd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml"
},
{
"techniqueID": "T1554",
@@ -241,19 +241,14 @@
},
{
"techniqueID": "T1059.001",
- "score": 20,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_powershell_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml"
+ "score": 28,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_powershell_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_import_applocker_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml"
},
{
"techniqueID": "T1059.003",
"score": 8,
"comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_started_forcefully.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/potentially_malicious_code_on_commandline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
},
- {
- "techniqueID": "T1525",
- "score": 2,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/new_container_uploaded_to_aws_ecr.yml"
- },
{
"techniqueID": "T1078.002",
"score": 5,
@@ -281,8 +276,8 @@
},
{
"techniqueID": "T1218",
- "score": 54,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_diskshadow_proxy_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
+ "score": 55,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_diskshadow_proxy_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
},
{
"techniqueID": "T1036",
@@ -346,18 +341,18 @@
},
{
"techniqueID": "T1562.001",
- "score": 42,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml"
+ "score": 44,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml"
},
{
"techniqueID": "T1021.001",
- "score": 5,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_traffic.yml"
+ "score": 9,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_services_allow_remote_assistance.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_services_rdp_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_traffic.yml"
},
{
"techniqueID": "T1021",
- "score": 20,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executable_file_written_in_administrative_smb_share.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mmc_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/smb_traffic_spike___mltk.yml"
+ "score": 24,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executable_file_written_in_administrative_smb_share.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mmc_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_services_allow_remote_assistance.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_services_rdp_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/smb_traffic_spike___mltk.yml"
},
{
"techniqueID": "T1548",
@@ -366,8 +361,8 @@
},
{
"techniqueID": "T1105",
- "score": 12,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/curl_download_and_bash_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wget_download_and_bash_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_curl_download_to_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_curl_upload_to_remote_destination.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_curl_network_connection.yml"
+ "score": 13,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/curl_download_and_bash_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/living_off_the_land.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wget_download_and_bash_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_curl_download_to_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_curl_upload_to_remote_destination.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_curl_network_connection.yml"
},
{
"techniqueID": "T1036.005",
@@ -536,8 +531,8 @@
},
{
"techniqueID": "T1190",
- "score": 26,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hunting_for_log4shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_class_file_download_by_java_user_agent.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_writing_jsp_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_java_spawning_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_java_spawning_shells.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winrm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_zerologon_via_zeek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/sql_injection_with_long_urls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/spring4shell_payload_url_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_server_side_template_injection_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_jsp_request_via_url.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring4shell_http_request_class_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring_cloud_function_functionrouter.yml"
+ "score": 27,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hunting_for_log4shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_class_file_download_by_java_user_agent.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_writing_jsp_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_java_spawning_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/living_off_the_land.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_java_spawning_shells.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winrm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_zerologon_via_zeek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/sql_injection_with_long_urls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/spring4shell_payload_url_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_server_side_template_injection_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_jsp_request_via_url.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring4shell_http_request_class_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring_cloud_function_functionrouter.yml"
},
{
"techniqueID": "T1218.001",
@@ -596,8 +591,8 @@
},
{
"techniqueID": "T1546.003",
- "score": 2,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml"
+ "score": 3,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml"
},
{
"techniqueID": "T1070.001",
@@ -606,8 +601,8 @@
},
{
"techniqueID": "T1112",
- "score": 17,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_security_logs_using_minint_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_inprocserver32_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_client_registry_install_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_shimcache_flush.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_change_password_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_logoff_button_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_notification_center.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_shutdown_button_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_hide_notification_features_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml"
+ "score": 24,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_security_logs_using_minint_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_inprocserver32_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_client_registry_install_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_shimcache_flush.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_change_password_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_logoff_button_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_notification_center.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_shutdown_button_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_hide_notification_features_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disallow_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml"
},
{
"techniqueID": "T1564",
@@ -646,8 +641,8 @@
},
{
"techniqueID": "T1489",
- "score": 6,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stop_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+ "score": 8,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stop_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_stop_by_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_valid_account_with_never_expires_password.yml"
},
{
"techniqueID": "T1222",
@@ -819,6 +814,11 @@
"score": 3,
"comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rubeus_command_line_parameters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml"
},
+ {
+ "techniqueID": "T1218.014",
+ "score": 3,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mmc_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml"
+ },
{
"techniqueID": "T1491",
"score": 1,
@@ -981,13 +981,23 @@
},
{
"techniqueID": "T1590",
- "score": 1,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml"
+ "score": 2,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml"
},
{
"techniqueID": "T1590.005",
+ "score": 2,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml"
+ },
+ {
+ "techniqueID": "T1071",
+ "score": 5,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_smb_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/excessive_dns_failures.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/tor_traffic.yml"
+ },
+ {
+ "techniqueID": "T1218.013",
"score": 1,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml"
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml"
},
{
"techniqueID": "T1218.004",
@@ -1014,6 +1024,11 @@
"score": 2,
"comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_nirsoft_advancedrun.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_nirsoft_utilities.yml"
},
+ {
+ "techniqueID": "T1218.008",
+ "score": 3,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_odbcconf_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_odbcconf_load_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_odbcconf_load_response_file.yml"
+ },
{
"techniqueID": "T1561.002",
"score": 2,
@@ -1024,6 +1039,11 @@
"score": 2,
"comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml"
},
+ {
+ "techniqueID": "T1219",
+ "score": 1,
+ "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_access_software_rms_registry.yml"
+ },
{
"techniqueID": "T1220",
"score": 2,
@@ -1094,11 +1114,6 @@
"score": 1,
"comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_smb_traffic.yml"
},
- {
- "techniqueID": "T1071",
- "score": 4,
- "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_smb_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/excessive_dns_failures.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/tor_traffic.yml"
- },
{
"techniqueID": "T1041",
"score": 1,
@@ -1137,7 +1152,7 @@
"#096ed7"
],
"minValue": 0,
- "maxValue": 54
+ "maxValue": 55
},
"filters": {
"platforms": [
diff --git a/stories/container_implantation_monitoring_and_investigation.yml b/stories/deprecated/container_implantation_monitoring_and_investigation.yml
similarity index 100%
rename from stories/container_implantation_monitoring_and_investigation.yml
rename to stories/deprecated/container_implantation_monitoring_and_investigation.yml