From 7f80da5894e87ecf97bea7ae97a1c53958f53d48 Mon Sep 17 00:00:00 2001
From: research bot <research@splunk.com>
Date: Tue, 19 Jul 2022 21:35:47 +0000
Subject: [PATCH 1/2] updating docs and package bits [ci skip]

---
 dist/escu/app.manifest                        |    2 +-
 dist/escu/default/analyticstories.conf        | 2171 +++++-----
 dist/escu/default/app.conf                    |    4 +-
 dist/escu/default/collections.conf            |    2 +-
 dist/escu/default/content-version.conf        |    2 +-
 dist/escu/default/es_investigations.conf      |    2 +-
 dist/escu/default/macros.conf                 |  118 +-
 dist/escu/default/savedsearches.conf          | 3736 +++++++++++------
 dist/escu/default/transforms.conf             |   17 +-
 dist/escu/default/workflow_actions.conf       |    2 +-
 ..._mlspl_risky_spl_pre_trained_model.mlmodel |    2 +
 dist/escu/lookups/security_services.csv       |    2 +-
 .../lookups/windows_protocol_handlers.csv     |  205 +
 ...ws_defender_tools_in_non_standard_path.yml |   57 +
 ...ows_lolbin_binary_in_non_standard_path.yml |   35 +-
 docs/_pages/detections.md                     |   49 +-
 docs/_pages/stories.md                        |   21 +-
 ...spectre_and_meltdown_vulnerable_systems.md |    2 +-
 ...12-detect_new_login_attempts_to_routers.md |    2 +-
 ...od_without_successful_netbackup_backups.md |    2 +-
 ...17-09-12-unsuccessful_netbackup_backups.md |    2 +-
 ...9-15-no_windows_updates_in_a_time_frame.md |    2 +-
 ...9-email_attachments_with_lots_of_spaces.md |    2 +-
 ...s_scanning_for_vulnerable_jboss_servers.md |    2 +-
 ...cious_requests_to_exploit_jboss_servers.md |    2 +-
 .../2017-09-23-monitor_dns_for_brand_abuse.md |    2 +-
 ...-23-monitor_web_traffic_for_brand_abuse.md |    2 +-
 .../2017-11-27-detect_usb_device_insertion.md |    2 +-
 ...018-01-05-monitor_email_for_brand_abuse.md |    2 +-
 ...nce_started_in_previously_unseen_region.md |    2 +-
 ...ance_started_with_previously_unseen_ami.md |    2 +-
 ...16-detect_new_api_calls_from_user_roles.md |    2 +-
 ...detect_spike_in_security_group_activity.md |    2 +-
 ...ect_api_activity_from_users_without_mfa.md |    2 +-
 ...6-01-detect_large_outbound_icmp_packets.md |    2 +-
 ...18-06-28-detect_s3_access_from_a_new_ip.md |    2 +-
 ...-10-23-wmi_permanent_event_subscription.md |    2 +-
 ...-10-23-wmi_temporary_event_subscription.md |    2 +-
 ...8-11-02-windows_hosts_file_modification.md |    2 +-
 .../2018-12-03-remote_wmi_command_attempt.md  |    2 +-
 .../_posts/2018-12-03-usn_journal_deletion.md |    2 +-
 .../2018-12-14-file_with_samsam_extension.md  |    2 +-
 .../2018-12-14-samsam_test_file_write.md      |    2 +-
 ...ikatz_via_powershell_and_eventcode_4703.md |    2 +-
 ...ide_files_directories_via_registry_keys.md |    2 +-
 ..._servers_executing_suspicious_processes.md |    2 +-
 .../2019-04-25-suspicious_file_write.md       |    2 +-
 ...5-08-unusually_long_command_line_-_mltk.md |    2 +-
 ...9-10-11-prohibited_software_on_endpoint.md |    2 +-
 ...credential_dumping_through_lsass_access.md |    2 +-
 ...-03-detect_mimikatz_using_loaded_images.md |    2 +-
 ...6-access_lsass_memory_for_dump_creation.md |    2 +-
 ...9-12-06-create_remote_thread_into_lsass.md |    2 +-
 ...19-12-06-unsigned_image_loaded_by_lsass.md |    2 +-
 .../2019-12-10-creation_of_shadow_copy.md     |    2 +-
 ...-01-22-dns_query_length_outliers_-_mltk.md |    2 +-
 ...-03-creation_of_lsass_dump_with_taskmgr.md |    2 +-
 ...ed_with_previously_unseen_instance_type.md |    2 +-
 ...20-02-07-macos_-_re-opened_applications.md |    2 +-
 .../2020-02-21-dump_lsass_via_comsvcs_dll.md  |    2 +-
 ...03-02-remote_registry_key_modifications.md |    2 +-
 ...20-03-16-child_processes_of_spoolsv_exe.md |    2 +-
 .../2020-03-16-detect_rare_executables.md     |    2 +-
 .../2020-03-16-process_execution_via_wmi.md   |    2 +-
 .../2020-03-16-script_execution_via_wmi.md    |    2 +-
 ...n_eks_kubernetes_cluster_scan_detection.md |    2 +-
 ...mazon_eks_kubernetes_pod_scan_detection.md |    2 +-
 ...0-first_time_seen_child_process_of_zoom.md |    2 +-
 ...interception_by_creation_of_program_exe.md |    2 +-
 ...2020-07-06-short_lived_windows_accounts.md |    2 +-
 .../2020-07-06-windows_event_log_cleared.md   |    2 +-
 ...20-07-07-remote_desktop_network_traffic.md |    2 +-
 ...20-07-08-detect_new_local_admin_account.md |    2 +-
 ...-07-21-attempt_to_stop_security_service.md |    3 +-
 ...api_activities_from_unapproved_accounts.md |    2 +-
 ..._to_phishing_sites_leveraging_evilginx2.md |    6 +-
 ...-detect_excessive_user_account_lockouts.md |    2 +-
 ...-21-detect_long_dns_txt_record_response.md |    2 +-
 ...07-21-detect_new_user_aws_console_login.md |    2 +-
 .../2020-07-21-detect_outbound_smb_traffic.md |    2 +-
 ...1-detect_outlook_exe_writing_a_zip_file.md |    2 +-
 ...f_cmd_exe_to_launch_script_interpreters.md |    3 +-
 ...web_traffic_to_dynamic_domain_providers.md |    2 +-
 ...-21-detection_of_tools_built_by_nirsoft.md |    2 +-
 ...ce_modified_with_previously_unseen_user.md |    2 +-
 ...nce_started_with_previously_unseen_user.md |    2 +-
 ...ritten_outside_of_the_outlook_directory.md |    2 +-
 ...1-first_time_seen_command_line_argument.md |    2 +-
 ...g_files_and_directories_with_attrib_exe.md |    3 +-
 ...shell_process_-_execution_policy_bypass.md |    2 +-
 ...7-21-overwriting_accessibility_binaries.md |    2 +-
 ...7-21-prohibited_network_traffic_allowed.md |    2 +-
 .../2020-07-21-protocol_or_port_mismatch.md   |    2 +-
 ...emote_desktop_process_running_on_system.md |    2 +-
 ...21-sc_exe_manipulating_windows_services.md |    3 +-
 ...uled_tasks_used_in_badrabbit_ransomware.md |    2 +-
 ...suspicious_changes_to_file_associations.md |    2 +-
 ...20-07-22-suspicious_email_-_uba_anomaly.md |    2 +-
 ...-suspicious_email_attachment_extensions.md |    2 +-
 .../2020-07-22-suspicious_reg_exe_process.md  |    2 +-
 ...ous_writes_to_system_volume_information.md |    2 +-
 docs/_posts/2020-07-22-tor_traffic.md         |    2 +-
 ...20-07-22-uncommon_processes_on_endpoint.md |    4 +-
 ...ct_windows_dns_sigred_via_splunk_stream.md |    2 +-
 ...ance_modified_by_previously_unseen_user.md |    2 +-
 ...oud_network_access_control_list_deleted.md |    2 +-
 ..._or_delete_windows_shares_using_net_exe.md |    2 +-
 ...tivity_related_to_pass_the_hash_attacks.md |    2 +-
 ...ect_software_download_to_network_device.md |    2 +-
 .../2020-11-06-ryuk_test_files_detected.md    |    2 +-
 ...windows_connhost_exe_started_forcefully.md |    2 +-
 ...indows_security_account_manager_stopped.md |    2 +-
 ...2020-11-09-common_ransomware_extensions.md |    2 +-
 .../2020-11-09-common_ransomware_notes.md     |    2 +-
 .../2020-11-09-deleting_shadow_copies.md      |    2 +-
 ...xcessive_account_lockouts_from_endpoint.md |    2 +-
 ..._system_network_configuration_discovery.md |    4 +-
 ...rohibited_applications_spawning_cmd_exe.md |    2 +-
 ...8-disabling_remote_user_account_control.md |    1 +
 ...cution_of_file_with_multiple_extensions.md |    2 +-
 ...on_of_file_with_spaces_before_extension.md |    2 +-
 .../2020-11-23-processes_created_by_netsh.md  |    2 +-
 ...installation_with_suspicious_parameters.md |    2 +-
 ...pulating_windows_services_registry_keys.md |    2 +-
 ...2-07-schtasks_used_for_forcing_a_reboot.md |    2 +-
 .../2020-12-08-shim_database_file_creation.md |    2 +-
 ...12-08-single_letter_process_on_endpoint.md |    2 +-
 ...processes_run_from_unexpected_locations.md |    2 +-
 .../2020-12-08-unusually_long_command_line.md |    2 +-
 ...burst_correlation_dll_and_network_event.md |    2 +-
 ...1-bcdedit_failure_recovery_modification.md |    2 +-
 ...ng_keys_with_encrypt_policy_without_mfa.md |    2 +-
 ..._with_kms_keys_performing_encryption_s3.md |    2 +-
 ...ontrol_list_created_with_all_open_ports.md |    2 +-
 ...aws_network_access_control_list_deleted.md |    2 +-
 ...cious_microsoft_workflow_compiler_usage.md |    2 +-
 .../2021-01-12-suspicious_msbuild_spawn.md    |    2 +-
 ...21-01-12-suspicious_mshta_child_process.md |    2 +-
 ..._connecting_to_dynamic_domain_providers.md |    2 +-
 ...ell_process_with_obfuscation_techniques.md |    2 +-
 ...cious_powershell_command-line_arguments.md |    2 +-
 ...20-detect_rundll32_inline_hta_execution.md |    2 +-
 .../2021-01-20-suspicious_mshta_spawn.md      |    2 +-
 ...021-01-22-wbadmin_delete_system_backups.md |    2 +-
 ...l_access_by_provider_user_and_principal.md |    2 +-
 ...01-26-aws_saml_update_identity_provider.md |    2 +-
 ...ect_regsvr32_application_control_bypass.md |    4 +-
 .../_posts/2021-01-28-ntdsutil_export_ntds.md |    2 +-
 ...cious_regsvr32_register_suspicious_path.md |    4 +-
 ...21-02-01-dump_lsass_via_procdump_rename.md |    2 +-
 ...32_application_control_bypass_-_advpack.md |    2 +-
 ...2_application_control_bypass_-_setupapi.md |    2 +-
 ...2_application_control_bypass_-_syssetup.md |    2 +-
 .../2021-02-04-suspicious_rundll32_startw.md  |    2 +-
 ...9-suspicious_rundll32_dllregisterserver.md |    2 +-
 ...11-detect_html_help_spawn_child_process.md |    2 +-
 ...-02-12-detect_regasm_spawning_a_process.md |    2 +-
 ...02-12-detect_regsvcs_spawning_a_process.md |    2 +-
 ...2-22-suspicious_curl_network_connection.md |    2 +-
 .../2021-02-22-suspicious_plistbuddy_usage.md |    2 +-
 ...uspicious_sqlite3_lsquarantine_behavior.md |    2 +-
 .../_posts/2021-03-01-fodhelper_uac_bypass.md |    2 +-
 .../2021-03-01-ryuk_wake_on_lan_command.md    |    2 +-
 ...us_scheduled_task_from_public_directory.md |    3 +-
 .../2021-03-02-aws_setdefaultpolicyversion.md |    2 +-
 ...ed_messaging_service_spawning_a_process.md |    2 +-
 ...-02-windows_disableantispyware_registry.md |    3 +-
 ...2021-03-03-nishang_powershelltcponeline.md |    2 +-
 docs/_posts/2021-03-03-w3wp_spawning_shell.md |    4 +-
 ...21-03-12-ransomware_notes_bulk_creation.md |    2 +-
 .../2021-03-12-resize_shadowstorage_volume.md |    2 +-
 ...3-16-high_process_termination_frequency.md |    2 +-
 ...16-windows_high_file_deletion_frequency.md |    2 +-
 .../2021-03-17-clop_common_exec_parameter.md  |    2 +-
 ...021-03-23-certutil_with_decode_argument.md |    2 +-
 ...021-03-29-powershell_start-bitstransfer.md |    2 +-
 ...03-31-aws_iam_successful_group_deletion.md |    2 +-
 ...021-03-31-disabling_firewall_with_netsh.md |    2 +-
 .../2021-03-31-dsquery_domain_discovery.md    |    2 +-
 ...-aws_iam_assume_role_policy_brute_force.md |    2 +-
 .../2021-04-01-aws_iam_delete_policy.md       |    2 +-
 ...21-04-01-aws_iam_failure_group_deletion.md |    2 +-
 ...heduled_task_created_within_public_path.md |    2 +-
 .../2021-04-12-excel_spawning_powershell.md   |    2 +-
 ...4-12-excel_spawning_windows_script_host.md |    2 +-
 ...t_scheduled_task_created_to_spawn_shell.md |    2 +-
 .../2021-04-12-winword_spawning_powershell.md |    2 +-
 ...12-winword_spawning_windows_script_host.md |    2 +-
 ...1-04-13-aws_excessive_security_scanning.md |    2 +-
 ...fice_application_spawn_rundll32_process.md |    2 +-
 ...-office_document_creating_schedule_task.md |    2 +-
 ...14-office_document_executing_macro_code.md |    2 +-
 ...-15-dns_exfiltration_using_nslookup_app.md |    2 +-
 ..._remote_thread_to_known_windows_process.md |    2 +-
 ...hedule_task_with_http_command_arguments.md |    2 +-
 ...dule_task_with_rundll32_command_trigger.md |    2 +-
 ...9-wermgr_process_create_executable_file.md |    2 +-
 ...ocess_spawned_cmd_or_powershell_process.md |    4 +-
 .../2021-04-22-anomalous_usage_of_7zip.md     |    2 +-
 ...e_product_spawning_rundll32_with_no_dll.md |    2 +-
 .../_posts/2021-04-22-winword_spawning_cmd.md |    2 +-
 ...04-26-office_product_spawning_bitsadmin.md |    2 +-
 ...-04-26-office_product_spawning_certutil.md |    2 +-
 ...021-04-26-office_product_spawning_mshta.md |    2 +-
 docs/_posts/2021-04-26-trickbot_named_pipe.md |    2 +-
 docs/_posts/2021-04-29-icacls_deny_command.md |    3 +-
 ...021-04-29-suspicious_driver_loaded_path.md |    2 +-
 docs/_posts/2021-04-29-xmrig_driver_loaded.md |    2 +-
 .../2021-05-04-deleting_of_net_users.md       |    2 +-
 .../2021-05-04-disabling_net_user_account.md  |    2 +-
 ...4-excessive_attempt_to_disable_services.md |    5 +-
 ...21-05-04-excessive_service_stop_attempt.md |    2 +-
 .../2021-05-04-excessive_usage_of_taskkill.md |    3 +-
 .../_posts/2021-05-04-icacls_grant_command.md |    2 +-
 ...21-05-04-process_kill_base_on_file_path.md |    2 +-
 ...2021-05-05-suspicious_process_file_path.md |    2 +-
 ...021-05-06-download_files_using_telegram.md |    2 +-
 ...merate_users_local_group_using_telegram.md |    2 +-
 .../2021-05-06-excessive_usage_of_net_app.md  |    3 +-
 ...s_or_script_creation_in_suspicious_path.md |    3 +-
 ...2021-05-07-excessive_usage_of_cacls_app.md |    3 +-
 .../2021-05-07-schtasks_run_task_on_demand.md |    2 +-
 ...2021-05-13-cmlua_or_cmstplua_uac_bypass.md |    2 +-
 docs/_posts/2021-05-13-slui_runas_elevated.md |    2 +-
 .../2021-05-13-slui_spawning_a_process.md     |    2 +-
 .../2021-05-18-services_escalate_exe.md       |    2 +-
 .../2021-05-20-cmd_echo_pipe_-_escalation.md  |    2 +-
 .../2021-05-21-winrm_spawning_a_process.md    |    2 +-
 ...6-secretdumps_offline_ntds_dumping_tool.md |    2 +-
 ...27-detect_sharphound_file_modifications.md |    2 +-
 .../2021-05-27-detect_sharphound_usage.md     |    2 +-
 ...etect_azurehound_command-line_arguments.md |    2 +-
 ...01-detect_azurehound_file_modifications.md |    2 +-
 ...etect_sharphound_command-line_arguments.md |    2 +-
 .../2021-06-02-conti_common_exec_parameter.md |    2 +-
 .../2021-06-02-modification_of_wallpaper.md   |    2 +-
 .../2021-06-02-revil_common_exec_parameter.md |    2 +-
 ...021-06-02-wbemprox_com_object_execution.md |    2 +-
 ...-excessive_number_of_taskhost_processes.md |    2 +-
 ...021-06-09-unloading_amsi_via_reflection.md |   10 +-
 ...ear_unallocated_sector_using_cipher_app.md |    2 +-
 .../2021-06-10-disable_logs_using_wevtutil.md |    2 +-
 ...rmission_modification_using_takeown_app.md |    2 +-
 ...ent_automatic_repair_mode_using_bcdedit.md |    2 +-
 ...tect_wmi_event_subscription_persistence.md |    2 +-
 ...7-suspicious_event_log_service_behavior.md |    2 +-
 ...ecute_javascript_with_jscript_com_clsid.md |    2 +-
 ...ursive_delete_of_directory_in_batch_cmd.md |    2 +-
 ...w_file_and_printing_sharing_in_firewall.md |    2 +-
 ...-23-allow_network_discovery_in_firewall.md |    2 +-
 ...4-excessive_usage_of_sc_service_utility.md |    3 +-
 ...er_of_service_control_start_as_disabled.md |    2 +-
 .../2021-07-01-spoolsv_spawning_rundll32.md   |    2 +-
 ...07-01-spoolsv_suspicious_loaded_modules.md |    2 +-
 ...07-01-spoolsv_suspicious_process_access.md |    2 +-
 ...21-07-01-spoolsv_writing_a_dll_-_sysmon.md |    2 +-
 ...05-msmpeng_application_dll_side_loading.md |    2 +-
 ...-07-12-uac_bypass_mmc_load_unsigned_dll.md |    7 +-
 ...tance_created_by_previously_unseen_user.md |    2 +-
 .../2021-07-19-aws_createloginprofile.md      |    2 +-
 .../2021-07-19-detect_new_open_s3_buckets.md  |    2 +-
 ...detect_new_open_s3_buckets_over_aws_cli.md |    2 +-
 ...a_spawning_rundll32_or_regsvr32_process.md |    2 +-
 ...-07-19-office_product_spawn_cmd_process.md |    2 +-
 ...-rundll32_createremotethread_in_browser.md |    2 +-
 ...rundll32_process_creating_exe_dll_files.md |    2 +-
 ...7-26-suspicious_icedid_rundll32_cmdline.md |    2 +-
 ...21-07-26-suspicious_rundll32_plugininit.md |    2 +-
 .../2021-07-27-chcp_command_execution.md      |    3 +-
 ...gsvr32_with_known_silent_switch_cmdline.md |    4 +-
 ...dll32_create_remote_thread_to_a_process.md |    2 +-
 .../2021-07-30-drop_icedid_license_dat.md     |    2 +-
 ...edid_exfiltrated_archived_file_creation.md |    2 +-
 ...fice_application_spawn_regsvr32_process.md |    4 +-
 ...2021-08-03-sqlite_module_in_temp_folder.md |    2 +-
 ...eate_remote_thread_in_shell_application.md |    2 +-
 .../2021-08-09-rundll32_lockworkstation.md    |    2 +-
 .../2021-08-09-uninstall_app_using_msiexec.md |    2 +-
 docs/_posts/2021-08-11-fsutil_zeroing_file.md |    2 +-
 ...8-13-uac_bypass_with_colorui_com_object.md |    2 +-
 ...16-gsuite_drive_share_in_external_email.md |    2 +-
 ...8-16-gsuite_email_suspicious_attachment.md |    2 +-
 ...8-17-7zip_commandline_to_smb_share_path.md |    2 +-
 ...ning_findings_low_informational_unknown.md |    2 +-
 ..._ecr_container_scanning_findings_medium.md |    2 +-
 ...mail_with_attachment_to_external_domain.md |    2 +-
 docs/_posts/2021-08-18-esentutl_sam_copy.md   |    4 +-
 ...container_upload_outside_business_hours.md |    2 +-
 ...9-aws_ecr_container_upload_unknown_user.md |    2 +-
 ...mail_suspicious_subject_with_attachment.md |    2 +-
 ...ols_passing_authentication_in_cleartext.md |    2 +-
 ...1-08-20-github_commit_changes_in_master.md |    2 +-
 ...2021-08-23-getlocaluser_with_powershell.md |    2 +-
 ...twmiobject_user_account_with_powershell.md |    2 +-
 ...email_with_known_abuse_web_service_link.md |    2 +-
 ...8-23-gsuite_suspicious_shared_file_name.md |    2 +-
 ...4-domain_account_discovery_with_dsquery.md |    2 +-
 ...4-domain_account_discovery_with_net_app.md |    2 +-
 ...8-24-domain_account_discovery_with_wmic.md |    2 +-
 ...1-08-24-get-domaintrust_with_powershell.md |    2 +-
 .../2021-08-24-get_aduser_with_powershell.md  |    2 +-
 ...21-08-24-get_domainuser_with_powershell.md |    2 +-
 ...24-getwmiobject_ds_user_with_powershell.md |    2 +-
 ...1-08-25-domain_group_discovery_with_net.md |    2 +-
 ...-08-25-domain_group_discovery_with_wmic.md |    2 +-
 ...08-25-elevated_group_discovery_with_net.md |    2 +-
 ...8-25-elevated_group_discovery_with_wmic.md |    2 +-
 .../2021-08-25-getadgroup_with_powershell.md  |    2 +-
 ...21-08-25-getdomaingroup_with_powershell.md |    2 +-
 ...-25-getnettcpconnection_with_powershell.md |    2 +-
 ...5-getwmiobject_ds_group_with_powershell.md |    2 +-
 ...ultdomainpasswordpolicy_with_powershell.md |    2 +-
 ...resultantpasswordpolicy_with_powershell.md |    2 +-
 ...-08-26-get_domainpolicy_with_powershell.md |    2 +-
 ...8-26-password_policy_discovery_with_net.md |    2 +-
 ...reating_lnk_file_in_suspicious_location.md |    2 +-
 ...8-27-exchange_powershell_abuse_via_ssrf.md |    2 +-
 ...domain_controller_discovery_with_nltest.md |    2 +-
 ...-08-30-remote_system_discovery_with_net.md |    2 +-
 ...petitpotam_network_share_access_request.md |    2 +-
 ...itpotam_suspicious_kerberos_tgt_request.md |    2 +-
 ...31-remote_system_discovery_with_dsquery.md |    2 +-
 ...1-domain_controller_discovery_with_wmic.md |    2 +-
 ...-01-domain_group_discovery_with_dsquery.md |    2 +-
 .../2021-09-01-github_commit_in_develop.md    |    2 +-
 .../2021-09-01-github_dependabot_alert.md     |    2 +-
 ...1-github_pull_request_from_unknown_user.md |    2 +-
 ...09-01-remote_system_discovery_with_wmic.md |    2 +-
 ...1-09-02-get-foresttrust_with_powershell.md |    2 +-
 ...cdedit_command_back_to_normal_mode_boot.md |    2 +-
 ...change_to_safe_mode_with_network_config.md |    2 +-
 ...021-09-07-getadcomputer_with_powershell.md |    2 +-
 ...09-07-getdomaincomputer_with_powershell.md |    2 +-
 ...-07-getdomaincontroller_with_powershell.md |    2 +-
 ...etwmiobject_ds_computer_with_powershell.md |    2 +-
 ...e_by_app_connect_and_create_adsi_object.md |    2 +-
 ...-system_information_discovery_detection.md |    2 +-
 ...l_loading_from_world_writable_directory.md |    2 +-
 ...eate_local_admin_accounts_using_net_exe.md |    3 +-
 .../2021-09-08-office_spawning_control.md     |    2 +-
 ...2021-09-08-rundll32_control_rundll_hunt.md |    2 +-
 ...control_rundll_world_writable_directory.md |    2 +-
 ...2021-09-09-extraction_of_registry_hives.md |    2 +-
 ...0-network_connection_discovery_with_arp.md |    2 +-
 ...0-network_connection_discovery_with_net.md |    3 +-
 ...twork_connection_discovery_with_netstat.md |    2 +-
 ...1-09-13-getcurrent_user_with_powershell.md |    2 +-
 ...-13-jscript_execution_using_cscript_app.md |    2 +-
 ...s_scripting_process_loading_ldap_module.md |    2 +-
 ...ms_scripting_process_loading_wmi_module.md |    2 +-
 ...-09-13-system_user_discovery_with_query.md |    2 +-
 ...09-13-system_user_discovery_with_whoami.md |    2 +-
 ...user_discovery_with_env_vars_powershell.md |    2 +-
 ...21-09-13-xsl_script_execution_with_wmic.md |    2 +-
 ...-cmdline_tool_not_executed_in_cmd_shell.md |    2 +-
 ...021-09-14-get_wmiobject_group_discovery.md |    2 +-
 .../2021-09-14-net_localgroup_discovery.md    |    3 +-
 ...-14-powershell_get_localgroup_discovery.md |    2 +-
 .../_posts/2021-09-14-wmic_group_discovery.md |    2 +-
 ...1-09-15-check_elevated_cmd_using_whoami.md |    2 +-
 ...me_process_accessing_chrome_default_dir.md |    2 +-
 ...efox_process_access_firefox_profile_dir.md |    3 +-
 ...21-09-16-account_discovery_with_net_app.md |    2 +-
 ...t_to_add_certificate_to_untrusted_store.md |    2 +-
 ...edential_dump_from_registry_via_reg_exe.md |    4 +-
 .../_posts/2021-09-16-bits_job_persistence.md |    2 +-
 .../2021-09-16-bitsadmin_download_file.md     |    2 +-
 ...of_shadow_copy_with_wmic_and_powershell.md |    4 +-
 ...mping_via_copy_command_from_shadow_copy.md |    2 +-
 ...tial_dumping_via_symlink_to_shadow_copy.md |    2 +-
 ...16-detect_html_help_url_in_command_line.md |    2 +-
 ...ml_help_using_infotech_storage_handlers.md |    2 +-
 ...09-16-detect_mshta_inline_hta_execution.md |    2 +-
 ...-09-16-detect_mshta_url_in_command_line.md |    2 +-
 ...9-16-detect_psexec_with_accepteula_flag.md |    2 +-
 .../_posts/2021-09-16-detect_renamed_7-zip.md |    2 +-
 .../2021-09-16-detect_renamed_rclone.md       |    2 +-
 .../2021-09-16-detect_renamed_winrar.md       |    2 +-
 .../2021-09-16-dump_lsass_via_procdump.md     |    2 +-
 ...-09-16-local_account_discovery_with_net.md |    2 +-
 ...09-16-local_account_discovery_with_wmic.md |    2 +-
 ...2021-09-16-office_product_spawning_wmic.md |    2 +-
 .../2021-09-16-processes_launching_netsh.md   |    3 +-
 ...ument_spawned_child_process_to_download.md |    2 +-
 ...mcos_rat_file_creation_in_remcos_folder.md |    2 +-
 ...1-09-27-change_default_file_association.md |    2 +-
 ...27-logon_script_event_trigger_execution.md |    2 +-
 ...-27-screensaver_event_trigger_execution.md |    2 +-
 ...9-28-print_processor_registry_autostart.md |    2 +-
 .../2021-09-29-verclsid_clsid_execution.md    |    2 +-
 ...01-vbscript_execution_using_wscript_app.md |    2 +-
 ...ld_suspicious_spawned_by_script_process.md |    2 +-
 ...32_silent_and_install_param_dll_loading.md |    4 +-
 ...5-malicious_inprocserver32_modification.md |    2 +-
 ...1-10-05-process_writing_dynamicwrapperx.md |    2 +-
 .../2021-10-05-rundll32_shimcache_flush.md    |    2 +-
 .../2021-10-05-suspicious_copy_on_system32.md |    2 +-
 .../2021-10-05-winhlp32_spawning_a_process.md |    2 +-
 ...021-10-06-sdelete_application_execution.md |    4 +-
 ...ipt_or_cscript_suspicious_child_process.md |    2 +-
 .../2021-10-11-suspicious_wevtutil_usage.md   |    2 +-
 ...iceprincipalnames_discovery_with_setspn.md |    2 +-
 .../2021-10-18-disable_schedule_task.md       |    2 +-
 ...indows_curl_download_to_suspicious_path.md |    2 +-
 docs/_posts/2021-11-03-windows_adfind_exe.md  |    2 +-
 .../2021-11-04-attacker_tools_on_endpoint.md  |    2 +-
 ...ndows_curl_upload_to_remote_destination.md |    2 +-
 ...ows_service_creation_on_remote_endpoint.md |    2 +-
 ...s_service_initiation_on_remote_endpoint.md |    2 +-
 ...ocess_instantiation_via_winrm_and_winrs.md |    2 +-
 ...sk_creation_on_remote_endpoint_using_at.md |    2 +-
 ...uled_task_initiation_on_remote_endpoint.md |    2 +-
 .../2021-11-11-wmic_xsl_execution_via_url.md  |    2 +-
 ...2-aws_iam_accessdenied_discovery_events.md |    2 +-
 ...21-11-12-csc_net_on_the_fly_compilation.md |    4 +-
 ...1-11-12-firewall_allowed_program_enable.md |    5 +-
 ...twork_discovery_using_route_windows_app.md |    2 +-
 ...12-remote_process_instantiation_via_wmi.md |    2 +-
 ...21-11-12-runas_execution_in_commandline.md |    2 +-
 ...12-windows_installutil_uninstall_option.md |    2 +-
 ...windows_installutil_url_in_command_line.md |    2 +-
 ...s_instantiation_via_dcom_and_powershell.md |    2 +-
 ...ss_instantiation_via_wmi_and_powershell.md |    2 +-
 .../2021-11-15-windows_diskcryptor_usage.md   |    2 +-
 ..._instantiation_via_winrm_and_powershell.md |    2 +-
 ...2021-11-17-windows_dism_remove_defender.md |    2 +-
 ...ile_written_in_administrative_smb_share.md |    2 +-
 .../2021-11-18-loading_of_dynwrapx_module.md  |    2 +-
 ...info_gathering_using_dxdiag_application.md |    2 +-
 ...22-possible_browser_pass_view_parameter.md |    2 +-
 ...services_lolbas_execution_process_spawn.md |    2 +-
 ...-svchost_lolbas_execution_process_spawn.md |    2 +-
 ...wmiprsve_lolbas_execution_process_spawn.md |    2 +-
 ...provhost_lolbas_execution_process_spawn.md |    2 +-
 ...1-23-mmc_lolbas_execution_process_spawn.md |    9 +-
 ...5-add_or_set_windows_defender_exclusion.md |    2 +-
 ...ndows_defender_exclusion_registry_entry.md |    1 +
 ...-11-29-detect_rclone_command-line_usage.md |    2 +-
 ...sible_lateral_movement_powershell_spawn.md |    7 +-
 ...-06-suspicious_linux_discovery_commands.md |    2 +-
 ...windows_raccine_scheduled_task_deletion.md |    2 +-
 ...-msi_module_loaded_by_non-system_binary.md |    2 +-
 ...-12-10-curl_download_and_bash_execution.md |    2 +-
 ...-12-11-wget_download_and_bash_execution.md |    2 +-
 .../2021-12-13-linux_java_spawning_shell.md   |    2 +-
 ...load_injection_with_outbound_connection.md |    2 +-
 ...2021-12-13-windows_java_spawning_shells.md |    2 +-
 ..._add_files_in_known_crontab_directories.md |    2 +-
 ...-17-linux_at_allow_config_file_creation.md |    2 +-
 ...1-12-17-linux_edit_cron_table_parameter.md |    2 +-
 ..._cronjob_entry_on_existing_cronjob_file.md |    2 +-
 ...ssible_cronjob_modification_with_editor.md |    2 +-
 ...ux_file_creation_in_init_boot_directory.md |    2 +-
 ...inux_file_creation_in_profile_directory.md |    2 +-
 ...e_append_command_to_profile_config_file.md |    2 +-
 ...rvice_file_created_in_systemd_directory.md |    2 +-
 .../2021-12-20-linux_service_restarted.md     |    2 +-
 ...-12-20-linux_service_started_or_enabled.md |    2 +-
 .../2021-12-21-linux_add_user_account.md      |    2 +-
 ...1-12-21-linux_change_file_owner_to_root.md |    2 +-
 ...21-linux_nopasswd_entry_in_sudoers_file.md |    2 +-
 ...-12-21-linux_setuid_using_chmod_utility.md |    2 +-
 ...12-21-linux_setuid_using_setcap_utility.md |    2 +-
 ...21-12-21-linux_visudo_utility_execution.md |    2 +-
 ...file_created_in_kernel_driver_directory.md |    2 +-
 ...sert_kernel_module_using_insmod_utility.md |    2 +-
 ...ll_kernel_module_using_modprobe_utility.md |    2 +-
 ...2-22-linux_preload_hijack_library_calls.md |    2 +-
 ...ux_common_process_for_elevation_control.md |    2 +-
 ...1-12-23-linux_sudoers_tmp_file_creation.md |    2 +-
 .../2022-01-04-linux_sudo_or_su_execution.md  |    2 +-
 ...022-01-05-linux_doas_conf_file_creation.md |    2 +-
 .../2022-01-05-linux_doas_tool_execution.md   |    2 +-
 ...nux_possible_access_to_credential_files.md |    2 +-
 ...0-linux_possible_access_to_sudoers_file.md |    2 +-
 ...ess_or_modification_of_sshd_config_file.md |    2 +-
 ...11-linux_possible_ssh_key_file_creation.md |    2 +-
 ..._connect_to_internet_with_hidden_window.md |    2 +-
 ..._hunting_system_account_targeting_lsass.md |    2 +-
 ...dows_non-system_account_targeting_lsass.md |    2 +-
 ...tentially_malicious_code_on_commandline.md |    2 +-
 ...-cmd_carry_out_string_command_parameter.md |    3 +-
 ...lateral_movement_commandline_parameters.md |    2 +-
 ...us_powershell_process_-_encoded_command.md |    2 +-
 ...cess_dns_query_known_abuse_web_services.md |    2 +-
 ...dows_dotnet_binary_in_non_standard_path.md |    2 +-
 ...indows_installutil_in_non_standard_path.md |    2 +-
 ...ive_file_deletion_in_windefender_folder.md |    2 +-
 .../2022-01-20-ping_sleep_batch_command.md    |    2 +-
 .../2022-01-21-windows_nirsoft_advancedrun.md |    2 +-
 .../2022-01-24-windows_nirsoft_utilities.md   |    2 +-
 ...1-26-allow_operation_with_consent_admin.md |    1 +
 ...sable_defender_blockatfirstseen_feature.md |    1 +
 ...-disable_defender_enhanced_notification.md |    1 +
 ...01-26-disable_defender_spynet_reporting.md |    1 +
 ...defender_submit_samples_consent_feature.md |    3 +-
 ...6-log4shell_cve-2021-44228_exploitation.md |    2 +-
 ...1-26-registry_keys_used_for_persistence.md |    1 +
 .../2022-01-27-disable_show_hidden_files.md   |    1 +
 ...-27-disable_windows_behavior_monitoring.md |    1 +
 ...-27-windows_possible_credential_dumping.md |    2 +-
 ...8-hide_user_account_from_sign-in_screen.md |    1 +
 ...01-28-linux_pkexec_privilege_escalation.md |    2 +-
 ...tz_passtheticket_commandline_parameters.md |    2 +-
 ...22-02-01-rubeus_command_line_parameters.md |    2 +-
 ...nload_with_urlcache_and_split_arguments.md |    2 +-
 ...load_with_verifyctl_and_split_arguments.md |    2 +-
 ..._ticket_exports_through_winlogon_access.md |    2 +-
 ...dows_remote_assistance_spawning_process.md |    2 +-
 ...7-windows_schtasks_create_run_as_system.md |    2 +-
 ...022-02-08-rundll_loading_dll_by_ordinal.md |    2 +-
 ...oasting_spn_request_with_rc4_encryption.md |    2 +-
 .../2022-02-14-linux_dd_file_overwrite.md     |    2 +-
 ...2-15-windows_diskshadow_proxy_execution.md |    2 +-
 ...22-02-15-windows_rasautou_dll_execution.md |    2 +-
 ..._raw_access_to_master_boot_record_drive.md |    2 +-
 ...8-detect_regasm_with_network_connection.md |    2 +-
 ...-detect_regsvcs_with_network_connection.md |    2 +-
 .../2022-02-18-net_profiler_uac_bypass.md     |    2 +-
 ...-process_deleting_its_process_file_path.md |    2 +-
 docs/_posts/2022-02-18-rundll32_dnsquery.md   |    2 +-
 ...cution_policy_to_unrestricted_or_bypass.md |    2 +-
 ...heduled_task_deleted_or_created_via_cmd.md |    3 +-
 ...2-02-22-windows_wmi_process_call_create.md |    2 +-
 ...dows_process_with_namedpipe_commandline.md |    2 +-
 ...re_with_powershell_script_block_logging.md |  168 +
 ...tz_with_powershell_script_block_logging.md |  167 +
 ...oresttrust_with_powershell_script_block.md |  164 +
 ...022-02-25-powershell_domain_enumeration.md |  167 +
 ...-powershell_enable_smb1protocol_feature.md |  163 +
 ...ss_process_injection_via_getprocaddress.md |  174 +
 ...25-powershell_processing_stream_of_data.md |  166 +
 .../2022-02-25-recon_using_wmi_class.md       |  167 +
 ...le_without_extension_in_critical_folder.md |    2 +-
 ...ows_raw_access_to_disk_volume_partition.md |    2 +-
 ...rincipalnames_discovery_with_powershell.md |  174 +
 ...ve_distinct_processes_from_windows_temp.md |    2 +-
 docs/_posts/2022-03-03-aws_createaccesskey.md |    2 +-
 .../2022-03-03-aws_updateloginprofile.md      |    2 +-
 .../2022-03-08-suspicious_msbuild_path.md     |    2 +-
 ...own_process_using_the_kerberos_protocol.md |    2 +-
 ...t_regasm_with_no_command_line_arguments.md |    4 +-
 ..._regsvcs_with_no_command_line_arguments.md |    2 +-
 ..._no_command_line_arguments_with_network.md |    2 +-
 ..._no_command_line_arguments_with_network.md |    2 +-
 ...ice_ticket_request_using_rc4_encryption.md |    2 +-
 ..._no_command_line_arguments_with_network.md |    2 +-
 ...lhost_with_no_command_line_with_network.md |    2 +-
 ...cious_dllhost_no_command_line_arguments.md |    4 +-
 ...ious_gpupdate_no_command_line_arguments.md |    2 +-
 ...ious_rundll32_no_command_line_arguments.md |    2 +-
 ...hprotocolhost_no_command_line_arguments.md |    2 +-
 ...s_installutil_remote_network_connection.md |    2 +-
 ...stallutil_uninstall_option_with_network.md |    2 +-
 ...odify_acl_permission_to_files_or_folder.md |    2 +-
 ...tlocaluser_with_powershell_script_block.md |   13 +-
 ...022-03-22-powershell_execute_com_object.md |   12 +-
 ...owershell_using_memory_as_backing_store.md |    8 +-
 ...3-22-recon_avproduct_through_pwh_or_wmi.md |   10 +-
 ...n_via_winrm_and_powershell_script_block.md |    9 +-
 ...03-28-windows_terminating_lsass_process.md |    2 +-
 ...022-03-29-windows_iso_lnk_file_creation.md |    2 +-
 ...-30-windows_drivers_loaded_by_signature.md |    2 +-
 ...connection_with_powershell_script_block.md |  155 +
 ...ithub_actions_disable_security_workflow.md |    2 +-
 ...nux_stdout_redirection_to_dev_null_file.md |    2 +-
 ...indirect_command_execution_via_forfiles.md |    2 +-
 ...s_indirect_command_execution_via_pcalua.md |    2 +-
 .../2022-04-07-any_powershell_downloadfile.md |    2 +-
 ...022-04-07-any_powershell_downloadstring.md |    2 +-
 .../2022-04-07-detect_html_help_renamed.md    |    2 +-
 .../_posts/2022-04-07-detect_mshta_renamed.md |    2 +-
 .../2022-04-07-detect_renamed_psexec.md       |    2 +-
 ...ious_microsoft_workflow_compiler_rename.md |    2 +-
 .../2022-04-07-suspicious_msbuild_rename.md   |    2 +-
 .../2022-04-07-suspicious_rundll32_rename.md  |    2 +-
 ...2-04-13-windows_registry_delete_task_sd.md |    2 +-
 ...022-04-18-nltest_domain_trust_discovery.md |    4 +-
 ...nux_adding_crontab_using_list_parameter.md |    2 +-
 ...ing_critical_directory_using_rm_command.md |    2 +-
 .../2022-04-22-linux_disable_services.md      |    2 +-
 ...022-04-22-linux_shred_overwrite_command.md |    2 +-
 docs/_posts/2022-04-22-linux_stop_services.md |    2 +-
 ...rocesses_killed_by_industroyer2_malware.md |    2 +-
 ..._script_contains_base64_encoded_content.md |  172 +
 ...oup_discovery_with_script_block_logging.md |  167 +
 ...6-windows_hidden_schedule_task_settings.md |    2 +-
 ...ter_account_created_by_computer_account.md |    2 +-
 ...uter_account_requesting_kerberos_ticket.md |    2 +-
 ...windows_kerberos_local_successful_logon.md |    2 +-
 ...04-28-windows_computer_account_with_spn.md |    2 +-
 ...worker_process_in_writable_process_path.md |    2 +-
 ...05-02-delete_shadowcopy_with_powershell.md |  159 +
 ...-05-02-exchange_powershell_module_usage.md |  167 +
 ...omaintrust_with_powershell_script_block.md |  161 +
 ...wordpolicy_with_powershell_script_block.md |  157 +
 ...mainpolicy_with_powershell_script_block.md |  157 +
 ...adcomputer_with_powershell_script_block.md |  155 +
 ...incomputer_with_powershell_script_block.md |  155 +
 ...controller_with_powershell_script_block.md |  155 +
 ...omaingroup_with_powershell_script_block.md |  160 +
 ...s_computer_with_powershell_script_block.md |  155 +
 ...t_ds_group_with_powershell_script_block.md |  160 +
 ...ct_ds_user_with_powershell_script_block.md |  161 +
 ...er_account_with_powershell_script_block.md |  165 +
 .../2022-05-02-mailsniper_invoke_functions.md |  161 +
 .../2022-05-02-powershell_4104_hunting.md     |  341 ++
 ...-05-02-powershell_creating_thread_mutex.md |  168 +
 ...ading_dotnet_into_memory_via_reflection.md |  167 +
 ...shell_remove_windows_defender_directory.md |  167 +
 ...2-wmi_recon_running_process_or_services.md |  159 +
 ...uthentication_discovery_with_get-aduser.md |  161 +
 ...authentication_discovery_with_powerview.md |  161 +
 ...ndows_service_create_kernel_mode_driver.md |    2 +-
 .../2022-05-16-cobalt_strike_named_pipes.md   |    2 +-
 .../2022-05-16-windows_system_file_on_disk.md |    2 +-
 ...e_policy_version_to_allow_all_resources.md |    2 +-
 ...chtasks_scheduling_job_on_remote_system.md |    2 +-
 ...nd_scripting_interpreter_risky_commands.md |    2 +-
 ...22-05-26-linux_at_application_execution.md |    2 +-
 ..._append_command_to_at_allow_config_file.md |    2 +-
 ..._and_scripting_interpreter_delete_usage.md |    2 +-
 ...30-windows_office_product_spawning_msdt.md |    2 +-
 ...01-mshtml_module_load_in_office_product.md |    2 +-
 ...spicious_process_with_discord_dns_query.md |    2 +-
 .../2022-06-01-unload_sysmon_filter_driver.md |    2 +-
 ...ess_connecting_to_ip_check_web_services.md |    2 +-
 ...ting_interpreter_hunting_path_traversal.md |    2 +-
 ...ripting_interpreter_path_traversal_exec.md |    2 +-
 ...01-windows_installutil_credential_theft.md |    2 +-
 ...2-06-03-excessive_usage_of_nslookup_app.md |    2 +-
 .../2022-06-03-java_writing_jsp_file.md       |    2 +-
 ...03-linux_iptables_firewall_modification.md |    2 +-
 ...efense_delete_win_defender_context_menu.md |    2 +-
 ...se_delete_win_defender_profile_registry.md |    2 +-
 ...enses_disable_win_defender_auto_logging.md |    2 +-
 ...windows_msiexec_spawn_discovery_command.md |    2 +-
 ...06-14-windows_msiexec_dllregisterserver.md |    2 +-
 ...ws_msiexec_unregister_dllregisterserver.md |    2 +-
 ...ect_risky_spl_using_pretrained_ml_model.md |  167 +
 ...2-06-16-windows_msiexec_remote_download.md |    2 +-
 ...indows_msiexec_with_network_connections.md |    2 +-
 ...ws_ecr_container_scanning_findings_high.md |    2 +-
 ...work_info_through_ip_check_web_services.md |  169 +
 ...s_remote_services_allow_rdp_in_firewall.md |  171 +
 ...remote_services_allow_remote_assistance.md |  170 +
 ...6-21-windows_remote_services_rdp_enable.md |  169 +
 ...-06-21-windows_service_stop_by_deletion.md |  168 +
 ...fy_registry_disable_toast_notifications.md |  165 +
 ...y_disable_windows_security_center_notif.md |  165 +
 ..._modify_registry_disabling_wer_settings.md |  165 +
 ...ws_modify_registry_disallow_windows_app.md |  164 +
 ...fy_registry_suppress_win_defender_notif.md |  165 +
 ...werview_kerberos_service_ticket_request.md |   13 +-
 ...2-06-22-windows_powerview_spn_discovery.md |    7 +-
 ...ows_remote_access_software_rms_registry.md |  165 +
 ...ry_disable_win_defender_raw_write_notif.md |  165 +
 ...lid_account_with_never_expires_password.md |  171 +
 ...ayer_protocol_rms_radmin_tool_namedpipe.md |  164 +
 ..._impair_defense_add_xml_applocker_rules.md |  170 +
 ...e_deny_security_software_with_applocker.md |  175 +
 ...dify_registry_regedit_silent_reg_import.md |  170 +
 ..._remote_service_rdpwinst_tool_execution.md |  174 +
 ...onnection_from_java_using_default_ports.md |    2 +-
 .../2022-06-28-windows_odbcconf_load_dll.md   |  170 +
 ...mote_system_discovery_with_adsisearcher.md |  154 +
 ...ws_execute_arbitrary_commands_with_msdt.md |  179 +
 .../2022-06-30-windows_odbcconf_hunting.md    |  170 +
 ...-30-windows_odbcconf_load_response_file.md |  170 +
 ...dows_powershell_import_applocker_policy.md |  160 +
 ...07-07-office_product_writing_cab_or_inf.md |  177 +
 ...icious_image_creation_in_appdata_folder.md |  163 +
 ...7-suspicious_wav_file_in_appdata_folder.md |  163 +
 ...proxy_execution_mavinject_dll_injection.md |  176 +
 docs/_posts/2022-07-08-living_off_the_land.md |  177 +
 ...7-11-windows_identify_protocol_handlers.md |  183 +
 ...-07-12-spring4shell_payload_url_request.md |  180 +
 ...-15-certutil_exe_certificate_extraction.md |  158 +
 ...-powershell_disable_security_monitoring.md |  171 +
 ...s_mof_event_triggered_execution_via_wmi.md |  174 +
 ...bound_traffic_by_firewall_rule_registry.md |  176 +
 ...-wmic_noninteractive_app_uninstallation.md |  169 +
 docs/_stories/active_directory_discovery.md   |    6 +-
 .../active_directory_lateral_movement.md      |    4 +-
 docs/_stories/azorult.md                      |  100 +
 ...plantation_monitoring_and_investigation.md |    3 -
 docs/_stories/disabling_security_tools.md     |    2 +-
 docs/_stories/hermetic_wiper.md               |    8 +-
 docs/_stories/hidden_cobra_malware.md         |    2 +-
 docs/_stories/industroyer2.md                 |    2 +-
 docs/_stories/living_off_the_land.md          |   13 +-
 docs/_stories/malicious_powershell.md         |   13 +-
 docs/_stories/ransomware.md                   |    2 +-
 docs/_stories/splunk_vulnerabilities.md       |    1 +
 .../windows_defense_evasion_tactics.md        |    2 +-
 docs/mitre-map/coverage.json                  |   97 +-
 696 files changed, 16796 insertions(+), 3032 deletions(-)
 create mode 100644 dist/escu/lookups/__mlspl_risky_spl_pre_trained_model.mlmodel
 create mode 100644 dist/escu/lookups/windows_protocol_handlers.csv
 create mode 100644 dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml
 create mode 100644 docs/_posts/2022-02-24-detect_empire_with_powershell_script_block_logging.md
 create mode 100644 docs/_posts/2022-02-24-detect_mimikatz_with_powershell_script_block_logging.md
 create mode 100644 docs/_posts/2022-02-24-get-foresttrust_with_powershell_script_block.md
 create mode 100644 docs/_posts/2022-02-25-powershell_domain_enumeration.md
 create mode 100644 docs/_posts/2022-02-25-powershell_enable_smb1protocol_feature.md
 create mode 100644 docs/_posts/2022-02-25-powershell_fileless_process_injection_via_getprocaddress.md
 create mode 100644 docs/_posts/2022-02-25-powershell_processing_stream_of_data.md
 create mode 100644 docs/_posts/2022-02-25-recon_using_wmi_class.md
 create mode 100644 docs/_posts/2022-02-26-serviceprincipalnames_discovery_with_powershell.md
 create mode 100644 docs/_posts/2022-04-02-getnettcpconnection_with_powershell_script_block.md
 create mode 100644 docs/_posts/2022-04-26-powershell_fileless_script_contains_base64_encoded_content.md
 create mode 100644 docs/_posts/2022-04-26-powershell_get_localgroup_discovery_with_script_block_logging.md
 create mode 100644 docs/_posts/2022-05-02-delete_shadowcopy_with_powershell.md
 create mode 100644 docs/_posts/2022-05-02-exchange_powershell_module_usage.md
 create mode 100644 docs/_posts/2022-05-02-get-domaintrust_with_powershell_script_block.md
 create mode 100644 docs/_posts/2022-05-02-get_aduserresultantpasswordpolicy_with_powershell_script_block.md
 create mode 100644 docs/_posts/2022-05-02-get_domainpolicy_with_powershell_script_block.md
 create mode 100644 docs/_posts/2022-05-02-getadcomputer_with_powershell_script_block.md
 create mode 100644 docs/_posts/2022-05-02-getdomaincomputer_with_powershell_script_block.md
 create mode 100644 docs/_posts/2022-05-02-getdomaincontroller_with_powershell_script_block.md
 create mode 100644 docs/_posts/2022-05-02-getdomaingroup_with_powershell_script_block.md
 create mode 100644 docs/_posts/2022-05-02-getwmiobject_ds_computer_with_powershell_script_block.md
 create mode 100644 docs/_posts/2022-05-02-getwmiobject_ds_group_with_powershell_script_block.md
 create mode 100644 docs/_posts/2022-05-02-getwmiobject_ds_user_with_powershell_script_block.md
 create mode 100644 docs/_posts/2022-05-02-getwmiobject_user_account_with_powershell_script_block.md
 create mode 100644 docs/_posts/2022-05-02-mailsniper_invoke_functions.md
 create mode 100644 docs/_posts/2022-05-02-powershell_4104_hunting.md
 create mode 100644 docs/_posts/2022-05-02-powershell_creating_thread_mutex.md
 create mode 100644 docs/_posts/2022-05-02-powershell_loading_dotnet_into_memory_via_reflection.md
 create mode 100644 docs/_posts/2022-05-02-powershell_remove_windows_defender_directory.md
 create mode 100644 docs/_posts/2022-05-02-wmi_recon_running_process_or_services.md
 create mode 100644 docs/_posts/2022-05-03-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md
 create mode 100644 docs/_posts/2022-05-03-disabled_kerberos_pre-authentication_discovery_with_powerview.md
 create mode 100644 docs/_posts/2022-06-16-detect_risky_spl_using_pretrained_ml_model.md
 create mode 100644 docs/_posts/2022-06-21-windows_gather_victim_network_info_through_ip_check_web_services.md
 create mode 100644 docs/_posts/2022-06-21-windows_remote_services_allow_rdp_in_firewall.md
 create mode 100644 docs/_posts/2022-06-21-windows_remote_services_allow_remote_assistance.md
 create mode 100644 docs/_posts/2022-06-21-windows_remote_services_rdp_enable.md
 create mode 100644 docs/_posts/2022-06-21-windows_service_stop_by_deletion.md
 create mode 100644 docs/_posts/2022-06-22-windows_modify_registry_disable_toast_notifications.md
 create mode 100644 docs/_posts/2022-06-22-windows_modify_registry_disable_windows_security_center_notif.md
 create mode 100644 docs/_posts/2022-06-22-windows_modify_registry_disabling_wer_settings.md
 create mode 100644 docs/_posts/2022-06-22-windows_modify_registry_disallow_windows_app.md
 create mode 100644 docs/_posts/2022-06-22-windows_modify_registry_suppress_win_defender_notif.md
 create mode 100644 docs/_posts/2022-06-22-windows_remote_access_software_rms_registry.md
 create mode 100644 docs/_posts/2022-06-23-windows_modify_registry_disable_win_defender_raw_write_notif.md
 create mode 100644 docs/_posts/2022-06-23-windows_valid_account_with_never_expires_password.md
 create mode 100644 docs/_posts/2022-06-24-windows_application_layer_protocol_rms_radmin_tool_namedpipe.md
 create mode 100644 docs/_posts/2022-06-24-windows_impair_defense_add_xml_applocker_rules.md
 create mode 100644 docs/_posts/2022-06-24-windows_impair_defense_deny_security_software_with_applocker.md
 create mode 100644 docs/_posts/2022-06-24-windows_modify_registry_regedit_silent_reg_import.md
 create mode 100644 docs/_posts/2022-06-24-windows_remote_service_rdpwinst_tool_execution.md
 create mode 100644 docs/_posts/2022-06-28-windows_odbcconf_load_dll.md
 create mode 100644 docs/_posts/2022-06-29-remote_system_discovery_with_adsisearcher.md
 create mode 100644 docs/_posts/2022-06-29-windows_execute_arbitrary_commands_with_msdt.md
 create mode 100644 docs/_posts/2022-06-30-windows_odbcconf_hunting.md
 create mode 100644 docs/_posts/2022-06-30-windows_odbcconf_load_response_file.md
 create mode 100644 docs/_posts/2022-06-30-windows_powershell_import_applocker_policy.md
 create mode 100644 docs/_posts/2022-07-07-office_product_writing_cab_or_inf.md
 create mode 100644 docs/_posts/2022-07-07-suspicious_image_creation_in_appdata_folder.md
 create mode 100644 docs/_posts/2022-07-07-suspicious_wav_file_in_appdata_folder.md
 create mode 100644 docs/_posts/2022-07-07-windows_binary_proxy_execution_mavinject_dll_injection.md
 create mode 100644 docs/_posts/2022-07-08-living_off_the_land.md
 create mode 100644 docs/_posts/2022-07-11-windows_identify_protocol_handlers.md
 create mode 100644 docs/_posts/2022-07-12-spring4shell_payload_url_request.md
 create mode 100644 docs/_posts/2022-07-15-certutil_exe_certificate_extraction.md
 create mode 100644 docs/_posts/2022-07-15-powershell_disable_security_monitoring.md
 create mode 100644 docs/_posts/2022-07-15-windows_mof_event_triggered_execution_via_wmi.md
 create mode 100644 docs/_posts/2022-07-19-allow_inbound_traffic_by_firewall_rule_registry.md
 create mode 100644 docs/_posts/2022-07-19-wmic_noninteractive_app_uninstallation.md
 create mode 100644 docs/_stories/azorult.md

diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest
index 5aaf06071b..f8df6d0f59 100644
--- a/dist/escu/app.manifest
+++ b/dist/escu/app.manifest
@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "3.44.0"
+      "version": "3.45.0"
     }, 
     "author": [
       {
diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf
index 847594a73f..803b84d6dc 100644
--- a/dist/escu/default/analyticstories.conf
+++ b/dist/escu/default/analyticstories.conf
@@ -1,12 +1,22 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-06-29T20:42:24 UTC
+# On Date: 2022-07-19T21:28:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
 
 ### DETECTIONS ###
 
+[savedsearch://ESCU - Detect Risky SPL using Pretrained ML Model - Rule]
+type = detection
+asset_type = Web Server
+confidence = medium
+explanation = The following analytic uses a pretrained machine learning text classifier to detect potentially risky commands. The model is trained independently and then the model file is packaged within ESCU for usage. A command is deemed risky based on the presence of certain trigger keywords, along with the context and the role of the user (please see references). The model uses custom features to predict whether a SPL is risky using text classification. The model takes as input the command text, user and search type and outputs a risk score between [0,1]. A high score indicates higher likelihood of a command being risky. This model is on-prem only.
+how_to_implement = This detection depends on the MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need to be ingesting logs which include Search_Activity.search, Search_Activity.user, Search_Activity.search_type from your endpoints. The risk score threshold should be adjusted based on the environment. The detection uses a custom MLTK model hence we need a few more steps for deployment, as outlined here - https://gist.github.com/ksharad-splunk/be2a62227966049047f5e5c4f2adcabb.
+annotations = {"cis20": ["CIS 3", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.AE"]}
+known_false_positives = False positives may be present if suspicious behavior is observed, as determined by frequent usage of risky keywords.
+providing_technologies = null
+
 [savedsearch://ESCU - Path traversal SPL injection - Rule]
 type = detection
 asset_type = Endpoint
@@ -15,7 +25,7 @@ explanation = On May 3rd, 2022, Splunk published a security advisory for a Path
 how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1083"]}
 known_false_positives = This search may find additional path traversal exploitation attempts.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule]
 type = detection
@@ -25,7 +35,7 @@ explanation = The following analytic identifies the use of the risky command - D
 how_to_implement = To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index. In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]}
 known_false_positives = False positives may be present if this command is used as a common practice. Filter as needed.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule]
 type = detection
@@ -35,7 +45,7 @@ explanation = The Splunk platform contains built-in search processing language (
 how_to_implement = To successfully implement this search acceleration is recommended against the Search_Activity datamodel that runs against the splunk _audit index.  In addition, this analytic requires the Common Information Model App which includes the Splunk Audit Datamodel https://splunkbase.splunk.com/app/1621/. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]}
 known_false_positives = False positives will be present until properly filtered by Username and search name.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule]
 type = detection
@@ -45,7 +55,7 @@ explanation = This detection utilizes machine learning model named "risky_comman
 how_to_implement = This detection depends on MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Baseline model needs to be built using "Splunk Command and Scripting Interpreter Risky SPL MLTK Baseline" before this search can run. Please note that the current search only finds matches exactly one space between separator bar and risky commands.
 annotations = {"cis20": ["CIS 3", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.AE"]}
 known_false_positives = If the run time of a search exceeds the boundaries of outlier defined by the fitted density function model, false positives can occur, incorrectly labeling a long running search as potentially risky.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Splunk Digital Certificates Infrastructure Version - Rule]
 type = detection
@@ -55,7 +65,7 @@ explanation = This search will check the TLS validation is properly configured o
 how_to_implement = The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (the `dispatch_rest_to_indexers` capability) in some architectures. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"]}
 known_false_positives = No known at this time.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Splunk Digital Certificates Lack of Encryption - Rule]
 type = detection
@@ -65,7 +75,7 @@ explanation = On June 14th, 2022, Splunk released a security advisory relating t
 how_to_implement = This anomaly search looks for forwarder connections that are not currently using TLS. It then presents the source IP, the type of forwarder, and the version of the forwarder. You can also remove the "ssl=false" argument from the initial stanza in order to get a full list of all your forwarders that are sending data, and the version of Splunk software they are running, for audit purposes. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1587.003"], "nist": ["DE.CM"]}
 known_false_positives = None at this time
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Splunk DoS via Malformed S2S Request - Rule]
 type = detection
@@ -75,7 +85,7 @@ explanation = On March 24th, 2022, Splunk published a security advisory for a po
 how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will only find attempted exploitation on versions of Splunk already patched for CVE-2021-3422.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1498"], "nist": ["DE.CM"]}
 known_false_positives = None.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule]
 type = detection
@@ -85,7 +95,7 @@ explanation = On June 14th, 2022, Splunk released a security advisory relating t
 how_to_implement = This hunting search uses native logs produced when a deployment server is within your environment. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.CM"]}
 known_false_positives = None at this time.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule]
 type = detection
@@ -95,7 +105,7 @@ explanation = On June 14th, 2022, Splunk released a security advisory relating t
 how_to_implement = The user running this search is required to have a permission allowing them to dispatch REST requests to indexers (The `dispatch_rest_to_indexers` capability). Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1001.003"], "nist": ["DE.CM"]}
 known_false_positives = While all of the settings on each device returned by this search may appear to be hardened, you will still need to verify the value of PYTHONHTTPSVERIFY in $SPLUNK_HOME/etc/splunk-launch.conf on each device in order to harden the python configuration.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule]
 type = detection
@@ -105,7 +115,7 @@ explanation = On June 14th 2022, Splunk released vulnerability advisory addresin
 how_to_implement = Must upgrade to Splunk version 9 and Configure TLS in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"]}
 known_false_positives = This searches finds self signed certificates issued by Splunk which are not recommended from Splunk version 9 forward.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule]
 type = detection
@@ -115,7 +125,7 @@ explanation = On Splunk version 9 on Python3 client libraries verify server cert
 how_to_implement = Must upgrade to Splunk version 9 and Configure TLS host name validation for Splunk Python modules in order to apply this search. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.004"], "nist": ["DE.CM"]}
 known_false_positives = This search tries to address validation of server and client certificates within Splunk infrastructure, it might produce results from accidental or unintended requests to port 8089.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Splunk User Enumeration Attempt - Rule]
 type = detection
@@ -125,7 +135,7 @@ explanation = On May 3rd, 2022, Splunk published a security advisory for  userna
 how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This detection may assist in efforts to find password spraying or brute force authorization attempts in addition to someone enumerating usernames.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1078"], "nist": ["DE.CM"]}
 known_false_positives = Automation executing authentication attempts against your Splunk infrastructure with outdated credentials may cause false positives.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Splunk XSS in Monitoring Console - Rule]
 type = detection
@@ -135,7 +145,7 @@ explanation = On May 3rd, 2022, Splunk published a security advisory for a refle
 how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This detection will find attempted exploitation of CVE-2022-27183.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1189"], "nist": ["DE.CM"]}
 known_false_positives = Use of the monitoring console where the less-than sign (<) is the first character in the description field.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule]
 type = detection
@@ -145,7 +155,7 @@ explanation = This search will detect a spike in the number of API calls made to
 how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to create the probability density function.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
 known_false_positives = 
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule]
 type = detection
@@ -155,7 +165,7 @@ explanation = This search will detect a spike in the number of API calls made to
 how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
 known_false_positives = 
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - AWS Create Policy Version to allow all resources - Rule]
 type = detection
@@ -165,7 +175,7 @@ explanation = This search looks for AWS CloudTrail events where a user created a
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources and you must verify this activity.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS CreateAccessKey - Rule]
 type = detection
@@ -175,7 +185,7 @@ explanation = This search looks for AWS CloudTrail events where a user A who has
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS CreateLoginProfile - Rule]
 type = detection
@@ -185,7 +195,7 @@ explanation = This search looks for AWS CloudTrail events where a user A(victim
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a login profile for another user.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule]
 type = detection
@@ -195,7 +205,7 @@ explanation = This search looks for AssumeRole events where an IAM role in a dif
 how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen AWS Cross Account Activity - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen AWS Cross Account Activity - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `aws_cross_account_activity_from_previously_unseen_account_filter` macro.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.AC", "PR.DS", "DE.AE"]}
 known_false_positives = Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicious when an account requests privileges of an account it hasn't before. You should validate with the account owner that this is a legitimate request.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule]
 type = detection
@@ -205,7 +215,7 @@ explanation = This search provides detection of KMS keys where action kms:Encryp
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1486"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule]
 type = detection
@@ -215,7 +225,7 @@ explanation = This search provides detection of users with KMS keys performing e
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1486"]}
 known_false_positives = bucket with S3 encryption
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS ECR Container Scanning Findings High - Rule]
 type = detection
@@ -225,7 +235,7 @@ explanation = This search looks for AWS CloudTrail events from AWS Elastic Conta
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule]
 type = detection
@@ -235,7 +245,7 @@ explanation = This search looks for AWS CloudTrail events from AWS Elastic Conta
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS ECR Container Scanning Findings Medium - Rule]
 type = detection
@@ -245,7 +255,7 @@ explanation = This search looks for AWS CloudTrail events from AWS Elastic Conta
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS ECR Container Upload Outside Business Hours - Rule]
 type = detection
@@ -255,7 +265,7 @@ explanation = This search looks for AWS CloudTrail events from AWS Elastic Conta
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = When your development is spreaded in different time zones, applying this rule can be difficult.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS ECR Container Upload Unknown User - Rule]
 type = detection
@@ -265,7 +275,7 @@ explanation = This search looks for AWS CloudTrail events from AWS Elastic Conta
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS Excessive Security Scanning - Rule]
 type = detection
@@ -275,7 +285,7 @@ explanation = This search looks for AWS CloudTrail events and analyse the amount
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = While this search has no known false positives.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS IAM AccessDenied Discovery Events - Rule]
 type = detection
@@ -285,7 +295,7 @@ explanation = The following detection identifies excessive AccessDenied events w
 how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1580"]}
 known_false_positives = It is possible to start this detection will need to be tuned by source IP or user. In addition, change the count values to an upper threshold to restrict false positives.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS IAM Assume Role Policy Brute Force - Rule]
 type = detection
@@ -295,7 +305,7 @@ explanation = The following detection identifies any malformed policy document e
 how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs. Set the `where count` greater than a value to identify suspicious activity in your environment.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1580", "T1110"]}
 known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS IAM Delete Policy - Rule]
 type = detection
@@ -305,7 +315,7 @@ explanation = The following detection identifes when a policy is deleted on AWS.
 how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
 annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1098"]}
 known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete policies (least privilege). In addition, this may be saved seperately and tuned for failed or success attempts only.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS IAM Failure Group Deletion - Rule]
 type = detection
@@ -315,7 +325,7 @@ explanation = This detection identifies failure attempts to delete groups. We wa
 how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
 annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1098"]}
 known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS IAM Successful Group Deletion - Rule]
 type = detection
@@ -325,7 +335,7 @@ explanation = The following query uses IAM events to track the success of a grou
 how_to_implement = The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.
 annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1069.003", "T1098", "T1069"]}
 known_false_positives = This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS Lambda UpdateFunctionCode - Rule]
 type = detection
@@ -335,7 +345,7 @@ explanation = This analytic is designed to detect IAM users attempting to update
 how_to_implement = You must install Splunk AWS Add on and enable Cloudtrail logs in your AWS Environment.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = While this search has no known false positives, it is possible that an AWS admin or an autorized IAM user has updated the lambda fuction code legitimately.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS Network Access Control List Created with All Open Ports - Rule]
 type = detection
@@ -345,7 +355,7 @@ explanation = The search looks for AWS CloudTrail events to detect if any networ
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs.
 annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007", "T1562"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS Network Access Control List Deleted - Rule]
 type = detection
@@ -355,7 +365,7 @@ explanation = Enforcing network-access controls is one of the defensive mechanis
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs.
 annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007", "T1562"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = It's possible that a user has legitimately deleted a network ACL.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS SAML Access by Provider User and Principal - Rule]
 type = detection
@@ -365,7 +375,7 @@ explanation = This search provides specific SAML access from specific Service Pr
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078"]}
 known_false_positives = Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS SAML Update identity provider - Rule]
 type = detection
@@ -375,7 +385,7 @@ explanation = This search provides detection of updates to SAML provider in AWS.
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078"]}
 known_false_positives = Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS SetDefaultPolicyVersion - Rule]
 type = detection
@@ -385,7 +395,7 @@ explanation = This search looks for AWS CloudTrail events where a user has set a
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately set a default policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS UpdateLoginProfile - Rule]
 type = detection
@@ -395,7 +405,7 @@ explanation = This search looks for AWS CloudTrail events where a user A who has
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.003", "T1136"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - Circle CI Disable Security Job - Rule]
 type = detection
@@ -405,7 +415,7 @@ explanation = This search looks for disable security job in CircleCI pipeline.
 how_to_implement = You must index CircleCI logs.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1554"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Circle CI Disable Security Step - Rule]
 type = detection
@@ -415,7 +425,7 @@ explanation = This search looks for disable security step in CircleCI pipeline.
 how_to_implement = You must index CircleCI logs.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1554"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Cloud API Calls From Previously Unseen User Roles - Rule]
 type = detection
@@ -425,7 +435,7 @@ explanation = This search looks for new commands from each user role.
 how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud API Calls Per User Role - Initial` to build the initial table of user roles, commands, and times. You must also enable the second baseline search `Previously Seen Cloud API Calls Per User Role - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `cloud_api_calls_from_previously_unseen_user_roles_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_api_calls_from_previously_unseen_user_roles_filter`
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
 known_false_positives = .
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule]
 type = detection
@@ -435,7 +445,7 @@ explanation = This search looks for cloud compute instances created by users who
 how_to_implement = You must be ingesting the appropriate cloud-infrastructure logs Run the "Previously Seen Cloud Compute Creations By User" support search to create of baseline of previously seen users.
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["ID.AM"]}
 known_false_positives = It's possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule]
 type = detection
@@ -445,7 +455,7 @@ explanation = This search looks at cloud-infrastructure events where an instance
 how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Regions - Initial` to build the initial table of images observed and times. You must also enable the second baseline search `Previously Seen Cloud Regions - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_in_previously_unused_region_filter` macro.
 annotations = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule]
 type = detection
@@ -455,7 +465,7 @@ explanation = This search looks for cloud compute instances being created with p
 how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Compute Images - Initial` to build the initial table of images observed and times. You must also enable the second baseline search `Previously Seen Cloud Compute Images - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_image_filter` macro.
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["ID.AM"]}
 known_false_positives = After a new image is created, the first systems created with that image will cause this alert to fire.  Verify that the image being used was created by a legitimate user.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule]
 type = detection
@@ -465,7 +475,7 @@ explanation = Find EC2 instances being created with previously unseen instance t
 how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Compute Instance Types - Initial` to build the initial table of instance types observed and times. You must also enable the second baseline search `Previously Seen Cloud Compute Instance Types - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter` macro.
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["ID.AM"]}
 known_false_positives = It is possible that an admin will create a new system using a new instance type that has never been used before. Verify with the creator that they intended to create the system with the new instance type.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Cloud Instance Modified By Previously Unseen User - Rule]
 type = detection
@@ -475,7 +485,7 @@ explanation = This search looks for cloud instances being modified by users who
 how_to_implement = This search has a dependency on other searches to create and update a baseline of users observed to be associated with this activity. The search "Previously Seen Cloud Instance Modifications By User - Update" should be enabled for this detection to properly work.
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["ID.AM"]}
 known_false_positives = It's possible that a new user will start to modify EC2 instances when they haven't before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule]
 type = detection
@@ -486,7 +496,7 @@ how_to_implement = You must be ingesting your cloud infrastructure logs from you
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
 known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
  This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule]
 type = detection
@@ -497,7 +507,7 @@ how_to_implement = You must be ingesting your cloud infrastructure logs from you
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
 known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
  This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule]
 type = detection
@@ -508,7 +518,7 @@ how_to_implement = You must be ingesting your cloud infrastructure logs from you
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
 known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
  This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule]
 type = detection
@@ -519,7 +529,7 @@ how_to_implement = You must be ingesting your cloud infrastructure logs from you
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
 known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
  This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Correlation by Repository and Risk - Rule]
 type = detection
@@ -529,7 +539,7 @@ explanation = This search correlations detections by repository and risk_score
 how_to_implement = For Dev Sec Ops POC
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Correlation by User and Risk - Rule]
 type = detection
@@ -539,7 +549,7 @@ explanation = This search correlations detections by user and risk_score
 how_to_implement = For Dev Sec Ops POC
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect AWS Console Login by New User - Rule]
 type = detection
@@ -549,7 +559,7 @@ explanation = This search looks for AWS CloudTrail events wherein a console logi
 how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect AWS Console Login by User from New City - Rule]
 type = detection
@@ -559,7 +569,7 @@ explanation = This search looks for AWS CloudTrail events wherein a console logi
 how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter` macro.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect AWS Console Login by User from New Country - Rule]
 type = detection
@@ -569,7 +579,7 @@ explanation = This search looks for AWS CloudTrail events wherein a console logi
 how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter` macro.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect AWS Console Login by User from New Region - Rule]
 type = detection
@@ -579,7 +589,7 @@ explanation = This search looks for AWS CloudTrail events wherein a console logi
 how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Run the `Previously Seen Users in AWS CloudTrail - Initial` support search only once to create a baseline of previously seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail - Update` hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines. You can also provide additional filtering for this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter` macro.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect New Open S3 buckets - Rule]
 type = detection
@@ -589,7 +599,7 @@ explanation = This search looks for AWS CloudTrail events where a user has creat
 how_to_implement = You must install the AWS App for Splunk.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - Detect New Open S3 Buckets over AWS CLI - Rule]
 type = detection
@@ -599,7 +609,7 @@ explanation = This search looks for AWS CloudTrail events where a user has creat
 how_to_implement = 
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - Detect shared ec2 snapshot - Rule]
 type = detection
@@ -609,7 +619,7 @@ explanation = The following analytic utilizes AWS CloudTrail events to identify
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule]
 type = detection
@@ -619,7 +629,7 @@ explanation = This search looks for a spike in number of of AWS security Hub ale
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Exploitation"], "nist": ["DE.DP"]}
 known_false_positives = None
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - GitHub Actions Disable Security Workflow - Rule]
 type = detection
@@ -629,7 +639,7 @@ explanation = This search detects a disabled security workflow in GitHub Actions
 how_to_implement = You must index GitHub logs. You can follow the url in reference to onboard GitHub logs. Sometimes GitHub logs are truncated, make sure to disable it in props.conf. Replace *security-testing* with the name of your security testing workflow in GitHub Actions.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.002", "T1195"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Github Commit Changes In Master - Rule]
 type = detection
@@ -639,7 +649,7 @@ explanation = This search is to detect a pushed or commit to master or main bran
 how_to_implement = To successfully implement this search, you need to be ingesting logs related to github logs having the fork, commit, push metadata that can be use to monitor the changes in a github project.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1199"]}
 known_false_positives = admin can do changes directly to master branch
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Github Commit In Develop - Rule]
 type = detection
@@ -649,7 +659,7 @@ explanation = This search is to detect a pushed or commit to develop branch. Thi
 how_to_implement = To successfully implement this search, you need to be ingesting logs related to github logs having the fork, commit, push metadata that can be use to monitor the changes in a github project.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1199"]}
 known_false_positives = admin can do changes directly to develop branch
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - GitHub Dependabot Alert - Rule]
 type = detection
@@ -659,7 +669,7 @@ explanation = This search looks for Dependabot Alerts in Github logs.
 how_to_implement = You must index GitHub logs. You can follow the url in reference to onboard GitHub logs.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001", "T1195"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - GitHub Pull Request from Unknown User - Rule]
 type = detection
@@ -669,7 +679,7 @@ explanation = This search looks for Pull Request from unknown user.
 how_to_implement = You must index GitHub logs. You can follow the url in reference to onboard GitHub logs.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1195.001", "T1195"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Gsuite Drive Share In External Email - Rule]
 type = detection
@@ -679,7 +689,7 @@ explanation = This search is to detect suspicious google drive or google docs fi
 how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1567.002", "T1567"]}
 known_false_positives = network admin or normal user may share files to customer and external team.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - GSuite Email Suspicious Attachment - Rule]
 type = detection
@@ -689,7 +699,7 @@ explanation = This search is to detect a suspicious attachment file extension in
 how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001", "T1566"]}
 known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Gsuite Email Suspicious Subject With Attachment - Rule]
 type = detection
@@ -699,7 +709,7 @@ explanation = This search is to detect a gsuite email contains suspicious subjec
 how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001", "T1566"]}
 known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Gsuite Email With Known Abuse Web Service Link - Rule]
 type = detection
@@ -709,7 +719,7 @@ explanation = This analytics is to detect a gmail containing a link that are kno
 how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001", "T1566"]}
 known_false_positives = normal email contains this link that are known application within the organization or network can be catched by this detection.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule]
 type = detection
@@ -719,7 +729,7 @@ explanation = This search is to detect a suspicious outbound e-mail from interna
 how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003", "T1048"]}
 known_false_positives = network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Gsuite Suspicious Shared File Name - Rule]
 type = detection
@@ -729,7 +739,7 @@ explanation = This search is to detect a shared file in google drive with suspic
 how_to_implement = To successfully implement this search, you need to be ingesting logs related to gsuite having the file attachment metadata like file type, file extension, source email, destination email, num of attachment and etc. In order for the search to work for your environment, please edit the query to use your company specific email domain instead of `internal_test_email.com`.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001", "T1566"]}
 known_false_positives = normal user or normal transaction may contain the subject and file type attachment that this detection try to search
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes Nginx Ingress LFI - Rule]
 type = detection
@@ -739,7 +749,7 @@ explanation = This search uses the Kubernetes logs from a nginx ingress controll
 how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes Nginx Ingress RFI - Rule]
 type = detection
@@ -749,7 +759,7 @@ explanation = This search uses the Kubernetes logs from a nginx ingress controll
 how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1212"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes Scanner Image Pulling - Rule]
 type = detection
@@ -759,7 +769,7 @@ explanation = This search uses the Kubernetes logs from Splunk Connect from Kube
 how_to_implement = You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1526"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - O365 Add App Role Assignment Grant User - Rule]
 type = detection
@@ -769,7 +779,7 @@ explanation = This search detects the creation of a new Federation setting by al
 how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1136.003", "T1136"]}
 known_false_positives = The creation of a new Federation is not necessarily malicious, however this events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - O365 Added Service Principal - Rule]
 type = detection
@@ -779,7 +789,7 @@ explanation = This search detects the creation of a new Federation setting by al
 how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1136.003", "T1136"]}
 known_false_positives = The creation of a new Federation is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - O365 Bypass MFA via Trusted IP - Rule]
 type = detection
@@ -789,7 +799,7 @@ explanation = This search detects newly added IP addresses/CIDR blocks to the li
 how_to_implement = You must install Splunk Microsoft Office 365 add-on. This search works with o365:management:activity
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007", "T1562"]}
 known_false_positives = Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - O365 Disable MFA - Rule]
 type = detection
@@ -799,7 +809,7 @@ explanation = This search detects when multi factor authentication has been disa
 how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1556"]}
 known_false_positives = Unless it is a special case, it is uncommon to disable MFA or Strong Authentication
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - O365 Excessive Authentication Failures Alert - Rule]
 type = detection
@@ -809,7 +819,7 @@ explanation = This search detects when an excessive number of authentication fai
 how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110"]}
 known_false_positives = The threshold for alert is above 10 attempts and this should reduce the number of false positives.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - O365 Excessive SSO logon errors - Rule]
 type = detection
@@ -819,7 +829,7 @@ explanation = This search detects accounts with high number of Single Sign ON (S
 how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1556"]}
 known_false_positives = Logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password obtained via credential access attack.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - O365 New Federated Domain Added - Rule]
 type = detection
@@ -829,7 +839,7 @@ explanation = This search detects the addition of a new Federated domain.
 how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1136.003", "T1136"]}
 known_false_positives = The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - O365 PST export alert - Rule]
 type = detection
@@ -839,7 +849,7 @@ explanation = This search detects when a user has performed an Ediscovery search
 how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114"]}
 known_false_positives = PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - O365 Suspicious Admin Email Forwarding - Rule]
 type = detection
@@ -849,7 +859,7 @@ explanation = This search detects when an admin configured a forwarding rule for
 how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003", "T1114"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - O365 Suspicious Rights Delegation - Rule]
 type = detection
@@ -859,7 +869,7 @@ explanation = This search detects the assignment of rights to accesss content fr
 how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002", "T1114"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = Service Accounts
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - O365 Suspicious User Email Forwarding - Rule]
 type = detection
@@ -869,7 +879,7 @@ explanation = This search detects when multiple user configured a forwarding rul
 how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003", "T1114"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Abnormally High AWS Instances Launched by User - Rule]
 type = detection
@@ -879,7 +889,7 @@ explanation = This search looks for AWS CloudTrail events where a user successfu
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. The threshold value should be tuned to your environment.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule]
 type = detection
@@ -889,7 +899,7 @@ explanation = This search looks for AWS CloudTrail events where a user successfu
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. The threshold value should be tuned to your environment.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - Abnormally High AWS Instances Terminated by User - Rule]
 type = detection
@@ -899,7 +909,7 @@ explanation = This search looks for AWS CloudTrail events where an abnormally hi
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = Many service accounts configured with your AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify whether this search alerted on a human user.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule]
 type = detection
@@ -909,7 +919,7 @@ explanation = This search looks for AWS CloudTrail events where a user successfu
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. The threshold value should be tuned to your environment.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule]
 type = detection
@@ -920,7 +930,7 @@ how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or lat
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]}
 known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
  This search will fire any time a new city is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your city, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule]
 type = detection
@@ -931,7 +941,7 @@ how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or lat
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]}
 known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching over plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
  This search will fire any time a new country is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule]
 type = detection
@@ -942,7 +952,7 @@ how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or lat
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Exploitation"], "nist": ["ID.AM"]}
 known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
  This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule]
 type = detection
@@ -953,7 +963,7 @@ how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or lat
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1535"], "nist": ["ID.AM"]}
 known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
  This search will fire any time a new region is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your region, there should be few false positives. If you are located in regions where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - Clients Connecting to Multiple DNS Servers - Rule]
 type = detection
@@ -965,7 +975,7 @@ This search produces fields (`dest_count`) that are not yet supported by ES Inci
 Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`
 annotations = {"cis20": ["CIS 9", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "PR.DS"]}
 known_false_positives = It's possible that an enterprise has more than five DNS servers that are configured in a round-robin rotation. Please customize the search, as appropriate.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Cloud Network Access Control List Deleted - Rule]
 type = detection
@@ -975,7 +985,7 @@ explanation = Enforcing network-access controls is one of the defensive mechanis
 how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You can also provide additional filtering for this search by customizing the `cloud_network_access_control_list_deleted_filter` macro.
 annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = It's possible that a user has legitimately deleted a network ACL.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - Detect API activity from users without MFA - Rule]
 type = detection
@@ -991,7 +1001,7 @@ This search produces fields (`eventName`,`userIdentity.type`,`userIdentity.arn`)
 Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "nist": ["DE.DP", "PR.AC"]}
 known_false_positives = Many service accounts configured within an AWS infrastructure do not have multi factor authentication enabled. Please ignore the service accounts, if triggered and instead add them to the aws_service_accounts.csv file to fine tune the detection. It is also possible that the search detects users in your environment using Single Sign-On systems, since the MFA is not handled by AWS.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - Detect AWS API Activities From Unapproved Accounts - Rule]
 type = detection
@@ -1007,7 +1017,7 @@ This search produces fields (`eventName`,`firstTime`,`lastTime`) that are not ye
 Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC", "ID.AM"]}
 known_false_positives = It's likely that you'll find activity detected by users/service accounts that are not listed in the `identity_lookup_expanded` or ` aws_service_accounts.csv` file. If the user is a legitimate service account, update the `aws_service_accounts.csv` table with that entry.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule]
 type = detection
@@ -1021,7 +1031,7 @@ If Splunk>Phantom is also configured in your environment, a Playbook called `Let
 
 annotations = {"cis20": ["CIS 8", "CIS 7"], "kill_chain_phases": ["Delivery", "Command \u0026 Control"], "mitre_attack": ["T1566.003"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]}
 known_false_positives = If a known good domain is not listed in the legit_domains.csv file, then the search could give you false postives. Please update that lookup file to filter out DNS requests to legitimate domains.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Long DNS TXT Record Response - Rule]
 type = detection
@@ -1031,7 +1041,7 @@ explanation = This search is used to detect attempts to use DNS tunneling, by ca
 how_to_implement = To successfully implement this search you need to ingest data from your DNS logs, or monitor DNS traffic using Stream, Bro or something similar. Specifically, this query requires that the DNS data model is populated with information regarding the DNS record type that is being returned as well as the data in the answer section of the protocol.
 annotations = {"cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]}
 known_false_positives = It's possible that legitimate TXT record responses can be long enough to trigger this search. You can modify the packet threshold for this search to help mitigate false positives.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule]
 type = detection
@@ -1041,7 +1051,7 @@ explanation = This search looks for PowerShell requesting privileges consistent
 how_to_implement = You must be ingesting Windows Security logs. You must also enable the account change auditing here: http://docs.splunk.com/Documentation/Splunk/7.0.2/Data/MonitorWindowseventlogdata. Additionally, this search requires you to enable your Group Management Audit Logs in your Local Windows Security Policy and to be ingesting those logs.  More information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/. Finally, please make sure that the local administrator group name is "Administrators" to be able to look for the right group membership changes.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["PR.IP", "PR.AC", "DE.CM"]}
 known_false_positives = The activity may be legitimate. PowerShell is often used by administrators to perform various tasks, and it's possible this event could be generated in those cases. In these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Detect new API calls from user roles - Rule]
 type = detection
@@ -1051,7 +1061,7 @@ explanation = This search detects new API calls that have either never been seen
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously seen API call per user roles in AWS CloudTrail" support search once to create a history of previously seen user roles.
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]}
 known_false_positives = It is possible that there are legitimate user roles making new or infrequently used API calls in your infrastructure, causing the search to trigger.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - Detect new user AWS Console Login - Rule]
 type = detection
@@ -1061,7 +1071,7 @@ explanation = This search looks for AWS CloudTrail events wherein a console logi
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Run the "Previously seen users in AWS CloudTrail" support search only once to create a baseline of previously seen IAM users within the last 30 days. Run "Update previously seen users in AWS CloudTrail" hourly (or more frequently depending on how often you run the detection searches) to refresh the baselines.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - Detect Spike in AWS API Activity - Rule]
 type = detection
@@ -1077,7 +1087,7 @@ This search produces fields (`eventName`,`numberOfApiCalls`,`uniqueApisCalled`)
 Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
 known_false_positives = 
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - Detect Spike in Network ACL Activity - Rule]
 type = detection
@@ -1087,7 +1097,7 @@ explanation = This search will detect users creating spikes in API activity rela
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of Network ACL Activity by ARN" support search once to create a lookup file of previously seen Network ACL Activity. To add or remove API event names related to network ACLs, edit the macro `network_acl_events`.
 annotations = {"cis20": ["CIS 12", "CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
 known_false_positives = The false-positive rate may vary based on the values of`dataPointThreshold` and `deviationThreshold`. Please modify this according the your environment.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - Detect Spike in Security Group Activity - Rule]
 type = detection
@@ -1097,7 +1107,7 @@ explanation = This search will detect users creating spikes in API activity rela
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike.This search works best when you run the "Baseline of Security Group Activity by ARN" support search once to create a history of previously seen Security Group Activity. To add or remove API event names for security groups, edit the macro `security_group_api_calls`.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
 known_false_positives = Based on the values of`dataPointThreshold` and `deviationThreshold`, the false positive rate may vary. Please modify this according the your environment.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - Detect USB device insertion - Rule]
 type = detection
@@ -1107,7 +1117,7 @@ explanation = The search is used to detect hosts that generate Windows Event ID
 how_to_implement = To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663 and 4656. Ensure that the field from the event logs is being mapped to the result_id field in the Change_Analysis data model. To minimize the alert volume, this search leverages the Assets and Identity framework to filter out events from those assets not marked high priority in the Enterprise Security Assets and Identity Framework.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "nist": ["PR.PT", "PR.DS"]}
 known_false_positives = Legitimate USB activity will also be detected. Please verify and investigate as appropriate.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect web traffic to dynamic domain providers - Rule]
 type = detection
@@ -1119,7 +1129,7 @@ This search produces fields (`isDynDNS`) that are not yet supported by ES Incide
 Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` Deprecated because duplicate.
 annotations = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1071.001"], "nist": ["PR.IP", "DE.DP"]}
 known_false_positives = It is possible that list of dynamic DNS providers is outdated and/or that the URL being requested is legitimate.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detection of DNS Tunnels - Rule]
 type = detection
@@ -1130,7 +1140,7 @@ NOTE:Deprecated because existing detection is doing the same. This detection is
 how_to_implement = To successfully implement this search, we must ensure that DNS data is being ingested and mapped to the appropriate fields in the Network_Resolution data model. Fields like src_category are automatically provided by the Assets and Identity Framework shipped with Splunk Enterprise Security. You will need to ensure you are using the Assets and Identity Framework and populating the src_category field. You will also need to enable the `cim_corporate_web_domain_search()` macro which will essentially filter out the DNS queries made to the corporate web domains to reduce alert fatigue.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"]}
 known_false_positives = It's possible that normal DNS traffic will exhibit this behavior. If an alert is generated, please investigate and validate as appropriate. The threshold can also be modified to better suit your environment.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule]
 type = detection
@@ -1140,7 +1150,7 @@ explanation = This search will detect DNS requests resolved by unauthorized DNS
 how_to_implement = To successfully implement this search you will need to ensure that DNS data is populating the Network_Resolution data model. It also requires that your DNS servers are identified correctly in the Assets and Identity table of Enterprise Security.
 annotations = {"cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1071.004"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]}
 known_false_positives = Legitimate DNS activity can be detected in this search. Investigate, verify and update the list of authorized DNS servers as appropriate.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - DNS record changed - Rule]
 type = detection
@@ -1154,7 +1164,7 @@ If Splunk>Phantom is also configured in your environment, a Playbook called "DNS
 
 annotations = {"cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1071.004"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]}
 known_false_positives = Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Dump LSASS via procdump Rename - Rule]
 type = detection
@@ -1165,7 +1175,7 @@ During triage, confirm this is procdump.exe executing. If it is the first time a
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]}
 known_false_positives = None identified.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - EC2 Instance Modified With Previously Unseen User - Rule]
 type = detection
@@ -1175,7 +1185,7 @@ explanation = This search looks for EC2 instances being modified by users who ha
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]}
 known_false_positives = It's possible that a new user will start to modify EC2 instances when they haven't before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - EC2 Instance Started In Previously Unseen Region - Rule]
 type = detection
@@ -1185,7 +1195,7 @@ explanation = This search looks for AWS CloudTrail events where an instance is s
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. Run the "Previously seen AWS Regions" support search only once to create of baseline of previously seen regions.  This search is deprecated and have been translated to use the latest Change Datamodel.
 annotations = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - EC2 Instance Started With Previously Unseen AMI - Rule]
 type = detection
@@ -1195,7 +1205,7 @@ explanation = This search looks for EC2 instances being created with previously
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 AMIs" support search once to create a history of previously seen AMIs.
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Exploitation"], "nist": ["ID.AM"]}
 known_false_positives = After a new AMI is created, the first systems created with that AMI will cause this alert to fire.  Verify that the AMI being used was created by a legitimate user.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule]
 type = detection
@@ -1205,7 +1215,7 @@ explanation = This search looks for EC2 instances being created with previously
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Instance Types" support search once to create a history of previously seen instance types.
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Exploitation"], "nist": ["ID.AM"]}
 known_false_positives = It is possible that an admin will create a new system using a new instance type never used before. Verify with the creator that they intended to create the system with the new instance type.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - EC2 Instance Started With Previously Unseen User - Rule]
 type = detection
@@ -1215,7 +1225,7 @@ explanation = This search looks for EC2 instances being created by users who hav
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. This search works best when you run the "Previously Seen EC2 Launches By User" support search once to create a history of previously seen ARNs.
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]}
 known_false_positives = It's possible that a user will start to create EC2 instances when they haven't before for any number of reasons. Verify with the user that is launching instances that this is the intended behavior.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - Execution of File With Spaces Before Extension - Rule]
 type = detection
@@ -1225,7 +1235,7 @@ explanation = This search looks for processes launched from files with at least
 how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"]}
 known_false_positives = None identified.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Extended Period Without Successful Netbackup Backups - Rule]
 type = detection
@@ -1235,7 +1245,7 @@ explanation = This search returns a list of hosts that have not successfully com
 how_to_implement = To successfully implement this search you need to first obtain data from your backup solution, either from the backup logs on your hosts, or from a central server responsible for performing the backups. If you do not use Netbackup, you can modify this search for your backup solution. Depending on how often you backup your systems, you may want to modify how far in the past to look for a successful backup, other than the default of seven days.
 annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "nist": ["PR.IP"]}
 known_false_positives = None identified
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - First time seen command line argument - Rule]
 type = detection
@@ -1245,7 +1255,7 @@ explanation = This search looks for command-line arguments that use a `/c` param
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. Please make sure you run the support search "Previously seen command line arguments,"&#151;which creates a lookup file called `previously_seen_cmd_line_arguments.csv`&#151;a historical baseline of all command-line arguments. You must also validate this list. For the search to do accurate calculation, ensure the search scheduling is the same value as the `relative_time` evaluation function.
 annotations = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1059.001", "T1059.003"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
 known_false_positives = Legitimate programs can also use command-line arguments to execute. Please verify the command-line arguments to check what command/program is being executed. We recommend customizing the `first_time_seen_cmd_line_filter` macro to exclude legitimate parent_process_name
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - GCP Detect accounts with high risk roles by project - Rule]
 type = detection
@@ -1255,7 +1265,7 @@ explanation = This search provides detection of accounts with high risk roles by
 how_to_implement = You must install splunk GCP add-on. This search works with gcp:pubsub:message logs
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078"]}
 known_false_positives = Accounts with high risk roles should be reduced to the minimum number needed, however specific tasks and setups may be simply expected behavior within organization
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - GCP Detect high risk permissions by resource and account - Rule]
 type = detection
@@ -1265,7 +1275,7 @@ explanation = This search provides detection of high risk permissions by resourc
 how_to_implement = You must install splunk GCP add-on. This search works with gcp:pubsub:message logs
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078"]}
 known_false_positives = High risk permissions are part of any GCP environment, however it is important to track resource and accounts usage, this search may produce false positives.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - gcp detect oauth token abuse - Rule]
 type = detection
@@ -1275,17 +1285,7 @@ explanation = This search provides detection of possible GCP Oauth token abuse.
 how_to_implement = You must install splunk GCP add-on. This search works with gcp:pubsub:message logs
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078"]}
 known_false_positives = GCP Oauth token abuse detection will only work if there are access policies in place along with audit logs.
-providing_technologies = []
-
-[savedsearch://ESCU - GCP GCR container uploaded - Rule]
-type = detection
-asset_type = GCP GCR Container
-confidence = medium
-explanation = This search show information on uploaded containers including source user, account, action, bucket name event name, http user agent, message and destination path.
-how_to_implement = You must install the GCP App for Splunk (version 2.0.0 or later), then configure stackdriver and set a subpub subscription to be imported to Splunk. You must also install Cloud Infrastructure data model. Please also customize the `container_implant_gcp_detection_filter` macro to filter out the false positives.
-annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1525"]}
-known_false_positives = Uploading container is a normal behavior from developers or users with access to container registry. GCP GCR registers container upload as a Storage event, this search must be considered under the context of CONTAINER upload creation which automatically generates a bucket entry for destination path.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - GCP Kubernetes cluster scan detection - Rule]
 type = detection
@@ -1295,7 +1295,7 @@ explanation = This search provides information of unauthenticated requests via u
 how_to_implement = You must install the GCP App for Splunk (version 2.0.0 or later), then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk. You must also install Cloud Infrastructure data model.Customize the macro kubernetes_gcp_scan_fingerprint_attack_detection to filter out FPs.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]}
 known_false_positives = Not all unauthenticated requests are malicious, but frequency, User Agent and source IPs will provide context.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Identify New User Accounts - Rule]
 type = detection
@@ -1305,7 +1305,7 @@ explanation = This detection search will help profile user accounts in your envi
 how_to_implement = To successfully implement this search, you need to be populating the Enterprise Security Identity_Management data model in the assets and identity framework.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078.002"], "nist": ["PR.IP"]}
 known_false_positives = If the Identity_Management data model is not updated regularly, this search could give you false positive alerts. Please consider this and investigate appropriately.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes AWS detect most active service accounts by pod - Rule]
 type = detection
@@ -1315,7 +1315,7 @@ explanation = This search provides information on Kubernetes service accounts,ac
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs
 annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = Not all service accounts interactions are malicious. Analyst must consider IP, verb and decision context when trying to detect maliciousness.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes AWS detect RBAC authorization by account - Rule]
 type = detection
@@ -1325,7 +1325,7 @@ explanation = This search provides information on Kubernetes RBAC authorizations
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs
 annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = Not all RBAC Authorications are malicious. RBAC authorizations can uncover malicious activity specially if sensitive Roles have been granted.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule]
 type = detection
@@ -1335,7 +1335,7 @@ explanation = This search provides information on Kubernetes accounts accessing
 how_to_implement = You must install Splunk Add-on for Amazon Web Services and Splunk App for AWS. This search works with cloudwatch logs.
 annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes AWS detect sensitive role access - Rule]
 type = detection
@@ -1345,7 +1345,7 @@ explanation = This search provides information on Kubernetes accounts accessing
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs.
 annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = Sensitive role resource access is necessary for cluster operation, however source IP, namespace and user group may indicate possible malicious use. 
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule]
 type = detection
@@ -1355,7 +1355,7 @@ explanation = This search provides information on Kubernetes service accounts wi
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs.
 annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = This search can give false positives as there might be inherent issues with authentications and permissions at cluster.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes Azure active service accounts by pod namespace - Rule]
 type = detection
@@ -1365,7 +1365,7 @@ explanation = This search provides information on Kubernetes service accounts,ac
 how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
 annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = Not all service accounts interactions are malicious. Analyst must consider IP and verb context when trying to detect maliciousness.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes Azure detect RBAC authorization by account - Rule]
 type = detection
@@ -1375,7 +1375,7 @@ explanation = This search provides information on Kubernetes RBAC authorizations
 how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
 annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = Not all RBAC Authorications are malicious. RBAC authorizations can uncover malicious activity specially if sensitive Roles have been granted.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes Azure detect sensitive object access - Rule]
 type = detection
@@ -1385,7 +1385,7 @@ explanation = This search provides information on Kubernetes accounts accessing
 how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
 annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes Azure detect sensitive role access - Rule]
 type = detection
@@ -1395,7 +1395,7 @@ explanation = This search provides information on Kubernetes accounts accessing
 how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
 annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = Sensitive role resource access is necessary for cluster operation, however source IP, namespace and user group may indicate possible malicious use. 
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule]
 type = detection
@@ -1405,7 +1405,7 @@ explanation = This search provides information on Kubernetes service accounts wi
 how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
 annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = This search can give false positives as there might be inherent issues with authentications and permissions at cluster.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule]
 type = detection
@@ -1415,7 +1415,7 @@ explanation = This search provides information on rare Kubectl calls with IP, ve
 how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
 annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = Kubectl calls are not malicious by nature. However source IP, verb and Object can reveal potential malicious activity, specially suspicious IPs and sensitive objects such as configmaps or secrets
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes Azure pod scan fingerprint - Rule]
 type = detection
@@ -1425,7 +1425,7 @@ explanation = This search provides information of unauthenticated requests via s
 how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
 annotations = {"kill_chain_phases": ["Reconnaissance"]}
 known_false_positives = Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, request URI and response status will provide context.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes Azure scan fingerprint - Rule]
 type = detection
@@ -1435,7 +1435,7 @@ explanation = This search provides information of unauthenticated requests via s
 how_to_implement = You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]}
 known_false_positives = Not all unauthenticated requests are malicious, but source IPs, userAgent, verb, request URI and response status will provide context.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule]
 type = detection
@@ -1445,7 +1445,7 @@ explanation = This search provides information on Kubernetes RBAC authorizations
 how_to_implement = You must install splunk AWS add on for GCP. This search works with pubsub messaging service logs
 annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = Not all RBAC Authorications are malicious. RBAC authorizations can uncover malicious activity specially if sensitive Roles have been granted.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes GCP detect most active service accounts by pod - Rule]
 type = detection
@@ -1455,7 +1455,7 @@ explanation = This search provides information on Kubernetes service accounts,ac
 how_to_implement = You must install splunk GCP add on. This search works with pubsub messaging service logs
 annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = Not all service accounts interactions are malicious. Analyst must consider IP, verb and decision context when trying to detect maliciousness.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes GCP detect sensitive object access - Rule]
 type = detection
@@ -1465,7 +1465,7 @@ explanation = This search provides information on Kubernetes accounts accessing
 how_to_implement = You must install splunk add on for GCP . This search works with pubsub messaging service logs.
 annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = Sensitive object access is not necessarily malicious but user and object context can provide guidance for detection.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes GCP detect sensitive role access - Rule]
 type = detection
@@ -1475,7 +1475,7 @@ explanation = This search provides information on Kubernetes accounts accessing
 how_to_implement = You must install splunk add on for GCP. This search works with pubsub messaging servicelogs.
 annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = Sensitive role resource access is necessary for cluster operation, however source IP, user agent, decision and reason may indicate possible malicious use. 
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule]
 type = detection
@@ -1485,7 +1485,7 @@ explanation = This search provides information on Kubernetes service accounts wi
 how_to_implement = You must install splunk add on for GCP. This search works with pubsub messaging service logs.
 annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = This search can give false positives as there might be inherent issues with authentications and permissions at cluster.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule]
 type = detection
@@ -1495,7 +1495,7 @@ explanation = This search provides information on anonymous Kubectl calls with I
 how_to_implement = You must install splunk add on for GCP. This search works with pubsub messaging logs.
 annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = Kubectl calls are not malicious by nature. However source IP, source user, user agent, object path, and authorization context can reveal potential malicious activity, specially anonymous suspicious IPs and sensitive objects such as configmaps or secrets
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Monitor DNS For Brand Abuse - Rule]
 type = detection
@@ -1505,7 +1505,7 @@ explanation = This search looks for DNS requests for faux domains similar to the
 how_to_implement = You need to ingest data from your DNS logs. Specifically you must ingest the domain that is being queried and the IP of the host originating the request. Ideally, you should also be ingesting the answer to the query and the query type. This approach allows you to also create your own localized passive DNS capability which can aid you in future investigations. You also need to have run the search "ESCU - DNSTwist Domain Names", which creates the permutations of the domain that will be checked for. You also need the [`dnstwist`](https://gist.github.com/d1vious/c4c2aae7fa7d5cbb1f24adc5f6303) custom command.
 annotations = {"kill_chain_phases": ["Delivery", "Actions on Objectives"]}
 known_false_positives = None at this time
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Open Redirect in Splunk Web - Rule]
 type = detection
@@ -1515,7 +1515,7 @@ explanation = This search allows you to look for evidence of exploitation for CV
 how_to_implement = No extra steps needed to implement this search.
 annotations = {"cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"]}
 known_false_positives = None identified
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Osquery pack - ColdRoot detection - Rule]
 type = detection
@@ -1525,7 +1525,7 @@ explanation = This search looks for ColdRoot events from the osx-attacks osquery
 how_to_implement = In order to properly run this search, Splunk needs to ingest data from your osquery deployed agents with the [osx-attacks.conf](https://github.com/facebook/osquery/blob/experimental/packs/osx-attacks.conf#L599) pack enabled. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the Alerts data model
 annotations = {"cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Installation", "Command \u0026 Control"], "nist": ["DE.DP", "DE.CM", "PR.PT"]}
 known_false_positives = There are no known false positives.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Processes created by netsh - Rule]
 type = detection
@@ -1535,7 +1535,7 @@ explanation = This search looks for processes launching netsh.exe to execute var
 how_to_implement = To successfully implement this search, you must be ingesting logs with the process name, command-line arguments, and parent processes from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = It is unusual for netsh.exe to have any child processes in most environments. It makes sense to investigate the child process and verify whether the process spawned is legitimate. We explicitely exclude "C:\Program Files\rempl\sedlauncher.exe" process path since it is a legitimate process by Mircosoft.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Prohibited Software On Endpoint - Rule]
 type = detection
@@ -1545,7 +1545,7 @@ explanation = This search looks for applications on the endpoint that you have m
 how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report process tracking in your Windows audit settings. In addition, you must also have only the `process_name` (not the entire process path) marked as "prohibited" in the Enterprise Security `interesting processes` table. To include the process names marked as "prohibited", which is included with ES Content Updates, run the included search <code>Add Prohibited Processes to Enterprise Security</code>.
 annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command \u0026 Control", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]}
 known_false_positives = None identified
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Reg exe used to hide files directories via registry keys - Rule]
 type = detection
@@ -1555,7 +1555,7 @@ explanation = The search looks for command-line arguments used to hide a file or
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1564.001"], "nist": ["DE.CM"]}
 known_false_positives = None at the moment
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Remote Registry Key modifications - Rule]
 type = detection
@@ -1565,7 +1565,7 @@ explanation = This search monitors for remote modifications to registry keys.
 how_to_implement = To successfully implement this search, you must populate the `Endpoint` data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. Deprecated because I don't think the logic is right.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = This technique may be legitimately used by administrators to modify remote registries, so it's important to filter these events out.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Scheduled tasks used in BadRabbit ransomware - Rule]
 type = detection
@@ -1575,7 +1575,7 @@ explanation = This search looks for flags passed to schtasks.exe on the command-
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]}
 known_false_positives = No known false positives
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Spectre and Meltdown Vulnerable Systems - Rule]
 type = detection
@@ -1585,7 +1585,7 @@ explanation = The search is used to detect systems that are still vulnerable to
 how_to_implement = The search requires that you are ingesting your vulnerability-scanner data and that it reports the CVE of the vulnerability identified.
 annotations = {"cis20": ["CIS 4"], "kill_chain_phases": ["Exploitation"], "nist": ["ID.RA", "RS.MI", "PR.IP", "DE.CM"]}
 known_false_positives = It is possible that your vulnerability scanner is not detecting that the patches have been applied.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Splunk Enterprise Information Disclosure - Rule]
 type = detection
@@ -1595,7 +1595,7 @@ explanation = This search allows you to look for evidence of exploitation for CV
 how_to_implement = The REST endpoint that exposes system information is also necessary for the proper operation of Splunk clustering and instrumentation. Whitelisting your Splunk systems will reduce false positives.
 annotations = {"cis20": ["CIS 3", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.AC", "PR.IP", "DE.CM"]}
 known_false_positives = Retrieving server information may be a legitimate API request. Verify that the attempt is a valid request for information.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Suspicious Changes to File Associations - Rule]
 type = detection
@@ -1605,7 +1605,7 @@ explanation = This search looks for changes to registry values that control Wind
 how_to_implement = To successfully implement this search you need to be ingesting information on registry changes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` nodes.
 annotations = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.001"], "nist": ["DE.CM", "PR.PT", "PR.IP"]}
 known_false_positives = There may be other processes in your environment that users may legitimately use to modify file associations. If this is the case and you are finding false positives, you can modify the search to add those processes as exceptions.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Suspicious Email - UBA Anomaly - Rule]
 type = detection
@@ -1615,7 +1615,7 @@ explanation = This detection looks for emails that are suspicious because of the
 how_to_implement = You must be ingesting data from email logs and have Splunk integrated with UBA. This anomaly is raised by a UBA detection model called  "SuspiciousEmailDetectionModel." Ensure that this model is enabled on your UBA instance.
 annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566"], "nist": ["PR.IP"]}
 known_false_positives = This detection model will alert on any sender domain that is seen for the first time. This could be a potential false positive. The next step is to investigate and add the URL to an allow list if you determine that it is a legitimate sender.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Suspicious File Write - Rule]
 type = detection
@@ -1625,7 +1625,7 @@ explanation = The search looks for files created with names that have been linke
 how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes. In addition, this search leverages an included lookup file that contains the names of the files to watch for, as well as a note to communicate why that file name is being monitored. This lookup file can be edited to add or remove file the file names you want to monitor.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = It's possible for a legitimate file to be created with the same name as one noted in the lookup file. Filenames listed in the lookup file should be unique enough that collisions are rare. Looking at the location of the file and the process responsible for the activity can help determine whether or not the activity is legitimate.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Suspicious Powershell Command-Line Arguments - Rule]
 type = detection
@@ -1635,7 +1635,7 @@ explanation = This search looks for PowerShell processes started with a base64 e
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
 known_false_positives = Legitimate process can have this combination of command-line options, but it's not common.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious Rundll32 Rename - Rule]
 type = detection
@@ -1645,7 +1645,7 @@ explanation = The following hunting analytic identifies renamed instances of run
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1036", "T1218.011", "T1036.003"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious writes to System Volume Information - Rule]
 type = detection
@@ -1655,7 +1655,7 @@ explanation = This search detects writes to the 'System Volume Information' fold
 how_to_implement = You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"], "nist": ["DE.CM"]}
 known_false_positives = It is possible that other utilities or system processes may legitimately write to this folder. Investigate and modify the search to include exceptions as appropriate.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Uncommon Processes On Endpoint - Rule]
 type = detection
@@ -1665,7 +1665,7 @@ explanation = This search looks for applications on the endpoint that you have m
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. This search uses a lookup file `uncommon_processes_default.csv` to track various features of process names that are usually uncommon in most environments. Please consider updating `uncommon_processes_local.csv` to hunt for processes that are uncommon in your environment.
 annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.002"], "nist": ["ID.AM", "PR.DS"]}
 known_false_positives = None identified
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Unsigned Image Loaded by LSASS - Rule]
 type = detection
@@ -1675,7 +1675,7 @@ explanation = This search detects loading of unsigned images by LSASS. Deprecate
 how_to_implement = This search needs Sysmon Logs with a sysmon configuration, which includes EventCode 7 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
 annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]}
 known_false_positives = Other tools could load images into LSASS for legitimate reason. But enterprise tools should always use signed DLLs.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Unsuccessful Netbackup backups - Rule]
 type = detection
@@ -1685,7 +1685,7 @@ explanation = This search gives you the hosts where a backup was attempted and t
 how_to_implement = To successfully implement this search you need to obtain data from your backup solution, either from the backup logs on your endpoints or from a central server responsible for performing the backups. If you do not use Netbackup, you can modify this search for your specific backup solution.
 annotations = {"cis20": ["CIS 10"], "kill_chain_phases": ["Exploitation"], "nist": ["PR.IP"]}
 known_false_positives = None identified
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Web Fraud - Account Harvesting - Rule]
 type = detection
@@ -1695,7 +1695,7 @@ explanation = This search is used to identify the creation of multiple user acco
 how_to_implement = We start with a dataset that provides visibility into the email address used for the account creation. In this example, we are narrowing our search down to the single web page that hosts the Magento2 e-commerce platform (via URI) used for account creation, the single http content-type to grab only the user's clicks, and the http field that provides the username (form_data), for performance reasons.  After we have the username and email domain, we look for numerous account creations per email domain.  Common data sources used for this detection are customized Apache logs or Splunk Stream.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136"], "nist": ["DE.CM", "DE.DP"]}
 known_false_positives = As is common with many fraud-related searches, we are usually looking to attribute risk or synthesize relevant context with loosely written detections that simply detect anamolous behavior. This search will need to be customized to fit your environment&#151;improving its fidelity by counting based on something much more specific, such as a device ID that may be present in your dataset. Consideration for whether the large number of registrations are occuring from a first-time seen domain may also be important.  Extending the search window to look further back in time, or even calculating the average per hour/day for each email domain to look for an anomalous spikes, will improve this search.  You can also use Shannon entropy or Levenshtein Distance (both courtesy of URL Toolbox) to consider the randomness or similarity of the email name or email domain, as the names are often machine-generated.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Web Fraud - Anomalous User Clickspeed - Rule]
 type = detection
@@ -1705,7 +1705,7 @@ explanation = This search is used to examine web sessions to identify those wher
 how_to_implement = Start with a dataset that allows you to see clickstream data for each user click on the website. That data must have a time stamp and must contain a reference to the session identifier being used by the website. This ties the clicks together into clickstreams. This value is usually found in the http cookie. With a bit of tuning, a version of this search could be used in high-volume scenarios, such as scraping, crawling, application DDOS, credit-card testing, account takeover, etc. Common data sources used for this detection are customized Apache logs, customized IIS, and Splunk Stream.
 annotations = {"cis20": ["CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078"], "nist": ["DE.AE", "DE.CM"]}
 known_false_positives = As is common with many fraud-related searches, we are usually looking to attribute risk or synthesize relevant context with loosly written detections that simply detect anamoluous behavior.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Web Fraud - Password Sharing Across Accounts - Rule]
 type = detection
@@ -1715,7 +1715,7 @@ explanation = This search is used to identify user accounts that share a common
 how_to_implement = We need to start with a dataset that allows us to see the values of usernames and passwords that users are submitting to the website hosting the Magento2 e-commerce platform (commonly found in the HTTP form_data field). A tokenized or hashed value of a password is acceptable and certainly preferable to a clear-text password. Common data sources used for this detection are customized Apache logs, customized IIS, and Splunk Stream.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "nist": ["DE.DP"]}
 known_false_positives = As is common with many fraud-related searches, we are usually looking to attribute risk or synthesize relevant context with loosely written detections that simply detect anamoluous behavior.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Windows connhost exe started forcefully - Rule]
 type = detection
@@ -1725,7 +1725,7 @@ explanation = The search looks for the Console Window Host process (connhost.exe
 how_to_implement = You must be ingesting data that records the process-system activity from your hosts to populate the Endpoint Processes data-model object. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = This process should not be ran forcefully, we have not see any false positives for this detection
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Windows hosts file modification - Rule]
 type = detection
@@ -1735,7 +1735,7 @@ explanation = The search looks for modifications to the hosts file on all Window
 how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes.
 annotations = {"cis20": ["CIS 3", "CIS 8", "CIS 12"], "kill_chain_phases": ["Command \u0026 Control"], "nist": ["PR.IP", "PR.PT", "PR.AC", "DE.AE", "DE.CM"]}
 known_false_positives = There may be legitimate reasons for system administrators to add entries to this file.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - 7zip CommandLine To SMB Share Path - Rule]
 type = detection
@@ -1745,7 +1745,7 @@ explanation = This search is to detect a suspicious 7z process with commandline
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed 7z.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001", "T1560"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Access LSASS Memory for Dump Creation - Rule]
 type = detection
@@ -1755,7 +1755,7 @@ explanation = Detect memory dumping of the LSASS process.
 how_to_implement = This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
 annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"]}
 known_false_positives = Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Account Discovery With Net App - Rule]
 type = detection
@@ -1765,7 +1765,7 @@ explanation = this search is to detect a potential account discovery series of c
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product..
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]}
 known_false_positives = admin or power user may used this series of command.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Active Setup Registry Autostart - Rule]
 type = detection
@@ -1775,7 +1775,7 @@ explanation = This analytic is to detect a suspicious modification of the active
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.014", "T1547"]}
 known_false_positives = Active setup installer may add or modify this registry.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Add DefaultUser And Password In Registry - Rule]
 type = detection
@@ -1785,7 +1785,7 @@ explanation = this search is to detect a suspicious registry modification to imp
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552.002", "T1552"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Add or Set Windows Defender Exclusion - Rule]
 type = detection
@@ -1795,7 +1795,7 @@ explanation = This analytic will identify a suspicious process command-line rela
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = Admin or user may choose to use this windows features. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - AdsiSearcher Account Discovery - Rule]
 type = detection
@@ -1805,7 +1805,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Allow File And Printing Sharing In Firewall - Rule]
 type = detection
@@ -1815,7 +1815,7 @@ explanation = This search is to detect a suspicious modification of firewall to
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007", "T1562"]}
 known_false_positives = network admin may modify this firewall feature that may cause this rule to be triggered.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule]
 type = detection
@@ -1825,7 +1825,7 @@ explanation = This analytic detects a potential suspicious modification of firew
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"]}
 known_false_positives = network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Allow Inbound Traffic In Firewall Rule - Rule]
 type = detection
@@ -1835,7 +1835,7 @@ explanation = The following analytic identifies suspicious PowerShell command to
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"]}
 known_false_positives = administrator may allow inbound traffic in certain network or machine.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Allow Network Discovery In Firewall - Rule]
 type = detection
@@ -1845,7 +1845,7 @@ explanation = This search is to detect a suspicious modification to the firewall
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.007", "T1562"]}
 known_false_positives = network admin may modify this firewall feature that may cause this rule to be triggered.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Allow Operation with Consent Admin - Rule]
 type = detection
@@ -1855,7 +1855,7 @@ explanation = This analytic identifies a potential privilege escalation attempt
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Anomalous usage of 7zip - Rule]
 type = detection
@@ -1865,7 +1865,7 @@ explanation = The following detection identifies a 7z.exe spawned from `Rundll32
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001", "T1560"]}
 known_false_positives = False positives should be limited as this behavior is not normal for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Any Powershell DownloadFile - Rule]
 type = detection
@@ -1875,7 +1875,7 @@ explanation = The following analytic identifies the use of PowerShell downloadin
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001", "T1105"]}
 known_false_positives = False positives may be present and filtering will need to occur by parent process or command line argument. It may be required to modify this query to an EDR product for more granular coverage.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Any Powershell DownloadString - Rule]
 type = detection
@@ -1885,7 +1885,7 @@ explanation = The following analytic identifies the use of PowerShell downloadin
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001", "T1105"]}
 known_false_positives = False positives may be present and filtering will need to occur by parent process or command line argument. It may be required to modify this query to an EDR product for more granular coverage.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Attacker Tools On Endpoint - Rule]
 type = detection
@@ -1895,7 +1895,7 @@ explanation = This search looks for execution of commonly used attacker tools on
 how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report process tracking in your Windows audit settings.
 annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1036.005", "T1036", "T1003", "T1595"], "nist": ["ID.AM", "PR.DS"]}
 known_false_positives = Some administrator activity can be potentially triggered, please add those users to the filter macro.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Attempt To Add Certificate To Untrusted Store - Rule]
 type = detection
@@ -1905,7 +1905,7 @@ explanation = Attempt To Add Certificate To Untrusted Store
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1553.004", "T1553"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
 known_false_positives = There may be legitimate reasons for administrators to add a certificate to the untrusted certificate store. In such cases, this will typically be done on a large number of systems.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Attempt To Stop Security Service - Rule]
 type = detection
@@ -1915,7 +1915,7 @@ explanation = This search looks for attempts to stop security-related services o
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
 known_false_positives = None identified. Attempts to disable security-related services should be identified and understood.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Attempted Credential Dump From Registry via Reg exe - Rule]
 type = detection
@@ -1925,7 +1925,7 @@ explanation = Monitor for execution of reg.exe with parameters specifying an exp
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.002", "T1003"], "nist": ["DE.CM"]}
 known_false_positives = None identified.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Auto Admin Logon Registry Entry - Rule]
 type = detection
@@ -1935,7 +1935,7 @@ explanation = this search is to detect a suspicious registry modification to imp
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1552.002", "T1552"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Batch File Write to System32 - Rule]
 type = detection
@@ -1945,7 +1945,7 @@ explanation = The search looks for a batch file (.bat) written to the Windows sy
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1204", "T1204.002"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = It is possible for this search to generate a notable event for a batch file write to a path that includes the string "system32", but is not the actual Windows system directory. As such, you should confirm the path of the batch file identified by the search. In addition, a false positive may be generated by an administrator copying a legitimate batch file in this directory tree. You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Bcdedit Command Back To Normal Mode Boot - Rule]
 type = detection
@@ -1955,7 +1955,7 @@ explanation = This search is to detect a suspicious bcdedit commandline to confi
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - BCDEdit Failure Recovery Modification - Rule]
 type = detection
@@ -1965,7 +1965,7 @@ explanation = This search looks for flags passed to bcdedit.exe modifications to
 how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. Tune based on parent process names.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"]}
 known_false_positives = Administrators may modify the boot configuration.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - BITS Job Persistence - Rule]
 type = detection
@@ -1975,7 +1975,7 @@ explanation = The following query identifies Microsoft Background Intelligent Tr
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197"]}
 known_false_positives = Limited false positives will be present. Typically, applications will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments (legitimate applications) or parent process.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - BITSAdmin Download File - Rule]
 type = detection
@@ -1985,7 +1985,7 @@ explanation = The following query identifies Microsoft Background Intelligent Tr
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197", "T1105"]}
 known_false_positives = Limited false positives, however it may be required to filter based on parent process name or network connection.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - CertUtil Download With URLCache and Split Arguments - Rule]
 type = detection
@@ -1995,7 +1995,7 @@ explanation = Certutil.exe may download a file from a remote destination using `
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]}
 known_false_positives = Limited false positives in most environments, however tune as needed based on parent-child relationship or network connection.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule]
 type = detection
@@ -2005,7 +2005,7 @@ explanation = Certutil.exe may download a file from a remote destination using `
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]}
 known_false_positives = Limited false positives in most environments, however tune as needed based on parent-child relationship or network connection.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Certutil exe certificate extraction - Rule]
 type = detection
@@ -2015,7 +2015,7 @@ explanation = This search looks for arguments to certutil.exe indicating the man
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Installation"]}
 known_false_positives = Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - CertUtil With Decode Argument - Rule]
 type = detection
@@ -2025,7 +2025,7 @@ explanation = CertUtil.exe may be used to `encode` and `decode` a file, includin
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"]}
 known_false_positives = Typically seen used to `encode` files, but it is possible to see legitimate use of `decode`. Filter based on parent-child relationship, file paths, endpoint or user.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Change Default File Association - Rule]
 type = detection
@@ -2035,7 +2035,7 @@ explanation = This analytic is developed to detect suspicious registry modificat
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.001", "T1546"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Change To Safe Mode With Network Config - Rule]
 type = detection
@@ -2045,7 +2045,7 @@ explanation = This search is to detect a suspicious bcdedit commandline to confi
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - CHCP Command Execution - Rule]
 type = detection
@@ -2055,7 +2055,7 @@ explanation = This search is to detect execution of chcp.exe application. this u
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed chcp.com may be used.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059"]}
 known_false_positives = other tools or script may used this to change code page to UTF-* or others
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Check Elevated CMD using whoami - Rule]
 type = detection
@@ -2065,7 +2065,7 @@ explanation = This search is to detect a suspicious whoami execution to check if
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1033"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Clear Unallocated Sector Using Cipher App - Rule]
 type = detection
@@ -2075,7 +2075,7 @@ explanation = this search is to detect execution of `cipher.exe` to clear the un
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004", "T1070"]}
 known_false_positives = administrator may execute this app to manage disk
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Clop Common Exec Parameter - Rule]
 type = detection
@@ -2085,7 +2085,7 @@ explanation = The following analytics are designed to identifies some CLOP ranso
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]}
 known_false_positives = Operators can execute third party tools using these parameters.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Clop Ransomware Known Service Name - Rule]
 type = detection
@@ -2095,7 +2095,7 @@ explanation = This detection is to identify the common service name created by t
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - CMD Carry Out String Command Parameter - Rule]
 type = detection
@@ -2105,7 +2105,7 @@ explanation = The following analytic identifies command-line arguments where `cm
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003", "T1059"]}
 known_false_positives = False positives may be high based on legitimate scripted code in any environment. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - CMD Echo Pipe - Escalation - Rule]
 type = detection
@@ -2115,7 +2115,7 @@ explanation = This analytic identifies a common behavior by Cobalt Strike and ot
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.003", "T1543.003", "T1543"]}
 known_false_positives = Unknown. It is possible filtering may be required to ensure fidelity.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Cmdline Tool Not Executed In CMD Shell - Rule]
 type = detection
@@ -2125,7 +2125,7 @@ explanation = The following analytic identifies a non-standard parent process (n
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"]}
 known_false_positives = A network operator or systems administrator may utilize an automated host discovery application that may generate false positives. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule]
 type = detection
@@ -2135,7 +2135,7 @@ explanation = This analytic detects a potential process using COM Object like CM
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.003"]}
 known_false_positives = Legitimate windows application that are not on the list loading this dll. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Cobalt Strike Named Pipes - Rule]
 type = detection
@@ -2146,7 +2146,7 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1055"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some of the named pipes identified and added may cause false positives. Filter by process name or pipe name to reduce false positives.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Common Ransomware Extensions - Rule]
 type = detection
@@ -2160,7 +2160,7 @@ This search produces fields (`query`,`query_length`,`count`) that are not yet su
 Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = It is possible for a legitimate file with these extensions to be created. If this is a true ransomware attack, there will be a large number of files created with these extensions.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Common Ransomware Notes - Rule]
 type = detection
@@ -2170,7 +2170,7 @@ explanation = The search looks for files created with names matching those typic
 how_to_implement = You must be ingesting data that records file-system activity from your hosts to populate the Endpoint Filesystem data-model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = It's possible that a legitimate file could be created with the same name used by ransomware note files.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Conti Common Exec parameter - Rule]
 type = detection
@@ -2180,7 +2180,7 @@ explanation = This search detects the suspicious commandline argument of revil r
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]}
 known_false_positives = 3rd party tool may have commandline parameter that can trigger this detection.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Control Loading from World Writable Directory - Rule]
 type = detection
@@ -2190,7 +2190,7 @@ explanation = The following detection identifies control.exe loading either a .c
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.002"]}
 known_false_positives = Limited false positives will be present as control.exe does not natively load from writable paths as defined. One may add .cpl or .inf to the command-line if there is any false positives. Tune as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Create local admin accounts using net exe - Rule]
 type = detection
@@ -2200,7 +2200,7 @@ explanation = This search looks for the creation of local administrator accounts
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Administrators often leverage net.exe to create admin accounts.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Create or delete windows shares using net exe - Rule]
 type = detection
@@ -2210,7 +2210,7 @@ explanation = This search looks for the creation or deletion of hidden shares us
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.005"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Administrators often leverage net.exe to create or delete network shares. You should verify that the activity was intentional and is legitimate.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Create Remote Thread In Shell Application - Rule]
 type = detection
@@ -2220,7 +2220,7 @@ explanation = This search is to detect suspicious process injection in command s
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Create Remote Thread into LSASS - Rule]
 type = detection
@@ -2230,7 +2230,7 @@ explanation = Detect remote thread creation into LSASS consistent with credentia
 how_to_implement = This search needs Sysmon Logs with a Sysmon configuration, which includes EventCode 8 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
 annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"]}
 known_false_positives = Other tools can access LSASS for legitimate reasons and generate an event. In these cases, tweaking the search may help eliminate noise.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Creation of lsass Dump with Taskmgr - Rule]
 type = detection
@@ -2240,7 +2240,7 @@ explanation = Detect the hands on keyboard behavior of Windows Task Manager crea
 how_to_implement = This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
 annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"]}
 known_false_positives = Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Creation of Shadow Copy - Rule]
 type = detection
@@ -2250,7 +2250,7 @@ explanation = Monitor for signs that Vssadmin or Wmic has been used to create a
 how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"]}
 known_false_positives = Legitimate administrator usage of Vssadmin or Wmic will create false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Creation of Shadow Copy with wmic and powershell - Rule]
 type = detection
@@ -2260,7 +2260,7 @@ explanation = This search detects the use of wmic and Powershell to create a sha
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"]}
 known_false_positives = Legtimate administrator usage of wmic to create a shadow copy.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule]
 type = detection
@@ -2270,7 +2270,7 @@ explanation = This search detects credential dumping using copy command from a s
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Credential Dumping via Symlink to Shadow Copy - Rule]
 type = detection
@@ -2280,7 +2280,7 @@ explanation = This search detects the creation of a symlink to a shadow copy.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - CSC Net On The Fly Compilation - Rule]
 type = detection
@@ -2290,7 +2290,7 @@ explanation = this analytic is to detect a suspicious compile before delivery ap
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.004", "T1027"]}
 known_false_positives = A network operator or systems administrator may utilize an automated powershell script taht execute .net code that may generate false positive. filter is needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Curl Download and Bash Execution - Rule]
 type = detection
@@ -2300,7 +2300,7 @@ explanation = The following analytic identifies the use of curl on Linux or MacO
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is occurring correctly. If the EDR is not parsing the pipe bash in the command-line, modifying the analytic will be required. Add parent process name (Processes.parent_process_name) as needed to filter.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]}
 known_false_positives = False positives should be limited, however filtering may be required.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Delete ShadowCopy With PowerShell - Rule]
 type = detection
@@ -2310,7 +2310,7 @@ explanation = This following analytic detects PowerShell command to delete shado
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Deleting Of Net Users - Rule]
 type = detection
@@ -2320,7 +2320,7 @@ explanation = This analytic will detect a suspicious net.exe/net1.exe command-li
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]}
 known_false_positives = System administrators or scripts may delete user accounts via this technique. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Deleting Shadow Copies - Rule]
 type = detection
@@ -2330,7 +2330,7 @@ explanation = The vssadmin.exe utility is used to interact with the Volume Shado
 how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 8", "CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
 known_false_positives = vssadmin.exe and wmic.exe are standard applications shipped with modern versions of windows. They may be used by administrators to legitimately delete old backup copies, although this is typically rare.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Activity Related to Pass the Hash Attacks - Rule]
 type = detection
@@ -2340,7 +2340,7 @@ explanation = This search looks for specific authentication events from the Wind
 how_to_implement = To successfully implement this search, you must ingest your Windows Security Event logs and leverage the latest TA for Windows.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1550", "T1550.002"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]}
 known_false_positives = Legitimate logon activity by authorized NTLM systems may be detected by this search. Please investigate as appropriate.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Detect AzureHound Command-Line Arguments - Rule]
 type = detection
@@ -2350,7 +2350,7 @@ explanation = The following analytic identifies the common command-line argument
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"]}
 known_false_positives = Unknown.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect AzureHound File Modifications - Rule]
 type = detection
@@ -2360,7 +2360,7 @@ explanation = The following analytic is similar to SharpHound file modifications
 how_to_implement = To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"]}
 known_false_positives = False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule]
 type = detection
@@ -2372,7 +2372,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"]}
 known_false_positives = Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Detect Credential Dumping through LSASS access - Rule]
 type = detection
@@ -2382,7 +2382,7 @@ explanation = This search looks for reading lsass memory consistent with credent
 how_to_implement = This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10 with lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["PR.IP", "PR.AC", "DE.CM"]}
 known_false_positives = The activity may be legitimate. Other tools can access lsass for legitimate reasons, and it's possible this event could be generated in those cases. In these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Empire with PowerShell Script Block Logging - Rule]
 type = detection
@@ -2394,7 +2394,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]}
 known_false_positives = False positives may only pertain to it not being related to Empire, but another framework. Filter as needed if any applications use the same pattern.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Detect Excessive Account Lockouts From Endpoint - Rule]
 type = detection
@@ -2408,7 +2408,7 @@ If Splunk>Phantom is also configured in your environment, a Playbook called "Exc
 
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.002"], "nist": ["PR.IP"]}
 known_false_positives = It's possible that a widely used system, such as a kiosk, could cause a large number of account lockouts.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Excessive User Account Lockouts - Rule]
 type = detection
@@ -2418,7 +2418,7 @@ explanation = This search detects user accounts that have been locked out a rela
 how_to_implement = ou must ingest your Windows security event logs in the `Change` datamodel under the nodename is `Account_Management`, for this search to execute successfully. Please consider updating the cron schedule and the count of lockouts you want to monitor, according to your environment.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.003"], "nist": ["PR.IP"]}
 known_false_positives = It is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Exchange Web Shell - Rule]
 type = detection
@@ -2428,7 +2428,7 @@ explanation = The following query identifies suspicious .aspx created in 3 paths
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003", "T1190"]}
 known_false_positives = The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect HTML Help Renamed - Rule]
 type = detection
@@ -2438,7 +2438,7 @@ explanation = The following analytic identifies a renamed instance of hh.exe (HT
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely a renamed instance of hh.exe will be used legitimately, filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect HTML Help Spawn Child Process - Rule]
 type = detection
@@ -2448,7 +2448,7 @@ explanation = The following analytic identifies hh.exe (HTML Help) execution of
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, some legitimate applications (ex. web browsers) may spawn a child process. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect HTML Help URL in Command Line - Rule]
 type = detection
@@ -2458,7 +2458,7 @@ explanation = The following analytic identifies hh.exe (HTML Help) execution of
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, some legitimate applications may retrieve a CHM remotely, filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule]
 type = detection
@@ -2468,7 +2468,7 @@ explanation = The following analytic identifies hh.exe (HTML Help) execution of
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = It is rare to see instances of InfoTech Storage Handlers being used, but it does happen in some legitimate instances. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Mimikatz Using Loaded Images - Rule]
 type = detection
@@ -2478,7 +2478,7 @@ explanation = This search looks for reading loaded Images unique to credential d
 how_to_implement = This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 7 with powershell.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
 annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.AE", "DE.CM"]}
 known_false_positives = Other tools can import the same DLLs. These tools should be part of a whitelist. False positives may be present with any process that authenticates or uses credentials, PowerShell included. Filter based on parent process.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule]
 type = detection
@@ -2488,9 +2488,9 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 This analytic identifies common Mimikatz functions that may be identified in the script block, including `mimikatz`. This will catch the most basic use cases for Pass the Ticket, Pass the Hash and `-DumprCreds`. \
 During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003"]}
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003", "T1059.001"]}
 known_false_positives = False positives should be limited as the commands being identifies are quite specific to EventCode 4104 and Mimikatz. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Detect mshta inline hta execution - Rule]
 type = detection
@@ -2500,7 +2500,7 @@ explanation = The following analytic identifies "mshta.exe" execution with inlin
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect mshta renamed - Rule]
 type = detection
@@ -2510,7 +2510,7 @@ explanation = The following analytic identifies renamed instances of mshta.exe e
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, some legitimate applications may use a moved copy of mshta.exe, but never renamed, triggering a false positive.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect MSHTA Url in Command Line - Rule]
 type = detection
@@ -2520,7 +2520,7 @@ explanation = This analytic identifies when Microsoft HTML Application Host (msh
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = It is possible legitimate applications may perform this behavior and will need to be filtered.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect New Local Admin account - Rule]
 type = detection
@@ -2530,7 +2530,7 @@ explanation = This search looks for newly created accounts that have been elevat
 how_to_implement = You must be ingesting Windows event logs using the Splunk Windows TA and collecting event code 4720 and 4732
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Command \u0026 Control"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.AC", "DE.CM"]}
 known_false_positives = The activity may be legitimate. For this reason, it's best to verify the account with an administrator and ask whether there was a valid service request for the account creation. If your local administrator group name is not "Administrators", this search may generate an excessive number of false positives
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Detect Path Interception By Creation Of program exe - Rule]
 type = detection
@@ -2540,7 +2540,7 @@ explanation = The detection Detect Path Interception By Creation Of program exe
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1574.009", "T1574"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect processes used for System Network Configuration Discovery - Rule]
 type = detection
@@ -2550,7 +2550,7 @@ explanation = This search looks for fast execution of processes used for system
 how_to_implement = You must be ingesting data that records registry activity from your hosts to populate the Endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report reads and writes to the registry or that are populated via Windows event logs, after enabling process tracking in your Windows audit settings.
 annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1016"], "nist": ["ID.AM", "PR.DS"]}
 known_false_positives = It is uncommon for normal users to execute a series of commands used for network discovery. System administrators often use scripts to execute these commands. These can generate false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Prohibited Applications Spawning cmd exe - Rule]
 type = detection
@@ -2560,7 +2560,7 @@ explanation = This search looks for executions of cmd.exe spawned by a process t
 how_to_implement = You must be ingesting data that records process activity from your hosts and populates the Endpoint data model with the resultant dataset. This search includes a lookup file, `prohibited_apps_launching_cmd.csv`, that contains a list of processes that should not be spawning cmd.exe. You can modify this lookup to better suit your environment. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.003"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = There are circumstances where an application may legitimately execute and interact with the Windows command-line interface. Investigate and modify the lookup file, as appropriate.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect PsExec With accepteula Flag - Rule]
 type = detection
@@ -2570,7 +2570,7 @@ explanation = This search looks for events where `PsExec.exe` is run with the `a
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021", "T1021.002"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Administrators can leverage PsExec for accessing remote systems and might pass `accepteula` as an argument if they are running this tool for the first time. However, it is not likely that you'd see multiple occurrences of this event on a machine
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect RClone Command-Line Usage - Rule]
 type = detection
@@ -2580,7 +2580,7 @@ explanation = This analytic identifies commonly used command-line arguments used
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1020"]}
 known_false_positives = False positives should be limited as this is restricted to the Rclone process name. Filter or tune the analytic as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Regasm Spawning a Process - Rule]
 type = detection
@@ -2590,7 +2590,7 @@ explanation = The following analytic identifies regasm.exe spawning a process. T
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Regasm with Network Connection - Rule]
 type = detection
@@ -2600,7 +2600,7 @@ explanation = The following analytic identifies regasm.exe with a network connec
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, limited instances of regasm.exe with a network connection may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Regasm with no Command Line Arguments - Rule]
 type = detection
@@ -2610,7 +2610,7 @@ explanation = The following analytic identifies regasm.exe with no command line
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, limited instances of regasm.exe or may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Regsvcs Spawning a Process - Rule]
 type = detection
@@ -2620,7 +2620,7 @@ explanation = The following analytic identifies regsvcs.exe spawning a process.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Regsvcs with Network Connection - Rule]
 type = detection
@@ -2630,7 +2630,7 @@ explanation = The following analytic identifies Regsvcs.exe with a network conne
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Regsvcs with No Command Line Arguments - Rule]
 type = detection
@@ -2640,7 +2640,7 @@ explanation = The following analytic identifies regsvcs.exe with no command line
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Regsvr32 Application Control Bypass - Rule]
 type = detection
@@ -2651,7 +2651,7 @@ Upon investigating, look for network connections to remote destinations (interna
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"]}
 known_false_positives = Limited false positives related to third party software registering .DLL's.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Renamed 7-Zip - Rule]
 type = detection
@@ -2661,7 +2661,7 @@ explanation = The following analytic identifies renamed 7-Zip usage using Sysmon
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001", "T1560"]}
 known_false_positives = Limited false positives, however this analytic will need to be modified for each environment if Sysmon is not used.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Renamed PSExec - Rule]
 type = detection
@@ -2671,7 +2671,7 @@ explanation = The following analytic identifies renamed instances of `PsExec.exe
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569", "T1569.002"]}
 known_false_positives = Limited false positives should be present. It is possible some third party applications may use older versions of PsExec, filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Renamed RClone - Rule]
 type = detection
@@ -2681,7 +2681,7 @@ explanation = The following analytic identifies the usage of `rclone.exe`, renam
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1020"]}
 known_false_positives = False positives should be limited as this analytic identifies renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business use case.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Renamed WinRAR - Rule]
 type = detection
@@ -2691,7 +2691,7 @@ explanation = The following analtyic identifies renamed instances of `WinRAR.exe
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001", "T1560"]}
 known_false_positives = Unknown. It is possible third party applications use renamed instances of WinRAR.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule]
 type = detection
@@ -2701,7 +2701,7 @@ explanation = The following analytic identifies rundll32.exe loading advpack.dll
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, some legitimate applications may use advpack.dll or ieadvpack.dll, triggering a false positive.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule]
 type = detection
@@ -2711,7 +2711,7 @@ explanation = The following analytic identifies rundll32.exe loading setupapi.dl
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, some legitimate applications may use setupapi triggering a false positive.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule]
 type = detection
@@ -2721,7 +2721,7 @@ explanation = The following analytic identifies rundll32.exe loading syssetup.dl
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, some legitimate applications may use syssetup.dll, triggering a false positive.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Rundll32 Inline HTA Execution - Rule]
 type = detection
@@ -2731,7 +2731,7 @@ explanation = The following analytic identifies "rundll32.exe" execution with in
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect SharpHound Command-Line Arguments - Rule]
 type = detection
@@ -2741,7 +2741,7 @@ explanation = The following analytic identifies common command-line arguments us
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"]}
 known_false_positives = False positives should be limited as the arguments used are specific to SharpHound. Filter as needed or add more command-line arguments as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect SharpHound File Modifications - Rule]
 type = detection
@@ -2751,7 +2751,7 @@ explanation = SharpHound is used as a reconnaissance collector, ingestor, for Bl
 how_to_implement = To successfully implement this search you need to be ingesting information on file modifications that include the name of the process, and file, responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"]}
 known_false_positives = False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect SharpHound Usage - Rule]
 type = detection
@@ -2761,7 +2761,7 @@ explanation = The following analytic identifies SharpHound binary usage by using
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1069.001", "T1482", "T1087.001", "T1087", "T1069.002", "T1069"]}
 known_false_positives = False positives should be limited as this is specific to a file attribute not used by anything else. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule]
 type = detection
@@ -2771,7 +2771,7 @@ explanation = This search looks for the execution of the cscript.exe or wscript.
 how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.003"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Some legitimate applications may exhibit this behavior.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect WMI Event Subscription Persistence - Rule]
 type = detection
@@ -2786,7 +2786,7 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons
 how_to_implement = To successfully implement this search, you need to be ingesting logs with that provide WMI Event Subscription from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA and have enabled EventID 19, 20 and 21. Tune and filter known good to limit the volume.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003", "T1546"]}
 known_false_positives = It is possible some applications will create a consumer and may be required to be filtered. For tuning, add any additional LOLBin's for further depth of coverage.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Disable AMSI Through Registry - Rule]
 type = detection
@@ -2796,7 +2796,7 @@ explanation = this search is to identify modification in registry to disable AMS
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = network operator may disable this feature of windows but not so common.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disable Defender AntiVirus Registry - Rule]
 type = detection
@@ -2806,7 +2806,7 @@ explanation = This particular behavior is typically executed when an adversaries
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to disable windows defender product
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disable Defender BlockAtFirstSeen Feature - Rule]
 type = detection
@@ -2816,7 +2816,7 @@ explanation = This analytic is to detect a suspicious modification of registry t
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to disable windows defender product
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disable Defender Enhanced Notification - Rule]
 type = detection
@@ -2826,7 +2826,7 @@ explanation = This analytic is to detect a suspicious modification of registry t
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = user may choose to disable windows defender AV
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disable Defender MpEngine Registry - Rule]
 type = detection
@@ -2836,7 +2836,7 @@ explanation = This particular behavior is typically executed when an adversaries
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to disable windows defender product
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disable Defender Spynet Reporting - Rule]
 type = detection
@@ -2846,17 +2846,17 @@ explanation = This analytic is to detect a suspicious modification of registry t
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to disable windows defender product
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disable Defender Submit Samples Consent Feature - Rule]
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = his analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
+explanation = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to disable windows defender product
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disable ETW Through Registry - Rule]
 type = detection
@@ -2866,7 +2866,7 @@ explanation = this search is to identify modification in registry to disable ETW
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = network operator may disable this feature of windows but not so common.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disable Logs Using WevtUtil - Rule]
 type = detection
@@ -2876,7 +2876,7 @@ explanation = This search is to detect execution of wevtutil.exe to disable logs
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070", "T1070.001"]}
 known_false_positives = network operator may disable audit event logs for debugging purposes.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disable Registry Tool - Rule]
 type = detection
@@ -2886,7 +2886,7 @@ explanation = This search identifies modification of registry to disable the reg
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin may disable this application for non technical user.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disable Schedule Task - Rule]
 type = detection
@@ -2896,7 +2896,7 @@ explanation = This analytic is to detect a suspicious commandline to disable exi
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin may disable problematic schedule task
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disable Security Logs Using MiniNt Registry - Rule]
 type = detection
@@ -2906,7 +2906,7 @@ explanation = This analytic is to detect a suspicious registry modification to d
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"]}
 known_false_positives = Unknown.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disable Show Hidden Files - Rule]
 type = detection
@@ -2916,7 +2916,7 @@ explanation = The following analytic is to identify a modification in the Window
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001", "T1564", "T1562"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disable UAC Remote Restriction - Rule]
 type = detection
@@ -2926,7 +2926,7 @@ explanation = This analytic is to detect a suspicious modification of registry t
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]}
 known_false_positives = admin may set this policy for non-critical machine.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disable Windows App Hotkeys - Rule]
 type = detection
@@ -2936,7 +2936,7 @@ explanation = This analytic detects a suspicious registry modification to disabl
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disable Windows Behavior Monitoring - Rule]
 type = detection
@@ -2946,7 +2946,7 @@ explanation = This search is to identifies a modification in registry to disable
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to disable this windows features.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disable Windows SmartScreen Protection - Rule]
 type = detection
@@ -2956,7 +2956,7 @@ explanation = The following search identifies a modification of registry to disa
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to disable this windows features.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disabled Kerberos Pre-Authentication Discovery With Get-ADUser - Rule]
 type = detection
@@ -2966,7 +2966,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558", "T1558.004"]}
 known_false_positives = Administrators or power users may use search for accounts with Kerberos Pre Authentication disabled for legitimate purposes.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Disabled Kerberos Pre-Authentication Discovery With PowerView - Rule]
 type = detection
@@ -2976,7 +2976,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558", "T1558.004"]}
 known_false_positives = Administrators or power users may use PowerView for troubleshooting
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Disabling CMD Application - Rule]
 type = detection
@@ -2986,7 +2986,7 @@ explanation = this search is to identify modification in registry to disable cmd
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin may disable this application for non technical user.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disabling ControlPanel - Rule]
 type = detection
@@ -2996,7 +2996,7 @@ explanation = this search is to identify registry modification to disable contro
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin may disable this application for non technical user.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disabling Defender Services - Rule]
 type = detection
@@ -3006,7 +3006,7 @@ explanation = This particular behavior is typically executed when an adversaries
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to disable windows defender product
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disabling Firewall with Netsh - Rule]
 type = detection
@@ -3016,7 +3016,7 @@ explanation = This search is to identifies suspicious firewall disabling using n
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin may disable firewall during testing or fixing network problem.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disabling FolderOptions Windows Feature - Rule]
 type = detection
@@ -3026,7 +3026,7 @@ explanation = This search is to identify registry modification to disable folder
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin may disable this application for non technical user.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disabling Net User Account - Rule]
 type = detection
@@ -3036,7 +3036,7 @@ explanation = This analytic will identify a suspicious command-line that disable
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disabling NoRun Windows App - Rule]
 type = detection
@@ -3046,7 +3046,7 @@ explanation = This search is to identify modification of registry to disable run
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin may disable this application for non technical user.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disabling Remote User Account Control - Rule]
 type = detection
@@ -3056,7 +3056,7 @@ explanation = The search looks for modifications to registry keys that control t
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002", "T1548"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = This registry key may be modified via administrators to implement a change in system policy. This type of change should be a very rare occurrence.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disabling SystemRestore In Registry - Rule]
 type = detection
@@ -3066,7 +3066,7 @@ explanation = The following search identifies the modification of registry relat
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]}
 known_false_positives = in some cases admin can disable systemrestore on a machine.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Disabling Task Manager - Rule]
 type = detection
@@ -3076,7 +3076,7 @@ explanation = This search is to identifies modification of registry to disable t
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin may disable this application for non technical user.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - DLLHost with no Command Line Arguments with Network - Rule]
 type = detection
@@ -3086,7 +3086,7 @@ explanation = The following analytic identifies DLLHost.exe with no command line
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = Although unlikely, some legitimate third party applications may use a moved copy of dllhost, triggering a false positive.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - DNS Exfiltration Using Nslookup App - Rule]
 type = detection
@@ -3096,7 +3096,7 @@ explanation = this search is to detect potential DNS exfiltration using nslookup
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of nslookup.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]}
 known_false_positives = admin nslookup usage
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Domain Account Discovery with Dsquery - Rule]
 type = detection
@@ -3106,7 +3106,7 @@ explanation = This analytic looks for the execution of `dsquery.exe` with comman
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Domain Account Discovery With Net App - Rule]
 type = detection
@@ -3116,7 +3116,7 @@ explanation = This analytic looks for the execution of `net.exe` or `net1.exe` w
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Domain Account Discovery with Wmic - Rule]
 type = detection
@@ -3126,7 +3126,7 @@ explanation = This analytic looks for the execution of `wmic.exe` with command-l
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Domain Controller Discovery with Nltest - Rule]
 type = detection
@@ -3136,7 +3136,7 @@ explanation = This analytic looks for the execution of `nltest.exe` with command
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Domain Controller Discovery with Wmic - Rule]
 type = detection
@@ -3146,7 +3146,7 @@ explanation = This analytic looks for the execution of `wmic.exe` with command-l
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Domain Group Discovery with Adsisearcher - Rule]
 type = detection
@@ -3156,7 +3156,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]}
 known_false_positives = Administrators or power users may use Adsisearcher for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Domain Group Discovery With Dsquery - Rule]
 type = detection
@@ -3166,7 +3166,7 @@ explanation = This analytic looks for the execution of `dsquery.exe` with comman
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Domain Group Discovery With Net - Rule]
 type = detection
@@ -3176,7 +3176,7 @@ explanation = This analytic looks for the execution of `net.exe` with command-li
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Domain Group Discovery With Wmic - Rule]
 type = detection
@@ -3186,7 +3186,7 @@ explanation = This analytic looks for the execution of `wmic.exe` with command-l
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Download Files Using Telegram - Rule]
 type = detection
@@ -3196,7 +3196,7 @@ explanation = The following analytic will identify a suspicious download by the
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and TargetFilename from your endpoints or Events that monitor filestream events which is happened when process download something. (EventCode 15) If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]}
 known_false_positives = normal download of file in telegram app. (if it was a common app in network)
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Drop IcedID License dat - Rule]
 type = detection
@@ -3206,7 +3206,7 @@ explanation = This search is to detect dropping a suspicious file named as "lice
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204", "T1204.002"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - DSQuery Domain Discovery - Rule]
 type = detection
@@ -3221,7 +3221,7 @@ In addition to trust discovery, review parallel processes for additional behavio
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"]}
 known_false_positives = Limited false positives. If there is a true false positive, filter based on command-line or parent process.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Dump LSASS via comsvcs DLL - Rule]
 type = detection
@@ -3231,7 +3231,7 @@ explanation = Detect the usage of comsvcs.dll for dumping the lsass process.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"]}
 known_false_positives = None identified.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Dump LSASS via procdump - Rule]
 type = detection
@@ -3242,7 +3242,7 @@ During triage, confirm this is procdump.exe executing. If it is the first time a
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"]}
 known_false_positives = None identified.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Elevated Group Discovery With Net - Rule]
 type = detection
@@ -3252,7 +3252,7 @@ explanation = This analytic looks for the execution of `net.exe` or `net1.exe`
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Elevated Group Discovery with PowerView - Rule]
 type = detection
@@ -3262,7 +3262,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]}
 known_false_positives = Administrators or power users may use this PowerView for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Elevated Group Discovery With Wmic - Rule]
 type = detection
@@ -3272,7 +3272,7 @@ explanation = This analytic looks for the execution of `wmic.exe` with command-l
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Enable RDP In Other Port Number - Rule]
 type = detection
@@ -3282,7 +3282,7 @@ explanation = This search is to detect a modification to registry to enable rdp
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Enable WDigest UseLogonCredential Registry - Rule]
 type = detection
@@ -3292,7 +3292,7 @@ explanation = This analytic is to detect a suspicious registry modification to e
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112", "T1003"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Enumerate Users Local Group Using Telegram - Rule]
 type = detection
@@ -3302,7 +3302,7 @@ explanation = This analytic will detect a suspicious Telegram process enumeratin
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the Task Schedule (Exa. Security Log EventCode 4798) endpoints. Tune and filter known instances of process like logonUI used in your environment.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Esentutl SAM Copy - Rule]
 type = detection
@@ -3312,7 +3312,7 @@ explanation = The following analytic identifies the process - `esentutl.exe` - b
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"]}
 known_false_positives = False positives should be limited. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - ETW Registry Disabled - Rule]
 type = detection
@@ -3322,7 +3322,7 @@ explanation = This analytic is to detect a registry modification to disable ETW
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.006", "T1127", "T1562"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Eventvwr UAC Bypass - Rule]
 type = detection
@@ -3332,7 +3332,7 @@ explanation = The following search identifies Eventvwr bypass by identifying the
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]}
 known_false_positives = Some false positives may be present and will need to be filtered.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Excel Spawning PowerShell - Rule]
 type = detection
@@ -3342,7 +3342,7 @@ explanation = The following detection identifies Microsoft Excel spawning PowerS
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"]}
 known_false_positives = False positives should be limited, but if any are present, filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Excel Spawning Windows Script Host - Rule]
 type = detection
@@ -3352,7 +3352,7 @@ explanation = The following detection identifies Microsoft Excel spawning Window
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"]}
 known_false_positives = False positives should be limited, but if any are present, filter as needed. In some instances, `cscript.exe` is used for legitimate business practices.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Excessive Attempt To Disable Services - Rule]
 type = detection
@@ -3362,7 +3362,7 @@ explanation = This analytic will identify suspicious series of command-line to d
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Excessive distinct processes from Windows Temp - Rule]
 type = detection
@@ -3372,7 +3372,7 @@ explanation = This analytic will identify suspicious series of process execution
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]}
 known_false_positives = Many benign applications will create processes from executables in Windows\Temp, although unlikely to exceed the given threshold.  Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Excessive File Deletion In WinDefender Folder - Rule]
 type = detection
@@ -3382,7 +3382,7 @@ explanation = This analytic will identify excessive file deletion events in the
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, TargetFilename, and ProcessID executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"], "nist": ["DE.CM"]}
 known_false_positives = Windows Defender AV updates may cause this alert. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Excessive number of service control start as disabled - Rule]
 type = detection
@@ -3392,7 +3392,7 @@ explanation = This detection targets behaviors observed when threat actors have
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = Legitimate programs and administrators will execute sc.exe with the start disabled flag.  It is possible, but unlikely from the telemetry of normal Windows operation we observed, that sc.exe will be called more than seven times in a short period of time.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Excessive number of taskhost processes - Rule]
 type = detection
@@ -3402,7 +3402,7 @@ explanation = This detection targets behaviors observed in post exploit kits lik
 how_to_implement = To successfully implement this search you need to be ingesting events related to processes on the endpoints that include the name of the process and process id into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]}
 known_false_positives = Administrators, administrative actions or certain applications may run many instances of taskhost and taskhostex concurrently.  Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Excessive Service Stop Attempt - Rule]
 type = detection
@@ -3412,7 +3412,7 @@ explanation = This analytic identifies suspicious series of attempt to kill mult
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Excessive Usage Of Cacls App - Rule]
 type = detection
@@ -3422,7 +3422,7 @@ explanation = The following analytic identifies excessive usage of `cacls.exe`,
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]}
 known_false_positives = Administrators or administrative scripts may use this application. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Excessive Usage Of Net App - Rule]
 type = detection
@@ -3432,7 +3432,7 @@ explanation = This analytic identifies excessive usage of `net.exe` or `net1.exe
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]}
 known_false_positives = unknown. Filter as needed. Modify the time span as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Excessive Usage of NSLOOKUP App - Rule]
 type = detection
@@ -3442,7 +3442,7 @@ explanation = This search is to detect potential DNS exfiltration using nslookup
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of nslookup.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Excessive Usage Of SC Service Utility - Rule]
 type = detection
@@ -3452,7 +3452,7 @@ explanation = This search is to detect a suspicious excessive usage of sc.exe in
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569", "T1569.002"]}
 known_false_positives = excessive execution of sc.exe is quite suspicious since it can modify or execute app in high privilege permission.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Excessive Usage Of Taskkill - Rule]
 type = detection
@@ -3462,7 +3462,7 @@ explanation = This analytic identifies excessive usage of `taskkill.exe` applica
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = Unknown. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Executable File Written in Administrative SMB Share - Rule]
 type = detection
@@ -3472,7 +3472,7 @@ explanation = The following analytic identifies executable files (.exe or .dll)
 how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.002"]}
 known_false_positives = System Administrators may use looks like PsExec for troubleshooting or administrations tasks. However, this will typically come only from certain users and certain systems that can be added to an allow list.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Executables Or Script Creation In Suspicious Path - Rule]
 type = detection
@@ -3482,7 +3482,7 @@ explanation = This analytic will identify suspicious executable or scripts (know
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"]}
 known_false_positives = Administrators may allow creation of script or exe in the paths specified. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Execute Javascript With Jscript COM CLSID - Rule]
 type = detection
@@ -3492,7 +3492,7 @@ explanation = This analytic will identify suspicious process of cscript.exe wher
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.005"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Execution of File with Multiple Extensions - Rule]
 type = detection
@@ -3502,7 +3502,7 @@ explanation = This search looks for processes launched from files that have doub
 how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node.
 annotations = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036", "T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"]}
 known_false_positives = None identified.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Extraction of Registry Hives - Rule]
 type = detection
@@ -3512,7 +3512,7 @@ explanation = The following analytic identifies the use of `reg.exe` exporting W
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"]}
 known_false_positives = It is possible some agent based products will generate false positives. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - File with Samsam Extension - Rule]
 type = detection
@@ -3522,7 +3522,7 @@ explanation = The search looks for file writes with extensions consistent with a
 how_to_implement = You must be ingesting data that records file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Installation"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Because these extensions are not typically used in normal operations, you should investigate all results.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Firewall Allowed Program Enable - Rule]
 type = detection
@@ -3532,7 +3532,7 @@ explanation = This analytic detects a potential suspicious modification of firew
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1562.004", "T1562"]}
 known_false_positives = A network operator or systems administrator may utilize an automated or manual execution of this firewall rule that may generate false positives. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - FodHelper UAC Bypass - Rule]
 type = detection
@@ -3546,7 +3546,7 @@ Upon triage, fodhelper.exe will have a child process and read access will occur
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112", "T1548.002", "T1548"]}
 known_false_positives = Limited to no false positives are expected.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Fsutil Zeroing File - Rule]
 type = detection
@@ -3556,7 +3556,7 @@ explanation = This search is to detect a suspicious fsutil process to zeroing a
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Get ADDefaultDomainPasswordPolicy with Powershell - Rule]
 type = detection
@@ -3566,7 +3566,7 @@ explanation = This analytic looks for the execution of `powershell.exe` executin
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Get ADDefaultDomainPasswordPolicy with Powershell Script Block - Rule]
 type = detection
@@ -3576,7 +3576,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Get ADUser with PowerShell - Rule]
 type = detection
@@ -3586,7 +3586,7 @@ explanation = This analytic looks for the execution of `powershell.exe` with com
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Get ADUser with PowerShell Script Block - Rule]
 type = detection
@@ -3596,7 +3596,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Get ADUserResultantPasswordPolicy with Powershell - Rule]
 type = detection
@@ -3606,7 +3606,7 @@ explanation = This analytic looks for the execution of `powershell.exe` executin
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule]
 type = detection
@@ -3616,7 +3616,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Get DomainPolicy with Powershell - Rule]
 type = detection
@@ -3626,7 +3626,7 @@ explanation = This analytic looks for the execution of `powershell.exe` executin
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Get DomainPolicy with Powershell Script Block - Rule]
 type = detection
@@ -3636,7 +3636,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Get-DomainTrust with PowerShell - Rule]
 type = detection
@@ -3646,7 +3646,7 @@ explanation = This analytic identifies Get-DomainTrust from PowerView in order t
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"]}
 known_false_positives = Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Get-DomainTrust with PowerShell Script Block - Rule]
 type = detection
@@ -3658,7 +3658,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"]}
 known_false_positives = It is possible certain system management frameworks utilize this command to gather trust information.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Get DomainUser with PowerShell - Rule]
 type = detection
@@ -3668,7 +3668,7 @@ explanation = This analytic looks for the execution of `powershell.exe` with com
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Get DomainUser with PowerShell Script Block - Rule]
 type = detection
@@ -3678,7 +3678,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Get-ForestTrust with PowerShell - Rule]
 type = detection
@@ -3688,7 +3688,7 @@ explanation = This analytic identifies Get-ForestTrust from PowerSploit in order
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"]}
 known_false_positives = Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Get-ForestTrust with PowerShell Script Block - Rule]
 type = detection
@@ -3698,9 +3698,9 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. \
 During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"]}
+annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482", "T1059.001"]}
 known_false_positives = False positives may be present. Tune as needed.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Get WMIObject Group Discovery - Rule]
 type = detection
@@ -3710,7 +3710,7 @@ explanation = The following hunting analytic identifies the use of `Get-WMIObjec
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"]}
 known_false_positives = False positives may be present. Tune as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Get WMIObject Group Discovery with Script Block Logging - Rule]
 type = detection
@@ -3722,7 +3722,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"]}
 known_false_positives = False positives may be present. Tune as needed.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - GetAdComputer with PowerShell - Rule]
 type = detection
@@ -3732,7 +3732,7 @@ explanation = This analytic looks for the execution of `powershell.exe` with com
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - GetAdComputer with PowerShell Script Block - Rule]
 type = detection
@@ -3742,7 +3742,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]}
 known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - GetAdGroup with PowerShell - Rule]
 type = detection
@@ -3752,7 +3752,7 @@ explanation = This analytic looks for the execution of `powershell.exe` with com
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - GetAdGroup with PowerShell Script Block - Rule]
 type = detection
@@ -3762,7 +3762,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]}
 known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - GetCurrent User with PowerShell - Rule]
 type = detection
@@ -3772,7 +3772,7 @@ explanation = This analytic looks for the execution of `powerhsell.exe` with com
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - GetCurrent User with PowerShell Script Block - Rule]
 type = detection
@@ -3782,7 +3782,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]}
 known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - GetDomainComputer with PowerShell - Rule]
 type = detection
@@ -3792,7 +3792,7 @@ explanation = This analytic looks for the execution of `powershell.exe` with com
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]}
 known_false_positives = Administrators or power users may use PowerView for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - GetDomainComputer with PowerShell Script Block - Rule]
 type = detection
@@ -3802,7 +3802,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]}
 known_false_positives = Administrators or power users may use PowerView for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - GetDomainController with PowerShell - Rule]
 type = detection
@@ -3812,7 +3812,7 @@ explanation = This analytic looks for the execution of `powershell.exe` with com
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]}
 known_false_positives = Administrators or power users may use PowerView for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - GetDomainController with PowerShell Script Block - Rule]
 type = detection
@@ -3822,7 +3822,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]}
 known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - GetDomainGroup with PowerShell - Rule]
 type = detection
@@ -3832,7 +3832,7 @@ explanation = This analytic looks for the execution of `powershell.exe` with com
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - GetDomainGroup with PowerShell Script Block - Rule]
 type = detection
@@ -3842,7 +3842,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]}
 known_false_positives = Administrators or power users may use this PowerView functions for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - GetLocalUser with PowerShell - Rule]
 type = detection
@@ -3852,7 +3852,7 @@ explanation = This analytic looks for the execution of `powershell.exe` with com
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]}
 known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - GetLocalUser with PowerShell Script Block - Rule]
 type = detection
@@ -3860,9 +3860,9 @@ asset_type = Endpoint
 confidence = medium
 explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-LocalUser` commandlet. The `Get-LocalUser` commandlet is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]}
+annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001", "T1059.001"]}
 known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - GetNetTcpconnection with PowerShell - Rule]
 type = detection
@@ -3872,7 +3872,7 @@ explanation = This analytic looks for the execution of `powershell.exe` with com
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - GetNetTcpconnection with PowerShell Script Block - Rule]
 type = detection
@@ -3882,7 +3882,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]}
 known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - GetWmiObject Ds Computer with PowerShell - Rule]
 type = detection
@@ -3892,7 +3892,7 @@ explanation = This analytic looks for the execution of `powershell.exe` with com
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - GetWmiObject Ds Computer with PowerShell Script Block - Rule]
 type = detection
@@ -3902,7 +3902,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]}
 known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - GetWmiObject Ds Group with PowerShell - Rule]
 type = detection
@@ -3912,7 +3912,7 @@ explanation = This analytic looks for the execution of `powershell.exe` with com
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - GetWmiObject Ds Group with PowerShell Script Block - Rule]
 type = detection
@@ -3922,7 +3922,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"]}
 known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - GetWmiObject DS User with PowerShell - Rule]
 type = detection
@@ -3932,7 +3932,7 @@ explanation = This analytic looks for the execution of `powershell.exe` with com
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - GetWmiObject DS User with PowerShell Script Block - Rule]
 type = detection
@@ -3942,7 +3942,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = he following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - GetWmiObject User Account with PowerShell - Rule]
 type = detection
@@ -3952,7 +3952,7 @@ explanation = This analytic looks for the execution of `powershell.exe` with com
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]}
 known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - GetWmiObject User Account with PowerShell Script Block - Rule]
 type = detection
@@ -3960,9 +3960,9 @@ asset_type = Endpoint
 confidence = medium
 explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters. The `Win32_UserAccount` parameter is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]}
+annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001", "T1059.001"]}
 known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - GPUpdate with no Command Line Arguments with Network - Rule]
 type = detection
@@ -3972,7 +3972,7 @@ explanation = The following analytic identifies gpupdate.exe with no command lin
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Hide User Account From Sign-In Screen - Rule]
 type = detection
@@ -3982,7 +3982,7 @@ explanation = This analytic identifies a suspicious registry modification to hid
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = Unknown. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Hiding Files And Directories With Attrib exe - Rule]
 type = detection
@@ -3992,7 +3992,7 @@ explanation = Attackers leverage an existing Windows binary, attrib.exe, to mark
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1222", "T1222.001"], "nist": ["DE.CM"]}
 known_false_positives = Some applications and users may legitimately use attrib.exe to interact with the files. 
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - High Frequency Copy Of Files In Network Share - Rule]
 type = detection
@@ -4002,7 +4002,7 @@ explanation = This analytic is to detect a suspicious high frequency copying/mov
 how_to_implement = o successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1537"]}
 known_false_positives = this behavior may seen in normal transfer of file within network if network share is common place for sharing documents.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - High Process Termination Frequency - Rule]
 type = detection
@@ -4012,7 +4012,7 @@ explanation = This analytics are designed to indentify a high frequency of proce
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the Image (process full path of terminated process) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1486"]}
 known_false_positives = admin or user tool that can terminate multiple process.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Hunting for Log4Shell - Rule]
 type = detection
@@ -4032,7 +4032,7 @@ Finally, a simple table is created to show the scoring and the _raw field. Sort
 how_to_implement = Out of the box, the Web datamodel is required to be pre-filled. However, tested was performed against raw httpd access logs. Change the first line to any dataset to pass the regex's against.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"]}
 known_false_positives = It is highly possible you will find false positives, however, the base score is set to 2 for _any_ jndi found in raw logs. tune and change as needed, include any filtering.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Icacls Deny Command - Rule]
 type = detection
@@ -4042,7 +4042,7 @@ explanation = This analytic identifies a potential adversary that changes the se
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]}
 known_false_positives = Unknown. It is possible some administrative scripts use ICacls. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - ICACLS Grant Command - Rule]
 type = detection
@@ -4052,7 +4052,7 @@ explanation = This analytic identifies potential adversaries that modify the sec
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]}
 known_false_positives = Unknown. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - IcedID Exfiltrated Archived File Creation - Rule]
 type = detection
@@ -4062,7 +4062,7 @@ explanation = This search is to detect a suspicious file creation namely passff.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1560.001", "T1560"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Impacket Lateral Movement Commandline Parameters - Rule]
 type = detection
@@ -4072,7 +4072,7 @@ explanation = This analytic looks for the presence of suspicious commandline par
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.002", "T1021.003", "T1047", "T1543.003"]}
 known_false_positives = Although uncommon, Administrators may leverage Impackets tools to start a process on remote systems for system administration or automation use cases.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Interactive Session on Remote Endpoint with PowerShell - Rule]
 type = detection
@@ -4082,7 +4082,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.006"]}
 known_false_positives = Administrators may leverage WinRM and `Enter-PSSession` for administrative and troubleshooting tasks. This activity is usually limited to a small set of hosts or users. In certain environments, tuning may not be possible.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Java Class File download by Java User Agent - Rule]
 type = detection
@@ -4092,7 +4092,7 @@ explanation = The following analytic identifies a Java user agent performing a G
 how_to_implement = To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"]}
 known_false_positives = Filtering may be required in some instances, filter as needed.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Java Writing JSP File - Rule]
 type = detection
@@ -4102,7 +4102,7 @@ explanation = The following analytic identifies the process java writing a .jsp
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
 known_false_positives = False positives are possible and filtering may be required. Restrict by assets or filter known jsp files that are common for the environment.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Jscript Execution Using Cscript App - Rule]
 type = detection
@@ -4112,7 +4112,7 @@ explanation = This search is to detect a execution of jscript using cscript proc
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Kerberoasting spn request with RC4 encryption - Rule]
 type = detection
@@ -4122,7 +4122,7 @@ explanation = The following analytic leverages Kerberos Event 4769, A Kerberos s
 how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
 annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558", "T1558.003"], "nist": ["DE.CM"]}
 known_false_positives = Older systems that support kerberos RC4 by default like NetApp may generate false positives. Filter as needed
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Kerberos Pre-Authentication Flag Disabled in UserAccountControl - Rule]
 type = detection
@@ -4132,7 +4132,7 @@ explanation = The following analytic leverages Windows Security Event 4738, `A u
 how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `User Account Management` within `Account Management` needs to be enabled.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558", "T1558.004"]}
 known_false_positives = Unknown.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Kerberos Pre-Authentication Flag Disabled with PowerShell - Rule]
 type = detection
@@ -4142,7 +4142,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558", "T1558.004"]}
 known_false_positives = Although unlikely, Administrators may need to set this flag for legitimate purposes.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Kerberos Service Ticket Request Using RC4 Encryption - Rule]
 type = detection
@@ -4152,7 +4152,7 @@ explanation = The following analytic leverages Kerberos Event 4769, A Kerberos s
 how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558", "T1558.001"]}
 known_false_positives = Based on Microsoft documentation, legacy systems or applications will use RC4-HMAC as the default encryption for Kerberos Service Ticket requests. Specifically, systems before Windows Server 2008 and Windows Vista. Newer systems will use AES128 or AES256.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Kerberos TGT Request Using RC4 Encryption - Rule]
 type = detection
@@ -4162,7 +4162,7 @@ explanation = The following analytic leverages Event 4768, A Kerberos authentica
 how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1550"]}
 known_false_positives = Based on Microsoft documentation, legacy systems or applications will use RC4-HMAC as the default encryption for TGT requests. Specifically, systems before Windows Server 2008 and Windows Vista. Newer systems will use AES128 or AES256.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Kerberos User Enumeration - Rule]
 type = detection
@@ -4172,7 +4172,7 @@ explanation = The following analytic leverages Event Id 4768, A Kerberos authent
 how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1589", "T1589.002"]}
 known_false_positives = Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Known Services Killed by Ransomware - Rule]
 type = detection
@@ -4182,7 +4182,7 @@ explanation = This search detects a suspicioous termination of known services ki
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the 7036 EventCode ScManager in System audit Logs from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]}
 known_false_positives = Admin activities or installing related updates may do a sudden stop to list of services we monitor.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Account Manipulation Of SSH Config and Keys - Rule]
 type = detection
@@ -4192,7 +4192,7 @@ explanation = This analytic is to detect a deletion of ssh key in a linux machin
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485", "T1070.004", "T1070"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Add Files In Known Crontab Directories - Rule]
 type = detection
@@ -4202,7 +4202,7 @@ explanation = The following analytic identifies a suspicious file creation in kn
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.003", "T1053"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can create file in crontab folders for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Add User Account - Rule]
 type = detection
@@ -4212,7 +4212,7 @@ explanation = This analytic looks for commands to create user accounts on the li
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Adding Crontab Using List Parameter - Rule]
 type = detection
@@ -4222,7 +4222,7 @@ explanation = The following analytic identifies a suspicious cron jobs modificat
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.003", "T1053"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux At Allow Config File Creation - Rule]
 type = detection
@@ -4232,7 +4232,7 @@ explanation = The following analytic identifies a suspicious file creation of /e
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.003", "T1053"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can create this file for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux At Application Execution - Rule]
 type = detection
@@ -4242,7 +4242,7 @@ explanation = The following analytic identifies a suspicious process creation of
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.002", "T1053"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Change File Owner To Root - Rule]
 type = detection
@@ -4252,7 +4252,7 @@ explanation = This analytic looks for a commandline that change the file owner t
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222.002", "T1222"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Common Process For Elevation Control - Rule]
 type = detection
@@ -4262,7 +4262,7 @@ explanation = This analytic is to look for possible elevation control access usi
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.001", "T1548"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux DD File Overwrite - Rule]
 type = detection
@@ -4272,7 +4272,7 @@ explanation = This analytic is to look for dd command to overwrite file. This te
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Deleting Critical Directory Using RM Command - Rule]
 type = detection
@@ -4282,7 +4282,7 @@ explanation = The following analytic identifies a suspicious deletion of a criti
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Deletion Of Cron Jobs - Rule]
 type = detection
@@ -4292,7 +4292,7 @@ explanation = This analytic is to detect a deletion of cron job in a linux machi
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485", "T1070.004", "T1070"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Deletion Of Init Daemon Script - Rule]
 type = detection
@@ -4302,7 +4302,7 @@ explanation = This analytic is to detect a deletion of init daemon script in a l
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485", "T1070.004", "T1070"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Deletion Of Services - Rule]
 type = detection
@@ -4312,7 +4312,7 @@ explanation = This analytic is to detect a deletion of services in a linux machi
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485", "T1070.004", "T1070"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Deletion of SSL Certificate - Rule]
 type = detection
@@ -4322,7 +4322,7 @@ explanation = This analytic is to detect a deletion of ssl certificate in a linu
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485", "T1070.004", "T1070"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Disable Services - Rule]
 type = detection
@@ -4332,7 +4332,7 @@ explanation = The following analytic is to detect events that attempts to disabl
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Doas Conf File Creation - Rule]
 type = detection
@@ -4342,7 +4342,7 @@ explanation = This analytic is to detect the creation of doas.conf file in linux
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.003", "T1548"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Doas Tool Execution - Rule]
 type = detection
@@ -4352,7 +4352,7 @@ explanation = This analytic is to detect the doas tool execution in linux host p
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.003", "T1548"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Edit Cron Table Parameter - Rule]
 type = detection
@@ -4362,7 +4362,7 @@ explanation = The following analytic identifies a suspicious cronjobs modificati
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.003", "T1053"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux File Created In Kernel Driver Directory - Rule]
 type = detection
@@ -4372,7 +4372,7 @@ explanation = This analytic looks for suspicious file creation in kernel/driver
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.006", "T1547"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can create file in this folders for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux File Creation In Init Boot Directory - Rule]
 type = detection
@@ -4382,7 +4382,7 @@ explanation = This analytic looks for suspicious file creation on init system di
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1037.004", "T1037"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can create file in this folders for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux File Creation In Profile Directory - Rule]
 type = detection
@@ -4392,7 +4392,7 @@ explanation = This analytic looks for suspicious file creation in /etc/profile.d
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.004", "T1546"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can create file in profile.d folders for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux High Frequency Of File Deletion In Boot Folder - Rule]
 type = detection
@@ -4402,7 +4402,7 @@ explanation = This analytic is to detect a high frequency of file deletion relat
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485", "T1070.004", "T1070"], "nist": ["DE.CM"]}
 known_false_positives = linux package installer/uninstaller may cause this event. Please update you filter macro to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux High Frequency Of File Deletion In Etc Folder - Rule]
 type = detection
@@ -4412,7 +4412,7 @@ explanation = This analytic is to detect a high frequency of file deletion relat
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485", "T1070.004", "T1070"], "nist": ["DE.CM"]}
 known_false_positives = linux package installer/uninstaller may cause this event. Please update you filter macro to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Insert Kernel Module Using Insmod Utility - Rule]
 type = detection
@@ -4422,7 +4422,7 @@ explanation = This analytic looks for inserting of linux kernel module using ins
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.006", "T1547"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Install Kernel Module Using Modprobe Utility - Rule]
 type = detection
@@ -4432,7 +4432,7 @@ explanation = This analytic looks for possible installing a linux kernel module
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.006", "T1547"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Iptables Firewall Modification - Rule]
 type = detection
@@ -4442,7 +4442,7 @@ explanation = This analytic looks for suspicious commandline that modify the ipt
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.004", "T1562"], "nist": ["DE.CM"]}
 known_false_positives = administrator may do this commandline for auditing and testing purposes. In this scenario filter is needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Java Spawning Shell - Rule]
 type = detection
@@ -4452,7 +4452,7 @@ explanation = The following analytic identifies the process name of Java, Apache
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is occurring correctly. Ensure EDR product is mapping OS Linux to the datamodel properly. Add any additional java process names for your environment to the analytic as needed.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"]}
 known_false_positives = Filtering may be required on internal developer build systems or classify assets as web facing and restrict the analytic based on asset type.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Kworker Process In Writable Process Path - Rule]
 type = detection
@@ -4462,7 +4462,7 @@ explanation = This analytic looks for suspicious process kworker commandline in
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036.004", "T1036"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux NOPASSWD Entry In Sudoers File - Rule]
 type = detection
@@ -4472,7 +4472,7 @@ explanation = This analytic is to look for suspicious command lines that may add
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.003", "T1548"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux pkexec Privilege Escalation - Rule]
 type = detection
@@ -4482,7 +4482,7 @@ explanation = The following analytic identifies `pkexec` spawning with no comman
 how_to_implement = Depending on the EDR product in use, there are multiple ways to "null" the command-line field, Processes.process. Two that may be useful `process="(^.{0}$)"` or `| where isnull(process)`. To generate data for this behavior, Sysmon for Linux was utilized. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"]}
 known_false_positives = False positives may be present, filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Possible Access Or Modification Of sshd Config File - Rule]
 type = detection
@@ -4492,7 +4492,7 @@ explanation = This analytic is to look for suspicious process command-line that
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1098.004", "T1098"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Possible Access To Credential Files - Rule]
 type = detection
@@ -4502,7 +4502,7 @@ explanation = This analytic is to detect a possible attempt to dump or access th
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.008", "T1003"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Possible Access To Sudoers File - Rule]
 type = detection
@@ -4512,7 +4512,7 @@ explanation = This analytic is to detect a possible access or modification of /e
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.003", "T1548"], "nist": ["DE.CM"]}
 known_false_positives = administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Possible Append Command To At Allow Config File - Rule]
 type = detection
@@ -4522,7 +4522,7 @@ explanation = This analytic looks for suspicious commandline that may use to app
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.002", "T1053"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Possible Append Command To Profile Config File - Rule]
 type = detection
@@ -4532,7 +4532,7 @@ explanation = This analytic looks for suspicious command-lines that can be possi
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.004", "T1546"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Possible Append Cronjob Entry on Existing Cronjob File - Rule]
 type = detection
@@ -4542,7 +4542,7 @@ explanation = This analytic looks for possible suspicious commandline that may u
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.003", "T1053"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Possible Cronjob Modification With Editor - Rule]
 type = detection
@@ -4552,7 +4552,7 @@ explanation = This analytic looks for possible modification of cronjobs file usi
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.003", "T1053"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Possible Ssh Key File Creation - Rule]
 type = detection
@@ -4562,7 +4562,7 @@ explanation = This analytic is to look for possible ssh key file creation on ~/.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1098.004", "T1098"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can create file in ~/.ssh folders for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Preload Hijack Library Calls - Rule]
 type = detection
@@ -4572,7 +4572,7 @@ explanation = This analytic is to detect a suspicious command that may hijack a
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.006", "T1574"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Service File Created In Systemd Directory - Rule]
 type = detection
@@ -4582,7 +4582,7 @@ explanation = This analytic looks for suspicious file creation in systemd timer
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the file name, file path, and process_guid executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.006", "T1053"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can create file in systemd folders for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Service Restarted - Rule]
 type = detection
@@ -4592,7 +4592,7 @@ explanation = This analytic looks for restarted or re-enable services in linux p
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and commandline executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.006", "T1053"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Service Started Or Enabled - Rule]
 type = detection
@@ -4602,7 +4602,7 @@ explanation = This analytic looks for created or enable services in linux platfo
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.006", "T1053"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Setuid Using Chmod Utility - Rule]
 type = detection
@@ -4612,7 +4612,7 @@ explanation = This analytic looks for suspicious chmod utility execution to enab
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.001", "T1548"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Setuid Using Setcap Utility - Rule]
 type = detection
@@ -4622,7 +4622,7 @@ explanation = This analytic looks for suspicious setcap utility execution to ena
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.001", "T1548"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Shred Overwrite Command - Rule]
 type = detection
@@ -4632,7 +4632,7 @@ explanation = This analytic is to detect a shred process to overwrite a files in
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Stop Services - Rule]
 type = detection
@@ -4642,7 +4642,7 @@ explanation = The following analytic is to detect events that attempt to stop or
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Sudo OR Su Execution - Rule]
 type = detection
@@ -4652,7 +4652,7 @@ explanation = This analytic is to detect the execution of sudo or su command in
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.003", "T1548"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Sudoers Tmp File Creation - Rule]
 type = detection
@@ -4662,7 +4662,7 @@ explanation = This analytic is to looks for file creation of sudoers.tmp file ca
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.003", "T1548"], "nist": ["DE.CM"]}
 known_false_positives = administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux System Network Discovery - Rule]
 type = detection
@@ -4672,7 +4672,7 @@ explanation = This analytic is to look for possible enumeration of local network
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1016"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Linux Visudo Utility Execution - Rule]
 type = detection
@@ -4682,7 +4682,17 @@ explanation = This analytic is to looks for suspicious commandline that add entr
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.003", "T1548"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Living Off The Land - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following correlation identifies a distinct amount of analytics associated with the Living Off The Land analytic story that identify potentially suspicious behavior.
+how_to_implement = To implement this correlation search a user needs to enable all detections in the Living Off The Land Analytic Story and confirm it is generating risk events. A simple search `index=risk analyticstories="Living Off The Land"` should contain events.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1105", "T1190", "T1059"], "nist": ["DE.CM"]}
+known_false_positives = There are no known false positive for this search, but it could contain false positives as multiple detections can trigger and not have successful exploitation. Modify the static value distinct_detection_name to a higher value. It is also required to tune analytics that are also tagged to ensure volume is never too much.
+providing_technologies = null
 
 [savedsearch://ESCU - Loading Of Dynwrapx Module - Rule]
 type = detection
@@ -4692,7 +4702,7 @@ explanation = DynamicWrapperX is an ActiveX component that can be used in a scri
 how_to_implement = To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1055.001"]}
 known_false_positives = False positives should be limited, however it is possible to filter by Processes.process_name and specific processes (ex. wscript.exe). Filter as needed. This may need modification based on EDR telemetry and how it brings in registry data. For example, removal of (Default).
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Local Account Discovery with Net - Rule]
 type = detection
@@ -4702,7 +4712,7 @@ explanation = This analytic looks for the execution of `net.exe` or `net1.exe` w
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Local Account Discovery With Wmic - Rule]
 type = detection
@@ -4712,7 +4722,7 @@ explanation = This analytic looks for the execution of `wmic.exe` with command-l
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Log4Shell CVE-2021-44228 Exploitation - Rule]
 type = detection
@@ -4722,7 +4732,7 @@ explanation = This correlation find exploitation of Log4Shell CVE-2021-44228 aga
 how_to_implement = To implement this correlation search a user needs to enable all detections in the Log4Shell Analytic Story and confirm it is generation risk events. A simple search `index=risk analyticstories="Log4Shell CVE-2021-44228"` should contain events.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1105", "T1190", "T1059"], "nist": ["DE.CM"]}
 known_false_positives = There are no known false positive for this search, but it could contain false positives as multiple detections can trigger and not have successful exploitation.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Logon Script Event Trigger Execution - Rule]
 type = detection
@@ -4732,7 +4742,7 @@ explanation = This search is to detect a suspicious modification of registry ent
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1037", "T1037.001"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - MacOS LOLbin - Rule]
 type = detection
@@ -4742,7 +4752,7 @@ explanation = Detect multiple executions of Living off the Land (LOLbin) binarie
 how_to_implement = This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059.004", "T1059"], "nist": ["DE.CM"]}
 known_false_positives = None identified.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - MacOS plutil - Rule]
 type = detection
@@ -4752,7 +4762,7 @@ explanation = Detect usage of plutil to modify plist files. Adversaries can modi
 how_to_implement = This detection uses osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1647"], "nist": ["DE.CM"]}
 known_false_positives = Administrators using plutil to change plist files.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Mailsniper Invoke functions - Rule]
 type = detection
@@ -4762,7 +4772,7 @@ explanation = This search is to detect known mailsniper.ps1 functions executed i
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114", "T1114.001"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Malicious InProcServer32 Modification - Rule]
 type = detection
@@ -4772,7 +4782,7 @@ explanation = The following analytic identifies a process modifying the registry
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.010", "T1112"]}
 known_false_positives = False positives should be limited, filter as needed. In our test case, Remcos used regsvr32.exe to modify the registry. It may be required, dependent upon the EDR tool producing registry events, to remove (Default) from the command-line.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Malicious Powershell Executed As A Service - Rule]
 type = detection
@@ -4782,7 +4792,7 @@ explanation = This detection is to identify the abuse the Windows SC.exe to exec
 how_to_implement = To successfully implement this search, you need to be ingesting Windows System logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569", "T1569.002"]}
 known_false_positives = Creating a hidden powershell service is rare and could key off of those instances.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Malicious PowerShell Process - Encoded Command - Rule]
 type = detection
@@ -4795,7 +4805,7 @@ Alternatively, may use regex per matching here https://regexr.com/662ov.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
 known_false_positives = System administrators may use this option, but it's not common.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule]
 type = detection
@@ -4805,7 +4815,7 @@ explanation = This search looks for PowerShell processes started with parameters
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1059", "T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
 known_false_positives = There may be legitimate reasons to bypass the PowerShell execution policy. The PowerShell script being run with this parameter should be validated to ensure that it is legitimate.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule]
 type = detection
@@ -4815,7 +4825,7 @@ explanation = This search looks for PowerShell processes launched with arguments
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1059", "T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
 known_false_positives = These characters might be legitimately on the command-line, but it is not common.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Mimikatz PassTheTicket CommandLine Parameters - Rule]
 type = detection
@@ -4825,7 +4835,7 @@ explanation = The following analytic looks for the use of Mimikatz command line
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1550", "T1550.003"]}
 known_false_positives = Although highly unlikely, legitimate applications may use the same command line parameters as Mimikatz.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Mmc LOLBAS Execution Process Spawn - Rule]
 type = detection
@@ -4833,9 +4843,9 @@ asset_type = Endpoint
 confidence = medium
 explanation = The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the DCOM protocol and the MMC20 COM object, the executed command is spawned as a child processs of `mmc.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of mmc.exe that are part of the LOLBAS project can help defenders identify lateral movement activity.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
-annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003"]}
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003", "T1218.014"]}
 known_false_positives = Legitimate applications may trigger this behavior, filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Modification Of Wallpaper - Rule]
 type = detection
@@ -4845,7 +4855,7 @@ explanation = This analytic identifies suspicious modification of registry to de
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"]}
 known_false_positives = 3rd party tool may used to changed the wallpaper of the machine
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Modify ACL permission To Files Or Folder - Rule]
 type = detection
@@ -4855,7 +4865,7 @@ explanation = This analytic identifies suspicious modification of ACL permission
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]}
 known_false_positives = administrators may use this command. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Monitor Registry Keys for Print Monitors - Rule]
 type = detection
@@ -4865,7 +4875,7 @@ explanation = This search looks for registry activity associated with modificati
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or via other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report registry modifications.
 annotations = {"cis20": ["CIS 8", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.010", "T1547"], "nist": ["PR.PT", "DE.CM", "PR.AC"]}
 known_false_positives = You will encounter noise from legitimate print-monitor registry entries.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - MS Scripting Process Loading Ldap Module - Rule]
 type = detection
@@ -4875,7 +4885,7 @@ explanation = This search is to detect a suspicious MS scripting process such as
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"]}
 known_false_positives = automation scripting language may used by network operator to do ldap query.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - MS Scripting Process Loading WMI Module - Rule]
 type = detection
@@ -4885,7 +4895,7 @@ explanation = This search is to detect a suspicious MS scripting process such as
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.007"]}
 known_false_positives = automation scripting language may used by network operator to do ldap query.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - MSBuild Suspicious Spawned By Script Process - Rule]
 type = detection
@@ -4895,7 +4905,7 @@ explanation = This analytic is to detect a suspicious child process of MSBuild s
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1127"]}
 known_false_positives = False positives should be limited as developers do not spawn MSBuild via a WSH.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule]
 type = detection
@@ -4905,7 +4915,7 @@ explanation = This search is to detect a suspicious mshta.exe process that spawn
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"]}
 known_false_positives = limitted. this anomaly behavior is not commonly seen in clean host.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - MSHTML Module Load in Office Product - Rule]
 type = detection
@@ -4915,7 +4925,7 @@ explanation = The following detection identifies the module load of mshtml.dll i
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 known_false_positives = Limited false positives will be present, however, tune as necessary.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - MSI Module Loaded by Non-System Binary - Rule]
 type = detection
@@ -4930,7 +4940,7 @@ In addition, `msi.dll` has been abused in DLL side-loading attacks by being load
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002", "T1574"]}
 known_false_positives = It is possible some Administrative utilities will load msi.dll outside of normal system paths, filter as needed.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Msmpeng Application DLL Side Loading - Rule]
 type = detection
@@ -4940,7 +4950,7 @@ explanation = This search is to detect a suspicious creation of msmpeng.exe or m
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002", "T1574"]}
 known_false_positives = quite minimal false positive expected.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule]
 type = detection
@@ -4953,7 +4963,7 @@ The analytics returned fields allow analysts to investigate the event further by
 how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation' within `Account Logon` needs to be enabled.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]}
 known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule]
 type = detection
@@ -4966,7 +4976,7 @@ The analytics returned fields allow analysts to investigate the event further by
 how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]}
 known_false_positives = A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, missconfigured systems and multi-user systems like Citrix farms.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule]
 type = detection
@@ -4979,7 +4989,7 @@ The analytics returned fields allow analysts to investigate the event further by
 how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation` within `Account Logon` needs to be enabled.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]}
 known_false_positives = A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Multiple Users Failing To Authenticate From Process - Rule]
 type = detection
@@ -4992,7 +5002,7 @@ The analytics returned fields allow analysts to investigate the event further by
 how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]}
 known_false_positives = A process failing to authenticate with multiple users is not a common behavior for legitimate user sessions. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule]
 type = detection
@@ -5005,7 +5015,7 @@ The analytics returned fields allow analysts to investigate the event further by
 how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]}
 known_false_positives = A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Net Localgroup Discovery - Rule]
 type = detection
@@ -5015,7 +5025,7 @@ explanation = The following hunting analytic will identify the use of localgroup
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"]}
 known_false_positives = False positives may be present. Tune as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - NET Profiler UAC bypass - Rule]
 type = detection
@@ -5025,7 +5035,7 @@ explanation = This search is to detect modification of registry to bypass UAC wi
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]}
 known_false_positives = limited false positive. It may trigger by some windows update that will modify this registry.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Network Connection Discovery With Arp - Rule]
 type = detection
@@ -5035,7 +5045,7 @@ explanation = This analytic looks for the execution of `arp.exe` utilized to get
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Network Connection Discovery With Net - Rule]
 type = detection
@@ -5045,7 +5055,7 @@ explanation = This analytic looks for the execution of `net.exe` with command-li
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Network Connection Discovery With Netstat - Rule]
 type = detection
@@ -5055,7 +5065,7 @@ explanation = This analytic looks for the execution of `netstat.exe` with comman
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Network Discovery Using Route Windows App - Rule]
 type = detection
@@ -5065,7 +5075,7 @@ explanation = This analytic look for a spawned process of route.exe windows appl
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1016", "T1016.001"]}
 known_false_positives = A network operator or systems administrator may utilize an automated host discovery application that may generate false positives or an amazon ec2 script that uses this application. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Nishang PowershellTCPOneLine - Rule]
 type = detection
@@ -5075,7 +5085,7 @@ explanation = This query detects the Nishang Invoke-PowerShellTCPOneLine utility
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]}
 known_false_positives = Limited false positives may be present. Filter as needed based on initial analysis.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - NLTest Domain Trust Discovery - Rule]
 type = detection
@@ -5085,7 +5095,7 @@ explanation = This search looks for the execution of `nltest.exe` with command-l
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Administrators may use nltest for troubleshooting purposes, otherwise, rarely used.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Non Chrome Process Accessing Chrome Default Dir - Rule]
 type = detection
@@ -5095,7 +5105,7 @@ explanation = This search is to detect an anomaly event of non-chrome process ac
 how_to_implement = To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1555", "T1555.003"]}
 known_false_positives = other browser not listed related to firefox may catch by this rule.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Non Firefox Process Access Firefox Profile Dir - Rule]
 type = detection
@@ -5105,7 +5115,7 @@ explanation = This search is to detect an anomaly event of non-firefox process a
 how_to_implement = To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1555", "T1555.003"]}
 known_false_positives = other browser not listed related to firefox may catch by this rule.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Ntdsutil Export NTDS - Rule]
 type = detection
@@ -5117,7 +5127,7 @@ This technique uses "Install from Media" (IFM), which will extract a copy of the
 how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"]}
 known_false_positives = Highly possible Server Administrators will troubleshoot with ntdsutil.exe, generating false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Office Application Drop Executable - Rule]
 type = detection
@@ -5127,7 +5137,7 @@ explanation = This search is to detect a suspicious MS office application that d
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 known_false_positives = office macro for automation may do this behavior
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Office Application Spawn Regsvr32 process - Rule]
 type = detection
@@ -5137,7 +5147,7 @@ explanation = this detection was designed to identifies suspicious spawned proce
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Office Application Spawn rundll32 process - Rule]
 type = detection
@@ -5147,7 +5157,7 @@ explanation = this detection was designed to identifies suspicious spawned proce
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Office Document Creating Schedule Task - Rule]
 type = detection
@@ -5157,7 +5167,7 @@ explanation = this search detects a potential malicious office document that cre
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Office Document Executing Macro Code - Rule]
 type = detection
@@ -5167,7 +5177,7 @@ explanation = this detection was designed to identifies suspicious office docume
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 known_false_positives = Normal Office Document macro use for automation
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Office Document Spawned Child Process To Download - Rule]
 type = detection
@@ -5177,7 +5187,7 @@ explanation = This search is to detect potential malicious office document execu
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances office application and browser may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 known_false_positives = Default browser not in the filter list.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Office Product Spawn CMD Process - Rule]
 type = detection
@@ -5187,7 +5197,7 @@ explanation = this search is to detect a suspicious office product process that
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"]}
 known_false_positives = IT or network admin may create an document automation that will run shell script.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Office Product Spawning BITSAdmin - Rule]
 type = detection
@@ -5197,7 +5207,7 @@ explanation = The following detection identifies the latest behavior utilized by
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 known_false_positives = No false positives known. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Office Product Spawning CertUtil - Rule]
 type = detection
@@ -5207,7 +5217,7 @@ explanation = The following detection identifies the latest behavior utilized by
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 known_false_positives = No false positives known. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Office Product Spawning MSHTA - Rule]
 type = detection
@@ -5217,7 +5227,7 @@ explanation = The following detection identifies the latest behavior utilized by
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 known_false_positives = No false positives known. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Office Product Spawning Rundll32 with no DLL - Rule]
 type = detection
@@ -5227,7 +5237,7 @@ explanation = The following detection identifies the latest behavior utilized by
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 known_false_positives = False positives should be limited, but if any are present, filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Office Product Spawning Wmic - Rule]
 type = detection
@@ -5237,7 +5247,7 @@ explanation = The following detection identifies the latest behavior utilized by
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 known_false_positives = No false positives known. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Office Product Writing cab or inf - Rule]
 type = detection
@@ -5247,7 +5257,7 @@ explanation = The following analytic identifies behavior related to CVE-2021-404
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 known_false_positives = The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Office Spawning Control - Rule]
 type = detection
@@ -5257,7 +5267,7 @@ explanation = The following detection identifies control.exe spawning from an of
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 known_false_positives = Limited false positives should be present.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Outbound Network Connection from Java Using Default Ports - Rule]
 type = detection
@@ -5267,7 +5277,7 @@ explanation = A required step while exploiting the CVE-2021-44228-Log4j vulnerab
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"]}
 known_false_positives = Legitimate Java applications may use perform outbound connections to these ports. Filter as needed
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Overwriting Accessibility Binaries - Rule]
 type = detection
@@ -5277,7 +5287,7 @@ explanation = Microsoft Windows contains accessibility features that can be laun
 how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546", "T1546.008"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Microsoft may provide updates to these binaries. Verify that these changes do not correspond with your normal software update cycle.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Password Policy Discovery with Net - Rule]
 type = detection
@@ -5287,7 +5297,7 @@ explanation = This analytic looks for the execution of `net.exe` or `net1.exe` w
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Permission Modification using Takeown App - Rule]
 type = detection
@@ -5297,7 +5307,7 @@ explanation = This search is to detect a modification of file or directory permi
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]}
 known_false_positives = takeown.exe is a normal windows application that may used by network operator.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - PetitPotam Network Share Access Request - Rule]
 type = detection
@@ -5310,7 +5320,7 @@ During triage, review parallel security events to identify further suspicious ac
 how_to_implement = Windows Event Code 5145 is required to utilize this analytic and it may not be enabled in most environments.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1187"]}
 known_false_positives = False positives have been limited when the Anonymous Logon is used for Account Name.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - PetitPotam Suspicious Kerberos TGT Request - Rule]
 type = detection
@@ -5320,7 +5330,7 @@ explanation = The following analytic identifes Event Code 4768, A `Kerberos auth
 how_to_implement = The following analytic requires Event Code 4768. Ensure that it is logging no Domain Controllers and appearing in Splunk.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003"]}
 known_false_positives = False positives are possible if the environment is using certificates for authentication.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Ping Sleep Batch Command - Rule]
 type = detection
@@ -5330,7 +5340,7 @@ explanation = This analytic will identify the possible execution of ping sleep b
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1497", "T1497.003"], "nist": ["DE.CM"]}
 known_false_positives = Administrator or network operator may execute this command. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Possible Browser Pass View Parameter - Rule]
 type = detection
@@ -5340,7 +5350,7 @@ explanation = This analytic will detect if a suspicious process contains a comma
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1555.003", "T1555"]}
 known_false_positives = False positive is quite limited. Filter is needed
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Possible Lateral Movement PowerShell Spawn - Rule]
 type = detection
@@ -5348,9 +5358,9 @@ asset_type = Endpoint
 confidence = medium
 explanation = The following analytic assists with identifying a PowerShell process spawned as a child or grand child process of commonly abused processes during lateral movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe` and `mmc.exe`. Legitimate Windows features such as the Service Control Manager, Windows Management Instrumentation, Task Scheduler, Windows Remote Management and the DCOM protocol can be abused to start a process on a remote endpoint. Looking for PowerShell spawned out of this processes may reveal a lateral movement attack. Red Teams and adversaries alike may abuse these services during a breach for lateral movement and remote code execution.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
-annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003", "T1021.006", "T1047", "T1053.005", "T1543.003", "T1059.001"]}
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003", "T1021.006", "T1047", "T1053.005", "T1543.003", "T1059.001", "T1218.014"]}
 known_false_positives = Legitimate applications may spawn PowerShell as a child process of the the identified processes. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Potential password in username - Rule]
 type = detection
@@ -5360,7 +5370,7 @@ explanation = This search identifies users who have entered their passwords in u
 how_to_implement = To successfully implement this search, you need to have relevant authentication logs mapped to the Authentication data model. You also need to have the Splunk TA URL Toolbox (https://splunkbase.splunk.com/app/2734/) installed. The detection must run with a time interval shorter than endtime+1000.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1078.003", "T1552.001"], "nist": ["DE.CM"]}
 known_false_positives = Valid usernames with high entropy or source/destination system pairs with multiple authenticating users will make it difficult to identify the real user authenticating.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Potentially malicious code on commandline - Rule]
 type = detection
@@ -5370,7 +5380,7 @@ explanation = The following analytic uses a pretrained machine learning text cla
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.  You will also need to install the Machine Learning Toolkit version 5.3 or above to apply the pretrained model.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"]}
 known_false_positives = This model is an anomaly detector that identifies usage of APIs and scripting constructs that are correllated with malicious activity.  These APIs and scripting constructs are part of the programming langauge and advanced scripts may generate false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - PowerShell 4104 Hunting - Rule]
 type = detection
@@ -5380,7 +5390,7 @@ explanation = The following Hunting analytic assists with identifying suspicious
 how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]}
 known_false_positives = Limited false positives. May filter as needed.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - PowerShell - Connect To Internet With Hidden Window - Rule]
 type = detection
@@ -5390,7 +5400,7 @@ explanation = The following hunting analytic identifies PowerShell commands util
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1059.001", "T1059"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
 known_false_positives = Legitimate process can have this combination of command-line options, but it's not common.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Powershell Creating Thread Mutex - Rule]
 type = detection
@@ -5398,9 +5408,9 @@ asset_type = Endpoint
 confidence = medium
 explanation = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using the `mutex` function. This function is commonly seen in some obfuscated PowerShell scripts to make sure that only one instance of there process is running on a compromise machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027", "T1027.005"]}
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027", "T1027.005", "T1059.001"]}
 known_false_positives = powershell developer may used this function in their script for instance checking too.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Powershell Disable Security Monitoring - Rule]
 type = detection
@@ -5410,7 +5420,7 @@ explanation = This search is to identifies a modification in registry to disable
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = Limited false positives. However, tune based on scripts that may perform this action.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - PowerShell Domain Enumeration - Rule]
 type = detection
@@ -5422,7 +5432,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059", "T1059.001"]}
 known_false_positives = It is possible there will be false positives, filter as needed.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Powershell Enable SMB1Protocol Feature - Rule]
 type = detection
@@ -5432,7 +5442,7 @@ explanation = This search is to detect a suspicious enabling of smb1protocol thr
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027", "T1027.005"]}
 known_false_positives = network operator may enable or disable this windows feature.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Powershell Execute COM Object - Rule]
 type = detection
@@ -5440,9 +5450,9 @@ asset_type = Endpoint
 confidence = medium
 explanation = This search is to detect a COM CLSID execution through powershell. This technique was seen in several adversaries and malware like ransomware conti where it has a feature to execute command using COM Object. This technique may use by network operator at some cases but a good indicator if some application want to gain privilege escalation or bypass uac.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.015", "T1546"]}
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.015", "T1546", "T1059.001"]}
 known_false_positives = network operrator may use this command.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule]
 type = detection
@@ -5455,7 +5465,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1055", "T1059.001"]}
 known_false_positives = Limited false positives. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule]
 type = detection
@@ -5468,7 +5478,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1027", "T1059.001"]}
 known_false_positives = False positives should be limited. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - PowerShell Get LocalGroup Discovery - Rule]
 type = detection
@@ -5478,7 +5488,7 @@ explanation = The following hunting analytic identifies the use of `get-localgro
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"]}
 known_false_positives = False positives may be present. Tune as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Powershell Get LocalGroup Discovery with Script Block Logging - Rule]
 type = detection
@@ -5490,7 +5500,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"]}
 known_false_positives = False positives may be present. Tune as needed.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - PowerShell Loading DotNET into Memory via Reflection - Rule]
 type = detection
@@ -5502,7 +5512,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]}
 known_false_positives = False positives should be limited as day to day scripts do not use this method.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Powershell Processing Stream Of Data - Rule]
 type = detection
@@ -5512,7 +5522,7 @@ explanation = The following analytic identifies suspicious PowerShell script exe
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"]}
 known_false_positives = powershell may used this function to process compressed data.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Powershell Remote Thread To Known Windows Process - Rule]
 type = detection
@@ -5522,7 +5532,7 @@ explanation = this search is designed to detect suspicious powershell process th
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, Create Remote thread from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of create remote thread may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Powershell Remove Windows Defender Directory - Rule]
 type = detection
@@ -5532,7 +5542,7 @@ explanation = This analytic will identify a suspicious PowerShell command used t
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - PowerShell Start-BitsTransfer - Rule]
 type = detection
@@ -5542,7 +5552,7 @@ explanation = Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. S
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197"]}
 known_false_positives = Limited false positives. It is possible administrators will utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent process or command-line arguments.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Powershell Using memory As Backing Store - Rule]
 type = detection
@@ -5552,7 +5562,7 @@ explanation = The following analytic identifies suspicious PowerShell script exe
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001", "T1059"]}
 known_false_positives = powershell may used this function to store out object into memory.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Powershell Windows Defender Exclusion Commands - Rule]
 type = detection
@@ -5562,7 +5572,7 @@ explanation = This analytic will detect a suspicious process commandline related
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to use this windows features.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule]
 type = detection
@@ -5572,7 +5582,7 @@ explanation = This search is to detect a suspicious bcdedit.exe execution to ign
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed bcdedit.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]}
 known_false_positives = Administrators may modify the boot configuration ignore failure during testing and debugging.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Print Spooler Adding A Printer Driver - Rule]
 type = detection
@@ -5584,7 +5594,7 @@ During triage, isolate the endpoint and review for source of exploitation. Captu
 how_to_implement = You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]}
 known_false_positives = Unknown. This may require filtering.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Print Spooler Failed to Load a Plug-in - Rule]
 type = detection
@@ -5597,7 +5607,7 @@ During triage, isolate the endpoint and review for source of exploitation. Captu
 how_to_implement = You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]}
 known_false_positives = False positives are unknown and filtering may be required.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Process Creating LNK file in Suspicious Location - Rule]
 type = detection
@@ -5607,7 +5617,7 @@ explanation = This search looks for a process launching an `*.lnk` file under `C
 how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon.
 annotations = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566", "T1566.002"], "nist": ["ID.AM", "PR.DS"]}
 known_false_positives = This detection should yield little or no false positive results. It is uncommon for LNK files to be executed from temporary or user directories.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Process Deleting Its Process File Path - Rule]
 type = detection
@@ -5617,7 +5627,7 @@ explanation = This detection is to identify a suspicious process that tries to d
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Process Execution via WMI - Rule]
 type = detection
@@ -5627,7 +5637,7 @@ explanation = The following analytic identifies `WmiPrvSE.exe` spawning a proces
 how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]}
 known_false_positives = Although unlikely, administrators may use wmi to execute commands for legitimate purposes.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Process Kill Base On File Path - Rule]
 type = detection
@@ -5637,7 +5647,7 @@ explanation = The following analytic identifies the use of `wmic.exe` using `del
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = Unknown.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Process Writing DynamicWrapperX - Rule]
 type = detection
@@ -5647,7 +5657,7 @@ explanation = DynamicWrapperX is an ActiveX component that can be used in a scri
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1559.001"]}
 known_false_positives = False positives should be limited, however it is possible to filter by Processes.process_name and specific processes (ex. wscript.exe). Filter as needed. This may need modification based on EDR telemetry and how it brings in registry data. For example, removal of (Default).
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Processes launching netsh - Rule]
 type = detection
@@ -5657,7 +5667,7 @@ explanation = This search looks for processes launching netsh.exe. Netsh is a co
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004", "T1562"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Some VPN applications are known to launch netsh.exe. Outside of these instances, it is unusual for an executable to launch netsh.exe and run commands.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Ransomware Notes bulk creation - Rule]
 type = detection
@@ -5667,7 +5677,7 @@ explanation = The following analytics identifies a big number of instance of ran
 how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1486"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Recon AVProduct Through Pwh or WMI - Rule]
 type = detection
@@ -5677,7 +5687,7 @@ explanation = The following analytic identifies suspicious PowerShell script exe
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]}
 known_false_positives = network administrator may used this command for checking purposes
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Recon Using WMI Class - Rule]
 type = detection
@@ -5685,9 +5695,9 @@ asset_type = Endpoint
 confidence = medium
 explanation = The following analytic identifies suspicious PowerShell via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found where the adversary will identify services and system information on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]}
+annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592", "T1059.001"]}
 known_false_positives = network administrator may used this command for checking purposes
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Recursive Delete of Directory In Batch CMD - Rule]
 type = detection
@@ -5697,7 +5707,7 @@ explanation = This search is to detect a suspicious commandline designed to dele
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004", "T1070"]}
 known_false_positives = network operator may use this batch command to delete recursively a directory or files within directory
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule]
 type = detection
@@ -5707,7 +5717,7 @@ explanation = The search looks for reg.exe modifying registry keys that define W
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1574.011", "T1574"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]}
 known_false_positives = It is unusual for a service to be created or modified by directly manipulating the registry. However, there may be legitimate instances of this behavior. It is important to validate and investigate, as appropriate.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Registry Keys for Creating SHIM Databases - Rule]
 type = detection
@@ -5717,7 +5727,7 @@ explanation = This search looks for registry activity associated with applicatio
 how_to_implement = To successfully implement this search, you must populate the Change_Analysis data model. This is typically populated via endpoint detection and response product, such as Carbon Black or other endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011", "T1546"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = There are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Registry Keys Used For Persistence - Rule]
 type = detection
@@ -5727,7 +5737,7 @@ explanation = The search looks for modifications to registry keys that can be us
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.001", "T1547"], "nist": ["PR.PT", "DE.CM", "DE.AE"]}
 known_false_positives = There are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Registry Keys Used For Privilege Escalation - Rule]
 type = detection
@@ -5737,7 +5747,7 @@ explanation = This search looks for modifications to registry keys that can be u
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.012", "T1546"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = There are many legitimate applications that must execute upon system startup and will use these registry keys to accomplish that task.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule]
 type = detection
@@ -5747,7 +5757,7 @@ explanation = This analytic is to detect a loading of dll using regsvr32 applica
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"]}
 known_false_positives = Other third part application may used this parameter but not so common in base windows environment.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule]
 type = detection
@@ -5757,7 +5767,7 @@ explanation = The following analytic identifies Regsvr32.exe utilizing the silen
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"]}
 known_false_positives = minimal. but network operator can use this application to load dll.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Remcos client registry install entry - Rule]
 type = detection
@@ -5767,7 +5777,7 @@ explanation = This search detects registry key license at host where Remcos RAT
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Remcos RAT File Creation in Remcos Folder - Rule]
 type = detection
@@ -5777,7 +5787,7 @@ explanation = This search is to detect file creation in remcos folder in appdata
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1113"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Remote Process Instantiation via DCOM and PowerShell - Rule]
 type = detection
@@ -5787,7 +5797,7 @@ explanation = This analytic looks for the execution of `powershell.exe` with arg
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003"]}
 known_false_positives = Administrators may leverage DCOM to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Remote Process Instantiation via DCOM and PowerShell Script Block - Rule]
 type = detection
@@ -5797,7 +5807,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003"]}
 known_false_positives = Administrators may leverage DCOM to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Remote Process Instantiation via WinRM and PowerShell - Rule]
 type = detection
@@ -5807,7 +5817,7 @@ explanation = This analytic looks for the execution of `powershell.exe` with arg
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.006"]}
 known_false_positives = Administrators may leverage WinRM and `Invoke-Command` to start a process on remote systems for system administration or automation use cases. However, this activity is usually limited to a small set of hosts or users.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Remote Process Instantiation via WinRM and PowerShell Script Block - Rule]
 type = detection
@@ -5817,7 +5827,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.006"]}
 known_false_positives = Administrators may leverage WinRM and `Invoke-Command` to start a process on remote systems for system administration or automation use cases. This activity is usually limited to a small set of hosts or users. In certain environments, tuning may not be possible.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Remote Process Instantiation via WinRM and Winrs - Rule]
 type = detection
@@ -5827,7 +5837,7 @@ explanation = This analytic looks for the execution of `winrs.exe` with command-
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.006"]}
 known_false_positives = Administrators may leverage WinRM and WinRs to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Remote Process Instantiation via WMI - Rule]
 type = detection
@@ -5837,7 +5847,7 @@ explanation = This analytic identifies wmic.exe being launched with parameters t
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]}
 known_false_positives = The wmic.exe utility is a benign Windows application. It may be used legitimately by Administrators with these parameters for remote system administration, but it's relatively uncommon.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Remote Process Instantiation via WMI and PowerShell - Rule]
 type = detection
@@ -5847,7 +5857,7 @@ explanation = This analytic looks for the execution of `powershell.exe` leveragi
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1047"]}
 known_false_positives = Administrators may leverage WWMI and powershell.exe to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Remote Process Instantiation via WMI and PowerShell Script Block - Rule]
 type = detection
@@ -5857,7 +5867,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1047"]}
 known_false_positives = Administrators may leverage WWMI and powershell.exe to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Remote System Discovery with Adsisearcher - Rule]
 type = detection
@@ -5867,7 +5877,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]}
 known_false_positives = Administrators or power users may use Adsisearcher for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Remote System Discovery with Dsquery - Rule]
 type = detection
@@ -5877,7 +5887,7 @@ explanation = This analytic looks for the execution of `dsquery.exe` with comman
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Remote System Discovery with Net - Rule]
 type = detection
@@ -5887,7 +5897,7 @@ explanation = This analytic looks for the execution of `net.exe` or `net1.exe` w
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Remote System Discovery with Wmic - Rule]
 type = detection
@@ -5897,7 +5907,7 @@ explanation = This analytic looks for the execution of `wmic.exe` with command-l
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Remote WMI Command Attempt - Rule]
 type = detection
@@ -5907,7 +5917,7 @@ explanation = The following analytic identifies usage of `wmic.exe` spawning a l
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. Deprecated because duplicate of Remote Process Instantiation via WMI.
 annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]}
 known_false_positives = Administrators may use this legitimately to gather info from remote systems. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Resize ShadowStorage volume - Rule]
 type = detection
@@ -5917,7 +5927,7 @@ explanation = The following analytics identifies the resizing of shadowstorage b
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]}
 known_false_positives = network admin can resize the shadowstorage for valid purposes.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Revil Common Exec Parameter - Rule]
 type = detection
@@ -5927,7 +5937,7 @@ explanation = This analytic identifies suspicious commandline parameter that are
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]}
 known_false_positives = third party tool may have same command line parameters as revil ransomware.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Revil Registry Entry - Rule]
 type = detection
@@ -5937,7 +5947,7 @@ explanation = This analytic identifies suspicious modification in registry entry
 how_to_implement = to successfully implement this search, you need to be ingesting logs with the Image, TargetObject registry key, registry Details from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Rubeus Command Line Parameters - Rule]
 type = detection
@@ -5947,7 +5957,7 @@ explanation = Rubeus is a C# toolset for raw Kerberos interaction and abuses. It
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1550", "T1550.003", "T1558", "T1558.003", "T1558.004"]}
 known_false_positives = Although unlikely, legitimate applications may use the same command line parameters as Rubeus. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Rubeus Kerberos Ticket Exports Through Winlogon Access - Rule]
 type = detection
@@ -5957,7 +5967,7 @@ explanation = The following analytic looks for a process accessing the winlogon.
 how_to_implement = This search needs Sysmon Logs and a sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1550", "T1550.003"]}
 known_false_positives = Legitimate applications may obtain a handle for winlogon.exe. Filter as needed
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Runas Execution in CommandLine - Rule]
 type = detection
@@ -5967,7 +5977,7 @@ explanation = This analytic look for a spawned runas.exe process with a administ
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134", "T1134.001"]}
 known_false_positives = A network operator or systems administrator may utilize an automated or manual execute this command that may generate false positives. filter is needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Rundll32 Control RunDLL Hunt - Rule]
 type = detection
@@ -5977,7 +5987,7 @@ explanation = The following hunting detection identifies rundll32.exe with `cont
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]}
 known_false_positives = This is a hunting detection, meant to provide a understanding of how voluminous control_rundll is within the environment.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Rundll32 Control RunDLL World Writable Directory - Rule]
 type = detection
@@ -5987,7 +5997,7 @@ explanation = The following detection identifies rundll32.exe with `control_rund
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]}
 known_false_positives = This may be tuned, or a new one related, by adding .cpl to command-line. However, it's important to look for both. Tune/filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Rundll32 Create Remote Thread To A Process - Rule]
 type = detection
@@ -5997,7 +6007,7 @@ explanation = This analytic identifies the suspicious Remote Thread execution of
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Rundll32 CreateRemoteThread In Browser - Rule]
 type = detection
@@ -6007,7 +6017,7 @@ explanation = This analytic identifies the suspicious Remote Thread execution of
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the SourceImage, TargetImage, and EventCode executions from your endpoints related to create remote thread or injecting codes. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Rundll32 DNSQuery - Rule]
 type = detection
@@ -6017,7 +6027,7 @@ explanation = This search is to detect a suspicious rundll32.exe process having
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and eventcode = 22 dnsquery executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Rundll32 LockWorkStation - Rule]
 type = detection
@@ -6027,7 +6037,7 @@ explanation = This search is to detect a suspicious rundll32 commandline to lock
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Rundll32 Process Creating Exe Dll Files - Rule]
 type = detection
@@ -6037,7 +6047,7 @@ explanation = This search is to detect a suspicious rundll32 process that drops
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, TargetFilename, and eventcode 11 executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Rundll32 Shimcache Flush - Rule]
 type = detection
@@ -6047,7 +6057,7 @@ explanation = This analytic is to detect a suspicious rundll32 commandline to cl
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Rundll32 with no Command Line Arguments with Network - Rule]
 type = detection
@@ -6057,7 +6067,7 @@ explanation = The following analytic identifies rundll32.exe with no command lin
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]}
 known_false_positives = Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - RunDLL Loading DLL By Ordinal - Rule]
 type = detection
@@ -6067,7 +6077,7 @@ explanation = The following analytic identifies rundll32.exe loading an export f
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = False positives are possible with native utilities and third party applications. Filtering may be needed based on command-line, or add world writeable paths to restrict query.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Ryuk Test Files Detected - Rule]
 type = detection
@@ -6077,7 +6087,7 @@ explanation = The search looks for files that contain the key word *Ryuk* under
 how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint Filesystem data-model object. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1486"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = If there are files with this keywoord as file names it might trigger false possitives, please make use of our filters to tune out potential FPs.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Ryuk Wake on LAN Command - Rule]
 type = detection
@@ -6087,7 +6097,7 @@ explanation = This Splunk query identifies the use of Wake-on-LAN utilized by Ry
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.003"]}
 known_false_positives = Limited to no known false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - SAM Database File Access Attempt - Rule]
 type = detection
@@ -6097,7 +6107,7 @@ explanation = The following analytic identifies access to SAM, SYSTEM or SECURIT
 how_to_implement = To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"]}
 known_false_positives = Natively, `dllhost.exe` will access the files. Every environment will have additional native processes that do as well. Filter by process_name. As an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Samsam Test File Write - Rule]
 type = detection
@@ -6107,7 +6117,7 @@ explanation = The search looks for a file named "test.txt" written to the window
 how_to_implement = You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data-model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1486"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = No false positives have been identified.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Sc exe Manipulating Windows Services - Rule]
 type = detection
@@ -6117,7 +6127,7 @@ explanation = This search looks for arguments to sc.exe indicating the creation
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003", "T1543"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]}
 known_false_positives = Using sc.exe to manipulate Windows services is uncommon. However, there may be legitimate instances of this behavior. It is important to validate and investigate as appropriate.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - SchCache Change By App Connect And Create ADSI Object - Rule]
 type = detection
@@ -6127,7 +6137,7 @@ explanation = This analytic is to detect an application try to connect and creat
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.002", "T1087"]}
 known_false_positives = normal application like mmc.exe and other ldap query tool may trigger this detections.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Schedule Task with HTTP Command Arguments - Rule]
 type = detection
@@ -6137,7 +6147,7 @@ explanation = The following query utilizes Windows Security EventCode 4698, `A s
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Schedule Task with Rundll32 Command Trigger - Rule]
 type = detection
@@ -6147,7 +6157,7 @@ explanation = The following query utilizes Windows Security EventCode 4698, `A s
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule]
 type = detection
@@ -6157,7 +6167,7 @@ explanation = This analytic looks for the execution of `at.exe` with command-lin
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053", "T1053.002"]}
 known_false_positives = Administrators may create scheduled tasks on remote systems, but this activity is usually limited to a small set of hosts or users.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Scheduled Task Deleted Or Created via CMD - Rule]
 type = detection
@@ -6167,7 +6177,7 @@ explanation = The following analytic identifies the creation or deletion of a sc
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"]}
 known_false_positives = It is possible scripts or administrators may trigger this analytic. Filter as needed based on parent process, application.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Scheduled Task Initiation on Remote Endpoint - Rule]
 type = detection
@@ -6177,7 +6187,7 @@ explanation = This analytic looks for the execution of `schtasks.exe` with comma
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053", "T1053.005"]}
 known_false_positives = Administrators may start scheduled tasks on remote systems, but this activity is usually limited to a small set of hosts or users.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Schtasks Run Task On Demand - Rule]
 type = detection
@@ -6187,7 +6197,7 @@ explanation = This analytic identifies an on demand run of a Windows Schedule Ta
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed schtasks.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]}
 known_false_positives = Administrators may use to debug Schedule Task entries. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Schtasks scheduling job on remote system - Rule]
 type = detection
@@ -6197,7 +6207,7 @@ explanation = This analytic looks for the execution of `schtasks.exe` with comma
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"]}
 known_false_positives = Administrators may create scheduled tasks on remote systems, but this activity is usually limited to a small set of hosts or users. It is important to validate and investigate as appropriate.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Schtasks used for forcing a reboot - Rule]
 type = detection
@@ -6207,7 +6217,7 @@ explanation = This search looks for flags passed to schtasks.exe on the command-
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"]}
 known_false_positives = Administrators may create jobs on systems forcing reboots to perform updates, maintenance, etc.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Screensaver Event Trigger Execution - Rule]
 type = detection
@@ -6217,7 +6227,7 @@ explanation = This analytic is developed to detect possible event trigger execut
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546", "T1546.002"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Script Execution via WMI - Rule]
 type = detection
@@ -6227,7 +6237,7 @@ explanation = This search looks for scripts launched via WMI.
 how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]}
 known_false_positives = Although unlikely, administrators may use wmi to launch scripts for legitimate purposes. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Sdclt UAC Bypass - Rule]
 type = detection
@@ -6237,7 +6247,7 @@ explanation = This search is to detect a suspicious sdclt.exe registry modificat
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]}
 known_false_positives = Limited to no false positives are expected.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Sdelete Application Execution - Rule]
 type = detection
@@ -6247,7 +6257,7 @@ explanation = This analytic is to detect the execution of sdelete.exe applicatio
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485", "T1070.004", "T1070"]}
 known_false_positives = user may execute and use this application
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - SearchProtocolHost with no Command Line with Network - Rule]
 type = detection
@@ -6257,7 +6267,7 @@ explanation = The following analytic identifies searchprotocolhost.exe with no c
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - SecretDumps Offline NTDS Dumping Tool - Rule]
 type = detection
@@ -6267,7 +6277,7 @@ explanation = This analytic detects a potential usage of secretsdump.py tool for
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.003", "T1003"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - ServicePrincipalNames Discovery with PowerShell - Rule]
 type = detection
@@ -6281,7 +6291,7 @@ During triage, review parallel processes for further suspicious activity.
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558.003"]}
 known_false_positives = False positives should be limited, however filter as needed.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - ServicePrincipalNames Discovery with SetSPN - Rule]
 type = detection
@@ -6298,7 +6308,7 @@ During triage, review parallel processes for further suspicious activity.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558.003"]}
 known_false_positives = False positives may be caused by Administrators resetting SPNs or querying for SPNs. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Services Escalate Exe - Rule]
 type = detection
@@ -6308,7 +6318,7 @@ explanation = The following analytic identifies the use of `svc-exe` with Cobalt
 how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"]}
 known_false_positives = False positives should be limited as `services.exe` should never spawn a process from `ADMIN$`. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Services LOLBAS Execution Process Spawn - Rule]
 type = detection
@@ -6318,7 +6328,7 @@ explanation = The following analytic identifies `services.exe` spawning a LOLBAS
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543", "T1543.003"]}
 known_false_positives = Legitimate applications may trigger this behavior, filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule]
 type = detection
@@ -6328,7 +6338,7 @@ explanation = Monitor for changes of the ExecutionPolicy in the registry to the
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Registry node. You must also be ingesting logs with the fields registry_path, registry_key_name, and registry_value_name from your endpoints.
 annotations = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1059", "T1059.001"], "nist": ["DE.CM"]}
 known_false_positives = Administrators may attempt to change the default execution policy on a system for a variety of reasons. However, setting the policy to "unrestricted" or "bypass" as this search is designed to identify, would be unusual. Hits should be reviewed and investigated as appropriate.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Shim Database File Creation - Rule]
 type = detection
@@ -6338,7 +6348,7 @@ explanation = This search looks for shim database files being written to default
 how_to_implement = You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint file-system data model node. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011", "T1546"], "nist": ["DE.CM"]}
 known_false_positives = Because legitimate shim files are created and used all the time, this event, in itself, is not suspicious. However, if there are other correlating events, it may warrant further investigation.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Shim Database Installation With Suspicious Parameters - Rule]
 type = detection
@@ -6348,7 +6358,7 @@ explanation = This search detects the process execution and arguments required t
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011", "T1546"], "nist": ["DE.CM"]}
 known_false_positives = None identified
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Short Lived Scheduled Task - Rule]
 type = detection
@@ -6358,7 +6368,7 @@ explanation = The following analytic leverages Windows Security EventCode 4698,
 how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005"]}
 known_false_positives = Although uncommon, legitimate applications may create and delete a Scheduled Task within 30 seconds. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Short Lived Windows Accounts - Rule]
 type = detection
@@ -6368,7 +6378,7 @@ explanation = This search detects accounts that were created and deleted in a sh
 how_to_implement = This search requires you to have enabled your Group Management Audit Logs in your Local Windows Security Policy and be ingesting those logs.  More information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.IP"]}
 known_false_positives = It is possible that an administrator created and deleted an account in a short time period.  Verifying activity with an administrator is advised.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - SilentCleanup UAC Bypass - Rule]
 type = detection
@@ -6378,7 +6388,7 @@ explanation = This search is to detect a suspicious modification of registry tha
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Single Letter Process On Endpoint - Rule]
 type = detection
@@ -6388,7 +6398,7 @@ explanation = This search looks for process names that consist only of a single
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204", "T1204.002"], "nist": ["ID.AM", "PR.DS"]}
 known_false_positives = Single-letter executables are not always malicious. Investigate this activity with your normal incident-response process.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - SLUI RunAs Elevated - Rule]
 type = detection
@@ -6398,7 +6408,7 @@ explanation = The following analytic identifies the Microsoft Software Licensing
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]}
 known_false_positives = Limited false positives should be present as this is not commonly used by legitimate applications.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - SLUI Spawning a Process - Rule]
 type = detection
@@ -6408,7 +6418,7 @@ explanation = The following analytic identifies the Microsoft Software Licensing
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]}
 known_false_positives = Certain applications may spawn from `slui.exe` that are legitimate. Filtering will be needed to ensure proper monitoring.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Spoolsv Spawning Rundll32 - Rule]
 type = detection
@@ -6418,7 +6428,7 @@ explanation = The following analytic identifies a suspicious child process, `run
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]}
 known_false_positives = Limited false positives have been identified. There are limited instances where `rundll32.exe` may be spawned by a legitimate print driver.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Spoolsv Suspicious Loaded Modules - Rule]
 type = detection
@@ -6428,7 +6438,7 @@ explanation = This search is to detect suspicious loading of dll in specific pat
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Spoolsv Suspicious Process Access - Rule]
 type = detection
@@ -6438,7 +6448,7 @@ explanation = This analytic identifies a suspicious behavior related to PrintNig
 how_to_implement = To successfully implement this search, you need to be ingesting logs with process access event where SourceImage, TargetImage, GrantedAccess and CallTrace executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of spoolsv.exe.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"]}
 known_false_positives = Unknown. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Spoolsv Writing a DLL - Rule]
 type = detection
@@ -6448,7 +6458,7 @@ explanation = The following analytic identifies a `.dll` being written by `spool
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]}
 known_false_positives = Unknown.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Spoolsv Writing a DLL - Sysmon - Rule]
 type = detection
@@ -6458,7 +6468,7 @@ explanation = The following analytic identifies a `.dll` being written by `spool
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]}
 known_false_positives = Limited false positives. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Sqlite Module In Temp Folder - Rule]
 type = detection
@@ -6468,7 +6478,7 @@ explanation = This search is to detect a suspicious file creation of sqlite3.dll
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1005"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious Computer Account Name Change - Rule]
 type = detection
@@ -6478,7 +6488,7 @@ explanation = As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain
 how_to_implement = To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.002"]}
 known_false_positives = Renaming a computer account name to a name that not end with '$' is highly unsual and may not have any legitimate scenarios.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Suspicious Copy on System32 - Rule]
 type = detection
@@ -6488,7 +6498,7 @@ explanation = This analytic is to detect a suspicious copy of file from systemro
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036.003", "T1036"]}
 known_false_positives = every user may do this event but very un-ussual.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious DLLHost no Command Line Arguments - Rule]
 type = detection
@@ -6498,7 +6508,7 @@ explanation = The following analytic identifies DLLHost.exe with no command line
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious Driver Loaded Path - Rule]
 type = detection
@@ -6508,7 +6518,7 @@ explanation = This analytic will detect suspicious driver loaded paths. This tec
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003", "T1543"]}
 known_false_positives = Limited false positives will be present. Some applications do load drivers
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious Event Log Service Behavior - Rule]
 type = detection
@@ -6518,7 +6528,7 @@ explanation = The following analytic utilizes Windows Event ID 1100 to identify
 how_to_implement = To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]}
 known_false_positives = It is possible the Event Logging service gets shut down due to system errors or legitimately administration tasks. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Suspicious GPUpdate no Command Line Arguments - Rule]
 type = detection
@@ -6528,7 +6538,7 @@ explanation = The following analytic identifies gpupdate.exe with no command lin
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious IcedID Rundll32 Cmdline - Rule]
 type = detection
@@ -6538,7 +6548,7 @@ explanation = This search is to detect a suspicious rundll32.exe commandline to
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]}
 known_false_positives = limitted. this parameter is not commonly used by windows application but can be used by the network operator.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious Image Creation In Appdata Folder - Rule]
 type = detection
@@ -6548,7 +6558,7 @@ explanation = This search is to detect a suspicious creation of image in appdata
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1113"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious Kerberos Service Ticket Request - Rule]
 type = detection
@@ -6558,7 +6568,7 @@ explanation = As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain
 how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.002"]}
 known_false_positives = We have tested this detection logic with ~2 million 4769 events and did not identify false positives. However, they may be possible in certain environments. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Suspicious Linux Discovery Commands - Rule]
 type = detection
@@ -6569,7 +6579,7 @@ The search logic specifically looks for high number of distinct commands run in
 how_to_implement = This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/). Please install this add-on to parse fields correctly and execute detection search. Consider customizing the time window and threshold values according to your environment.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.004"]}
 known_false_positives = Unless an administrator is using these commands to troubleshoot or audit a system, the execution of these commands should be monitored.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious microsoft workflow compiler rename - Rule]
 type = detection
@@ -6579,7 +6589,7 @@ explanation = The following analytic identifies a renamed instance of microsoft.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, some legitimate applications may use a moved copy of microsoft.workflow.compiler.exe, triggering a false positive.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious microsoft workflow compiler usage - Rule]
 type = detection
@@ -6589,7 +6599,7 @@ explanation = The following analytic identifies microsoft.workflow.compiler.exe
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, limited instances have been identified coming from native Microsoft utilities similar to SCCM.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious msbuild path - Rule]
 type = detection
@@ -6599,7 +6609,7 @@ explanation = The following analytic identifies msbuild.exe executing from a non
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003", "T1127.001"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Some legitimate applications may use a moved copy of msbuild.exe, triggering a false positive. Baselining of MSBuild.exe usage is recommended to better understand it's path usage. Visual Studio runs an instance out of a path that will need to be filtered on.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious MSBuild Rename - Rule]
 type = detection
@@ -6609,7 +6619,7 @@ explanation = The following analytic identifies renamed instances of msbuild.exe
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003", "T1127.001"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, some legitimate applications may use a moved copy of msbuild, triggering a false positive.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious MSBuild Spawn - Rule]
 type = detection
@@ -6619,7 +6629,7 @@ explanation = The following analytic identifies wmiprvse.exe spawning msbuild.ex
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127", "T1127.001"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious mshta child process - Rule]
 type = detection
@@ -6629,7 +6639,7 @@ explanation = The following analytic identifies child processes spawning from  "
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious mshta spawn - Rule]
 type = detection
@@ -6639,7 +6649,7 @@ explanation = The following analytic identifies wmiprvse.exe spawning mshta.exe.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious Process DNS Query Known Abuse Web Services - Rule]
 type = detection
@@ -6649,7 +6659,7 @@ explanation = This analytic detects a suspicious process making a DNS query via
 how_to_implement = This detection relies on sysmon logs with the Event ID 22, DNS Query. We suggest you run this detection at least once a day over the last 14 days.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.005", "T1059"]}
 known_false_positives = Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, a filter is needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious Process File Path - Rule]
 type = detection
@@ -6659,7 +6669,7 @@ explanation = The following analytic will detect a suspicious process running in
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543"]}
 known_false_positives = Administrators may allow execution of specific binaries in non-standard paths. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious Process With Discord DNS Query - Rule]
 type = detection
@@ -6669,7 +6679,7 @@ explanation = This analytic identifies a process making a DNS query to Discord,
 how_to_implement = his detection relies on sysmon logs with the Event ID 22, DNS Query.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.005", "T1059"], "nist": ["DE.CM"]}
 known_false_positives = Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, a filter is needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious Reg exe Process - Rule]
 type = detection
@@ -6679,7 +6689,7 @@ explanation = This search looks for reg.exe being launched from a command prompt
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
 known_false_positives = It's possible for system administrators to write scripts that exhibit this behavior. If this is the case, the search will need to be modified to filter them out.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule]
 type = detection
@@ -6689,7 +6699,7 @@ explanation = Adversaries may abuse Regsvr32.exe to proxy execution of malicious
 how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. Tune the query by filtering additional extensions found to be used by  legitimate processes. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"]}
 known_false_positives = Limited false positives with the query restricted to specified paths. Add more world writeable paths as tuning continues.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious Rundll32 dllregisterserver - Rule]
 type = detection
@@ -6699,7 +6709,7 @@ explanation = The following analytic identifies rundll32.exe using dllregisterse
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = This is likely to produce false positives and will require some filtering. Tune the query by adding command line paths to known good DLLs, or filtering based on parent process names.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious Rundll32 PluginInit - Rule]
 type = detection
@@ -6709,7 +6719,7 @@ explanation = This search is to detect a suspicious rundll32.exe process with pl
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"]}
 known_false_positives = third party application may used this dll export name to execute function.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious Rundll32 StartW - Rule]
 type = detection
@@ -6719,7 +6729,7 @@ explanation = The following analytic identifies rundll32.exe executing a DLL fun
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, some legitimate applications may use Start as a function and call it via the command line. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious Rundll32 no Command Line Arguments - Rule]
 type = detection
@@ -6729,7 +6739,7 @@ explanation = The following analytic identifies rundll32.exe with no command lin
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious Scheduled Task from Public Directory - Rule]
 type = detection
@@ -6739,7 +6749,7 @@ explanation = The following detection identifies Scheduled Tasks registering (cr
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"]}
 known_false_positives = Limited false positives may be present. Filter as needed by parent process or command line argument.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule]
 type = detection
@@ -6749,7 +6759,7 @@ explanation = The following analytic identifies searchprotocolhost.exe with no c
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious Ticket Granting Ticket Request - Rule]
 type = detection
@@ -6759,7 +6769,7 @@ explanation = As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain
 how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.002"]}
 known_false_positives = A computer account name change event inmediately followed by a kerberos TGT request with matching fields is unsual. However, legitimate behavior may trigger it. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Suspicious WAV file in Appdata Folder - Rule]
 type = detection
@@ -6769,7 +6779,7 @@ explanation = This analytic is to detect a suspicious creation of .wav file in a
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, file_name, file_path and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1113"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious wevtutil Usage - Rule]
 type = detection
@@ -6779,7 +6789,7 @@ explanation = The wevtutil.exe application is the windows event log utility. Thi
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001", "T1070"], "nist": ["DE.DP", "PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.AE"]}
 known_false_positives = The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious writes to windows Recycle Bin - Rule]
 type = detection
@@ -6789,7 +6799,7 @@ explanation = This search detects writes to the recycle bin by a process other t
 how_to_implement = To successfully implement this search you need to be ingesting information on filesystem and process logs responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` nodes.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"], "nist": ["DE.CM"]}
 known_false_positives = Because the Recycle Bin is a hidden folder in modern versions of Windows, it would be unusual for a process other than explorer.exe to write to it. Incidents should be investigated as appropriate.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Svchost LOLBAS Execution Process Spawn - Rule]
 type = detection
@@ -6799,7 +6809,7 @@ explanation = The following analytic identifies `svchost.exe` spawning a LOLBAS
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053", "T1053.005"]}
 known_false_positives = Legitimate applications may trigger this behavior, filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - System Info Gathering Using Dxdiag Application - Rule]
 type = detection
@@ -6809,7 +6819,7 @@ explanation = This analytic is to detect a suspicious dxdiag.exe process command
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]}
 known_false_positives = This commandline can be used by a network administrator to audit host machine specifications. Thus, a filter is needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - System Information Discovery Detection - Rule]
 type = detection
@@ -6819,7 +6829,7 @@ explanation = Detect system information discovery techniques used by attackers t
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["DE.CM"]}
 known_false_positives = Administrators debugging servers
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - System Processes Run From Unexpected Locations - Rule]
 type = detection
@@ -6831,7 +6841,7 @@ During triage, review the parallel processes - what process moved the native Win
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036", "T1036.003"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = This detection may require tuning based on third party applications utilizing native Windows binaries in non-standard paths.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - System User Discovery With Query - Rule]
 type = detection
@@ -6841,7 +6851,7 @@ explanation = This analytic looks for the execution of `query.exe` with command-
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - System User Discovery With Whoami - Rule]
 type = detection
@@ -6851,7 +6861,7 @@ explanation = This analytic looks for the execution of `whoami.exe` without any
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Time Provider Persistence Registry - Rule]
 type = detection
@@ -6861,7 +6871,7 @@ explanation = This analytic is to detect a suspicious modification of time provi
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.003", "T1547"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Trickbot Named Pipe - Rule]
 type = detection
@@ -6871,7 +6881,7 @@ explanation = this search is to detect potential trickbot infection through the
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and pipename from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. .
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - UAC Bypass MMC Load Unsigned Dll - Rule]
 type = detection
@@ -6879,9 +6889,9 @@ asset_type = Endpoint
 confidence = medium
 explanation = This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry that will trigger the mmc.exe to load the dll path
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]}
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548", "T1218.014"]}
 known_false_positives = unknown. all of the dll loaded by mmc.exe is microsoft signed dll.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - UAC Bypass With Colorui COM Object - Rule]
 type = detection
@@ -6891,7 +6901,7 @@ explanation = This search is to detect a possible uac bypass using the colorui.d
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.003"]}
 known_false_positives = not so common. but 3rd part app may load this dll.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Unified Messaging Service Spawning a Process - Rule]
 type = detection
@@ -6901,7 +6911,7 @@ explanation = This detection identifies Microsoft Exchange Server's Unified Mess
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"]}
 known_false_positives = Unknown. Tune out child processes as needed to limit volume of false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Uninstall App Using MsiExec - Rule]
 type = detection
@@ -6911,7 +6921,7 @@ explanation = This search is to detect a suspicious un-installation of applicati
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.007", "T1218"]}
 known_false_positives = unknown.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Unknown Process Using The Kerberos Protocol - Rule]
 type = detection
@@ -6921,7 +6931,7 @@ explanation = The following analytic identifies a process performing an outbound
 how_to_implement = To successfully implement this search, you must be ingesting your endpoint events and populating the Endpoint and Network data models.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1550"]}
 known_false_positives = Custom applications may leverage the Kerberos protocol. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Unload Sysmon Filter Driver - Rule]
 type = detection
@@ -6931,7 +6941,7 @@ explanation = Attackers often disable security tools to avoid detection. This se
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. This search is also shipped with `unload_sysmon_filter_driver_filter` macro, update this macro to filter out false positives.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"]}
 known_false_positives = Unknown at the moment
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Unloading AMSI via Reflection - Rule]
 type = detection
@@ -6943,7 +6953,7 @@ During triage, review parallel processes using an EDR product or 4688 events. It
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562", "T1059.001", "T1059"]}
 known_false_positives = Potential for some third party applications to disable AMSI upon invocation. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Unusual Number of Kerberos Service Tickets Requested - Rule]
 type = detection
@@ -6954,7 +6964,7 @@ The detection calculates the standard deviation for each host and leverages the
 how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558", "T1558.003"]}
 known_false_positives = An single endpoint requesting a large number of kerberos service tickets is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systems and missconfigured systems.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - User Discovery With Env Vars PowerShell - Rule]
 type = detection
@@ -6964,7 +6974,7 @@ explanation = This analytic looks for the execution of `powershell.exe` with com
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - User Discovery With Env Vars PowerShell Script Block - Rule]
 type = detection
@@ -6974,7 +6984,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1033"]}
 known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - USN Journal Deletion - Rule]
 type = detection
@@ -6984,7 +6994,7 @@ explanation = The fsutil.exe application is a legitimate Windows utility used to
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 6", "CIS 8", "CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070"], "nist": ["DE.CM", "PR.PT", "DE.AE", "DE.DP", "PR.IP"]}
 known_false_positives = None identified
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Vbscript Execution Using Wscript App - Rule]
 type = detection
@@ -6994,7 +7004,7 @@ explanation = This analytic is to detect a suspicious wscript commandline to exe
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.005", "T1059"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Verclsid CLSID Execution - Rule]
 type = detection
@@ -7004,7 +7014,7 @@ explanation = This analytic is to detect a possible abuse of verclsid to execute
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.012", "T1218"]}
 known_false_positives = windows can used this application for its normal COM object validation.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - W3WP Spawning Shell - Rule]
 type = detection
@@ -7014,7 +7024,7 @@ explanation = This query identifies a shell, PowerShell.exe or Cmd.exe, spawning
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003"]}
 known_false_positives = Baseline your environment before production. It is possible build systems using IIS will spawn cmd.exe to perform a software build. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - WBAdmin Delete System Backups - Rule]
 type = detection
@@ -7024,7 +7034,7 @@ explanation = This search looks for flags passed to wbadmin.exe (Windows Backup
 how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. Tune based on parent process names.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"]}
 known_false_positives = Administrators may modify the boot configuration.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Wbemprox COM Object Execution - Rule]
 type = detection
@@ -7034,7 +7044,7 @@ explanation = this search is designed to detect potential malicious process load
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.003"]}
 known_false_positives = legitimate process that are not in the exception list may trigger this event.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Wermgr Process Connecting To IP Check Web Services - Rule]
 type = detection
@@ -7044,7 +7054,7 @@ explanation = this search is designed to detect suspicious wermgr.exe process th
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1590", "T1590.005"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Wermgr Process Create Executable File - Rule]
 type = detection
@@ -7054,7 +7064,7 @@ explanation = this search is designed to detect potential malicious wermgr.exe p
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule]
 type = detection
@@ -7064,7 +7074,7 @@ explanation = This search is designed to detect suspicious cmd and powershell pr
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Wget Download and Bash Execution - Rule]
 type = detection
@@ -7074,7 +7084,7 @@ explanation = The following analytic identifies the use of wget on Linux or MacO
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is occurring correctly. If the EDR is not parsing the pipe bash in the command-line, modifying the analytic will be required. Add parent process name (Processes.parent_process_name) as needed to filter.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]}
 known_false_positives = False positives should be limited, however filtering may be required.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows AdFind Exe - Rule]
 type = detection
@@ -7084,7 +7094,27 @@ explanation = This search looks for the execution of `adfind.exe` with command-l
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1018"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = administrators rarely use adfind, usually not used for legitimate reasons
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Application Layer Protocol RMS Radmin Tool Namedpipe - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies the use of default or publicly known named pipes used by RMX remote admin tool. A named pipe is a named, one-way or duplex pipe for communication between the pipe server and one or more pipe clients. RMX Tool uses named pipes in many way as part of its communication for its server and client component. This tool was abuse by several adversaries and malware like Azorult to collect data to the targeted host. This TTP is a good indicator that this tool was install in production premise and need to check if the user has a valid reason why it need to install this legitimate application.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1071"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present. Filter based on pipe name or process.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Binary Proxy Execution Mavinject DLL Injection - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution (ex. C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL). In addition to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import descriptor injection via its /HMODULE command-line parameter (ex. mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an import table entry consisting of the specified DLL into the module at the given base address. During triage, review file modifcations and parallel processes.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.013", "T1218"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present, filter on DLL name or parent process.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Command and Scripting Interpreter Hunting Path Traversal - Rule]
 type = detection
@@ -7094,7 +7124,7 @@ explanation = The following analytic identifies path traversal command-line exec
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]}
 known_false_positives = false positive may vary depends on the score you want to check. The bigger number of path traversal string count the better.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule]
 type = detection
@@ -7104,7 +7134,7 @@ explanation = The following analytic identifies path traversal command-line exec
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]}
 known_false_positives = Not known at this moment.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Computer Account Created by Computer Account - Rule]
 type = detection
@@ -7114,7 +7144,7 @@ explanation = The following analytic identifes a Computer Account creating a new
 how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4741 EventCode enabled. The Windows TA is also required.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558"], "nist": ["DE.CM"]}
 known_false_positives = It is possible third party applications may have a computer account that adds computer accounts, filtering may be required.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Windows Computer Account Requesting Kerberos Ticket - Rule]
 type = detection
@@ -7124,7 +7154,7 @@ explanation = The following analytic identifies a ComputerAccount requesting a K
 how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4768 EventCode enabled. The Windows TA is also required.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1558"], "nist": ["DE.CM"]}
 known_false_positives = It is possible false positives will be present based on third party applications. Filtering may be needed.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Windows Computer Account With SPN - Rule]
 type = detection
@@ -7134,7 +7164,7 @@ explanation = The following analytic identifies two SPNs, HOST and RestrictedKrb
 how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4741 EventCode enabled. The Windows TA is also required.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1558"], "nist": ["DE.CM"]}
 known_false_positives = It is possible third party applications may add these SPNs to Computer Accounts, filtering may be needed.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Windows Curl Download to Suspicious Path - Rule]
 type = detection
@@ -7146,7 +7176,7 @@ During triage, review parallel processes for further behavior. In addition, iden
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]}
 known_false_positives = It is possible Administrators or super users will use Curl for legitimate purposes. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Curl Upload to Remote Destination - Rule]
 type = detection
@@ -7160,7 +7190,7 @@ Adversaries may use one of the three methods based on the remote destination and
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]}
 known_false_positives = False positives may be limited to source control applications and may be required to be filtered out.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Defender Exclusion Registry Entry - Rule]
 type = detection
@@ -7170,7 +7200,7 @@ explanation = This analytic will detect a suspicious process that modify a regis
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = admin or user may choose to use this windows features.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Deleted Registry By A Non Critical Process File Path - Rule]
 type = detection
@@ -7180,7 +7210,7 @@ explanation = This analytic is to detect deletion of registry with suspicious pr
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
 known_false_positives = This detection can catch for third party application updates or installation. In this scenario false positive filter is needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Disable Change Password Through Registry - Rule]
 type = detection
@@ -7190,7 +7220,7 @@ explanation = This analytic is to detect a suspicious registry modification to d
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
 known_false_positives = This windows feature may implemented by administrator to prevent normal user to change the password of a critical host or server, In this type of scenario filter is needed to minimized false positive.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule]
 type = detection
@@ -7200,7 +7230,7 @@ explanation = This analytic is to detect a suspicious registry modification to d
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Disable LogOff Button Through Registry - Rule]
 type = detection
@@ -7210,7 +7240,7 @@ explanation = This analytic is to detect a suspicious registry modification to d
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
 known_false_positives = This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Disable Memory Crash Dump - Rule]
 type = detection
@@ -7220,7 +7250,7 @@ explanation = The following analytic identifies a process that is attempting to
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` and `Registry` node.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Disable Notification Center - Rule]
 type = detection
@@ -7230,7 +7260,7 @@ explanation = The following search identifies a modification of registry to disa
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = admin or user may choose to disable this windows features.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Disable Shutdown Button Through Registry - Rule]
 type = detection
@@ -7240,7 +7270,7 @@ explanation = This analytic is to detect a suspicious registry modification to d
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
 known_false_positives = This windows feature may implement by administrator in some server where shutdown is critical. In that scenario filter of machine and users that can modify this registry is needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule]
 type = detection
@@ -7250,7 +7280,7 @@ explanation = This analytic is to detect a suspicious registry modification to d
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows DisableAntiSpyware Registry - Rule]
 type = detection
@@ -7260,7 +7290,7 @@ explanation = The search looks for the Registry Key DisableAntiSpyware set to di
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Disabled Users Failing To Authenticate Kerberos - Rule]
 type = detection
@@ -7273,7 +7303,7 @@ The analytics returned fields allow analysts to investigate the event further by
 how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]}
 known_false_positives = A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Windows DiskCryptor Usage - Rule]
 type = detection
@@ -7283,7 +7313,7 @@ explanation = The following analytic identifies DiskCryptor  process name of dcr
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1486"]}
 known_false_positives = It is possible false positives may be present based on the internal name dcinst.exe, filter as needed. It may be worthy to alert on the service name.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Diskshadow Proxy Execution - Rule]
 type = detection
@@ -7293,7 +7323,7 @@ explanation = DiskShadow.exe is a Microsoft Signed binary present on Windows Ser
 how_to_implement = To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218"], "nist": ["DE.CM"]}
 known_false_positives = Administrators using the DiskShadow tool in their infrastructure as a main backup tool with scripts will cause false positives that can be filtered with `windows_diskshadow_proxy_execution_filter`
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows DISM Remove Defender - Rule]
 type = detection
@@ -7303,7 +7333,7 @@ explanation = The following analytic identifies the use of the Windows Disk Imag
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 known_false_positives = Some legitimate administrative tools leverage `dism.exe` to manipulate packages and features of the operating system. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows DotNet Binary in Non Standard Path - Rule]
 type = detection
@@ -7313,7 +7343,7 @@ explanation = The following analytic identifies native .net binaries within the
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1036.003", "T1218", "T1218.004"]}
 known_false_positives = False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application in use.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Driver Load Non-Standard Path - Rule]
 type = detection
@@ -7323,7 +7353,7 @@ explanation = The following analytic uses Windows EventCode 7045 to identify new
 how_to_implement = To implement this analytic, the Windows EventCode 7045 will need to be logged. The Windows TA for Splunk is also recommended.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1014"], "nist": ["DE.CM"]}
 known_false_positives = False positives may be present based on legitimate third party applications needing to install drivers. Filter, or allow list known good drivers consistently being installed in these paths.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Drivers Loaded by Signature - Rule]
 type = detection
@@ -7333,7 +7363,7 @@ explanation = The following analytic assists with viewing all drivers being load
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have the latest version of the Sysmon TA. Most EDR products provide the ability to review driver loads, or module loads, and using a query as such help with hunting for malicious drivers.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1014", "T1068"], "nist": ["DE.CM"]}
 known_false_positives = This analytic is meant to assist with identifying drivers loaded in the environment and not to be setup for notables off the bat.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Event For Service Disabled - Rule]
 type = detection
@@ -7343,7 +7373,7 @@ explanation = This analytic will identify suspicious system event of services th
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"]}
 known_false_positives = Windows service update may cause this event. In that scenario, filtering is needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Event Log Cleared - Rule]
 type = detection
@@ -7353,7 +7383,7 @@ explanation = The following analytic utilizes Windows Security Event ID 1102 or
 how_to_implement = To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]}
 known_false_positives = It is possible that these logs may be legitimately cleared by Administrators. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Windows Excessive Disabled Services Event - Rule]
 type = detection
@@ -7363,7 +7393,7 @@ explanation = This analytic will identify suspicious excessive number of system
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"]}
 known_false_positives = Unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Execute Arbitrary Commands with MSDT - Rule]
 type = detection
@@ -7373,7 +7403,7 @@ explanation = The following analytic identifies a recently disclosed arbitraty c
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218"], "nist": ["DE.CM"]}
 known_false_positives = False positives may be present, filter as needed. Added .xml to potentially capture any answer file usage. Remove as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows File Without Extension In Critical Folder - Rule]
 type = detection
@@ -7383,7 +7413,17 @@ explanation = This analytic is to look for suspicious file creation in the criti
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"], "nist": ["DE.CM"]}
 known_false_positives = Unknown at this point
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Gather Victim Network Info Through Ip Check Web Services - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies process that attempts to connect to a known IP web services. This technique is commonly used by trickbot and other malware to perform reconnaissance against the infected machine and look for its IP address.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1590.005", "T1590"], "nist": ["DE.CM"]}
+known_false_positives = Filter internet browser application to minimize the false positive of this detection.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Get-AdComputer Unconstrained Delegation Discovery - Rule]
 type = detection
@@ -7393,7 +7433,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = The following  analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "nist": ["DE.CM"]}
 known_false_positives = Administrators or power users may leverage PowerView for system management or troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Windows Hidden Schedule Task Settings - Rule]
 type = detection
@@ -7403,7 +7443,7 @@ explanation = The following query utilizes Windows Security EventCode 4698, A sc
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and filter known instances of Task schedule used in your environment.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Windows Hide Notification Features Through Registry - Rule]
 type = detection
@@ -7413,7 +7453,7 @@ explanation = This analytic is to detect a suspicious registry modification to h
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows High File Deletion Frequency - Rule]
 type = detection
@@ -7423,7 +7463,7 @@ explanation = This search looks for high frequency of file deletion relative to
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the deleted target file name, process name and process id  from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"]}
 known_false_positives = user may delete bunch of pictures or files in a folder.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Hunting System Account Targeting Lsass - Rule]
 type = detection
@@ -7433,7 +7473,27 @@ explanation = The following hunting analytic identifies all processes requesting
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
 annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.AE", "DE.CM"]}
 known_false_positives = False positives will occur based on GrantedAccess and SourceUser, filter based on source image as needed.
-providing_technologies = []
+providing_technologies = null
+
+[savedsearch://ESCU - Windows Identify Protocol Handlers - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings). To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL in the property to limit the scope of this query to similar handlers as ms-msdt.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]}
+known_false_positives = False positives will be found. https and http is a URL Protocol handler that will trigger this analytic. Tune based on process or command-line.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Impair Defense Add Xml Applocker Rules - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic is to identify a process that imports applocker xml policy using PowerShell commandlet. This technique was seen in Azorult malware where it drop an xml Applocker policy that will deny several AV products and further executed the PowerShell Applocker commandlet.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"]}
+known_false_positives = Administrators may execute this command that may cause some false positive.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule]
 type = detection
@@ -7443,7 +7503,7 @@ explanation = The search looks for the deletion of Windows Defender context menu
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Impair Defense Delete Win Defender Profile Registry - Rule]
 type = detection
@@ -7453,7 +7513,17 @@ explanation = The search looks for the deletion of Windows Defender main profile
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Impair Defense Deny Security Software With Applocker - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a modification in the Windows registry by the Applocker utility that contains details or registry data values related to denying the execution of several security products. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV products and then loaded by using PowerShell Applocker commandlet.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present based on organization use of Applocker. Filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule]
 type = detection
@@ -7463,7 +7533,7 @@ explanation = The search looks for the Registry Key DefenderApiLogger or Defende
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Indirect Command Execution Via forfiles - Rule]
 type = detection
@@ -7473,7 +7543,7 @@ explanation = The following analytic detects programs that have been started by
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where  forfiles.exe may be used.
 annotations = {"cis20": ["CIS 8", "CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1202"], "nist": ["DE.AE"]}
 known_false_positives = Some legacy applications may be run using pcalua.exe. Similarly, forfiles.exe may be used in legitimate batch scripts.  Filter these results as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Indirect Command Execution Via pcalua - Rule]
 type = detection
@@ -7483,7 +7553,7 @@ explanation = The following analytic detects programs that have been started by
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where pcalua.exe may be used.
 annotations = {"cis20": ["CIS 8", "CIS 10"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1202"], "nist": ["DE.AE"]}
 known_false_positives = Some legacy applications may be run using pcalua.exe.  Filter these results as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows InstallUtil Credential Theft - Rule]
 type = detection
@@ -7496,7 +7566,7 @@ During triage review resulting network connections, file modifications, and para
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and module loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.004", "T1218"]}
 known_false_positives = Typically this will not trigger as by it's very nature InstallUtil does not need credentials. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows InstallUtil in Non Standard Path - Rule]
 type = detection
@@ -7506,7 +7576,7 @@ explanation = The following analytic identifies the Windows binary InstallUtil.e
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1036.003", "T1218", "T1218.004"]}
 known_false_positives = False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application in use.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows InstallUtil Remote Network Connection - Rule]
 type = detection
@@ -7519,7 +7589,7 @@ During triage review resulting network connections, file modifications, and para
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.004", "T1218"]}
 known_false_positives = Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows InstallUtil Uninstall Option - Rule]
 type = detection
@@ -7533,7 +7603,7 @@ During triage review resulting network connections, file modifications, and para
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.004", "T1218"]}
 known_false_positives = Limited false positives should be present. Filter as needed by parent process or application.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows InstallUtil Uninstall Option with Network - Rule]
 type = detection
@@ -7547,7 +7617,7 @@ During triage review resulting network connections, file modifications, and para
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.004", "T1218"]}
 known_false_positives = Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows InstallUtil URL in Command Line - Rule]
 type = detection
@@ -7560,7 +7630,7 @@ During triage review resulting network connections, file modifications, and para
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.004", "T1218"]}
 known_false_positives = Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Invalid Users Failed Authentication via Kerberos - Rule]
 type = detection
@@ -7573,7 +7643,7 @@ The analytics returned fields allow analysts to investigate the event further by
 how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]}
 known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Windows ISO LNK File Creation - Rule]
 type = detection
@@ -7583,7 +7653,7 @@ explanation = The following analytic identifies the use of a delivered ISO file
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001", "T1566", "T1204.001", "T1204"], "nist": ["DE.CM"]}
 known_false_positives = False positives may be high depending on the environment and consistent use of ISOs mounting. Restrict to servers, or filter out based on commonly used ISO names. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Kerberos Local Successful Logon - Rule]
 type = detection
@@ -7593,7 +7663,7 @@ explanation = The following analytic identifies a local successful authenticatio
 how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4624 EventCode enabled. The Windows TA is also required.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558"], "nist": ["DE.CM"]}
 known_false_positives = False positives are possible, filtering may be required to restrict to workstations vs domain controllers. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Windows KrbRelayUp Service Creation - Rule]
 type = detection
@@ -7603,7 +7673,7 @@ explanation = The following analytic identifies the default service name created
 how_to_implement = To successfully implement this search, you need to be ingesting Windows System Event Logs with 7045 EventCode enabled. The Windows TA is also required.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"], "nist": ["DE.CM"]}
 known_false_positives = False positives should be limited as this is specific to KrbRelayUp based attack. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Linked Policies In ADSI Discovery - Rule]
 type = detection
@@ -7613,7 +7683,77 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "nist": ["DE.CM"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
+
+[savedsearch://ESCU - Windows Modify Registry Disable Toast Notifications - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic is to identify a modification in the Windows registry to disable toast notifications. This Windows Operating System feature is responsible for alerting or notifying user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion and execution.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Modify Registry Disable Win Defender Raw Write Notif - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a modification in the Windows registry to disable Windows Defender raw write notification feature. This policy controls whether raw volume write notifications are sent to behavior monitoring or not. This registry was recently identified in Azorult malware to bypass Windows Defender detections or behavior monitoring in terms of volume write.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+known_false_positives = Administrators may enable or disable this feature that may cause some false positive. Filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Modify Registry Disable Windows Security Center Notif - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic is to identify a modification in the Windows registry to disable windows center notifications. This Windows Operating System feature is responsible for alerting or notifying user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion and execution.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Modify Registry Disabling WER Settings - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a modification in the Windows registry to disable Windows error reporting settings. This Windows feature allows the user to report bugs, errors, failure or problems encountered in specific application or processes. Adversaries use this technique to hide any error or failure that some of its malicious components trigger.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+known_false_positives = Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Modify Registry DisAllow Windows App - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies modification in the Windows registry to prevent user running specific computer programs that could aid them in manually removing malware or detecting it using security products. This technique was recently identified in Azorult malware where it uses this registry value to prevent several AV products to execute on the compromised host machine.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+known_false_positives = Administrators may enable or disable this feature that may cause some false positive. Filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Modify Registry Regedit Silent Reg Import - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies modification of Windows registry using regedit.exe application with silent mode parameter. regedit.exe windows application is commonly used as GUI app to check or modify registry. This application is also has undocumented command-line parameter and one of those are silent mode parameter that performs action without stopping for confirmation with dialog box. Importing registry from .reg files need to monitor in a production environment since it can be used adversaries to import RMS registry in compromised host.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+known_false_positives = Administrators may execute this command that may cause some false positive. Filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Modify Registry Suppress Win Defender Notif - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic is to identify a modification in the Windows registry to suppress windows defender notification. This technique was abuse by adversaries and threat actor to bypassed windows defender on the targeted host. Azorult malware is one of the malware use this technique that also disable toast notification and other windows features as part of its malicious behavior.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule]
 type = detection
@@ -7623,7 +7763,17 @@ explanation = This analytic is to look for suspicious registry modification rela
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows MOF Event Triggered Execution via WMI - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following anaytic identifies MOFComp.exe loading a MOF file. The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Typically, MOFComp.exe does not reach out to the public internet or load a MOF file from User Profile paths. A filter and consumer is typically registered in WMI. Review parallel processes and query WMI subscriptions to gather artifacts. The default path of mofcomp.exe is C:\Windows\System32\wbem.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present from automation based applications (SCCM), filtering may be required. In addition, break the query out based on volume of usage. Filter process names or f
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows MSIExec DLLRegisterServer - Rule]
 type = detection
@@ -7633,7 +7783,7 @@ explanation = The following analytic identifies the usage of msiexec.exe using t
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.007"], "nist": ["DE.CM"]}
 known_false_positives = This analytic will need to be tuned for your environment based on legitimate usage of msiexec.exe. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows MSIExec Remote Download - Rule]
 type = detection
@@ -7643,7 +7793,7 @@ explanation = The following analytic identifies msiexec.exe with http in the com
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.007"], "nist": ["DE.CM"]}
 known_false_positives = False positives may be present, filter by destination or parent process as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows MSIExec Spawn Discovery Command - Rule]
 type = detection
@@ -7653,7 +7803,7 @@ explanation = The following analytic identifies MSIExec spawning multiple discov
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.007"], "nist": ["DE.CM"]}
 known_false_positives = False positives will be present with MSIExec spawning Cmd or PowerShell. Filtering will be needed. In addition, add other known discovery processes to enhance query.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows MSIExec Unregister DLLRegisterServer - Rule]
 type = detection
@@ -7663,7 +7813,7 @@ explanation = The following analytic identifies the usage of msiexec.exe using t
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.007"], "nist": ["DE.CM"]}
 known_false_positives = This analytic will need to be tuned for your environment based on legitimate usage of msiexec.exe. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows MSIExec With Network Connections - Rule]
 type = detection
@@ -7673,7 +7823,7 @@ explanation = The following analytic identifies MSIExec with any network connect
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. Add parent process as a filter, filter known good processes. This may be voluminous due to the join on process_id. All_Traffic does not have process_guid, yet.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.007"], "nist": ["DE.CM"]}
 known_false_positives = False positives will be present and filtering is required.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows NirSoft AdvancedRun - Rule]
 type = detection
@@ -7683,7 +7833,7 @@ explanation = The following analytic identifies the use of AdvancedRun.exe. Adva
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.002"]}
 known_false_positives = False positives should be limited as it is specific to AdvancedRun. Filter as needed based on legitimate usage.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows NirSoft Utilities - Rule]
 type = detection
@@ -7693,7 +7843,7 @@ explanation = The following hunting analytic assists with identifying the proces
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1588.002"]}
 known_false_positives = False positives may be present. Filtering may be required before setting to alert.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Non-System Account Targeting Lsass - Rule]
 type = detection
@@ -7703,7 +7853,37 @@ explanation = The following analytic identifies non SYSTEM accounts requesting a
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
 annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.AE", "DE.CM"]}
 known_false_positives = False positives will occur based on legitimate application requests, filter based on source image as needed.
-providing_technologies = []
+providing_technologies = null
+
+[savedsearch://ESCU - Windows Odbcconf Hunting - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies Odbcconf.exe running in the environment to assist with identifying tuning higher fidelity analytics related to Odbcconf.exe.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.008"], "nist": ["DE.CM"]}
+known_false_positives = False positives will be present as this is meant to assist with filtering and tuning.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Odbcconf Load DLL - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies odbcconf.exe, Windows Open Database Connectivity utility, utilizing the action function of regsvr to load a DLL. An example will look like - odbcconf.exe /A { REGSVR T1218-2.dll }. During triage, review parent process, parallel procesess and file modifications.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.008"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Odbcconf Load Response File - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies the odbcconf.exe, Windows Open Database Connectivity utility, loading up a resource file. The file extension is arbitrary and may be named anything. The resource file itself may have different commands supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. During triage, review file modifications and parallel processes.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.008"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Office Product Spawning MSDT - Rule]
 type = detection
@@ -7713,7 +7893,7 @@ explanation = The following analytic identifies a Microsoft Office product spawn
 how_to_implement = how To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.CM"]}
 known_false_positives = False positives should be limited, however filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Possible Credential Dumping - Rule]
 type = detection
@@ -7727,7 +7907,17 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
 annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.AE", "DE.CM"]}
 known_false_positives = False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter based on source image as needed or remove them. Concern is Cobalt Strike usage of Mimikatz will generate 0x1010 initially, but later be caught.
-providing_technologies = []
+providing_technologies = null
+
+[savedsearch://ESCU - Windows Powershell Import Applocker Policy - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic is to identify the imports of Windows PowerShell Applocker commandlets. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV product and then loaded using PowerShell Applocker commandlet.
+how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"]}
+known_false_positives = administrators may execute this command that may cause some false positive.
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Windows PowerView Constrained Delegation Discovery - Rule]
 type = detection
@@ -7737,7 +7927,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = The following  analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "nist": ["DE.CM"]}
 known_false_positives = Administrators or power users may leverage PowerView for system management or troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Windows PowerView Kerberos Service Ticket Request - Rule]
 type = detection
@@ -7747,7 +7937,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558", "T1558.003"], "nist": ["DE.CM"]}
 known_false_positives = False positive may include Administrators using PowerView for troubleshooting and management.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Windows PowerView SPN Discovery - Rule]
 type = detection
@@ -7757,7 +7947,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = The following analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1558", "T1558.003"], "nist": ["DE.CM"]}
 known_false_positives = False positive may include Administrators using PowerView for troubleshooting and management.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Windows PowerView Unconstrained Delegation Discovery - Rule]
 type = detection
@@ -7767,7 +7957,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = The following  analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "nist": ["DE.CM"]}
 known_false_positives = Administrators or power users may leverage PowerView for system management or troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Windows Process With NamedPipe CommandLine - Rule]
 type = detection
@@ -7777,7 +7967,7 @@ explanation = This analytic is to look for process commandline that contains nam
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "nist": ["DE.CM"]}
 known_false_positives = Normal browser application may use this technique. Please update the filter macros to remove false positives.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Processes Killed By Industroyer2 Malware - Rule]
 type = detection
@@ -7787,7 +7977,7 @@ explanation = The following analytic is to look for known processes killed by in
 how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "nist": ["DE.CM"]}
 known_false_positives = False positives are possible if legitimate applications are allowed to terminate this process during testing or updates. Filter as needed based on paths that are used legitimately.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Raccine Scheduled Task Deletion - Rule]
 type = detection
@@ -7797,7 +7987,7 @@ explanation = The following analytic identifies the Raccine Rules Updater schedu
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]}
 known_false_positives = False positives should be limited, however filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Rasautou DLL Execution - Rule]
 type = detection
@@ -7807,7 +7997,7 @@ explanation = The following analytic identifies the Windows Windows Remote Auto
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055.001", "T1218", "T1055"]}
 known_false_positives = False positives will be limited to applications that require Rasautou.exe to load a DLL from disk. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Raw Access To Disk Volume Partition - Rule]
 type = detection
@@ -7817,7 +8007,7 @@ explanation = This analytic is to look for suspicious raw access read to device
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the raw access read event (like sysmon eventcode 9), process name and process guid from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1561.002", "T1561"], "nist": ["DE.CM"]}
 known_false_positives = This event is really notable but we found minimal number of normal application from system32 folder like svchost.exe accessing it too. In this case we used 'system32' and 'syswow64' path as a filter for this detection.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Raw Access To Master Boot Record Drive - Rule]
 type = detection
@@ -7827,7 +8017,7 @@ explanation = This analytic is to look for suspicious raw access read to drive w
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the raw access read event (like sysmon eventcode 9), process name and process guid from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1561.002", "T1561"], "nist": ["DE.CM"]}
 known_false_positives = This event is really notable but we found minimal number of normal application from system32 folder like svchost.exe accessing it too. In this case we used 'system32' and 'syswow64' path as a filter for this detection.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Registry Certificate Added - Rule]
 type = detection
@@ -7837,7 +8027,7 @@ explanation = The following analytic identifies installation of a root CA certif
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1553.004", "T1553"], "nist": ["DE.CM"]}
 known_false_positives = False positives will be limited to a legitimate business applicating consistently adding new root certificates to the endpoint. Filter by user, process, or thumbprint.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Registry Delete Task SD - Rule]
 type = detection
@@ -7847,7 +8037,7 @@ explanation = The following analytic identifies a process attempting to delete a
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1053.005", "T1562"], "nist": ["DE.CM"]}
 known_false_positives = False positives should be limited as the activity is not common to delete ONLY the SD from the registry. Filter as needed. Update the analytic Modified or Deleted values based on product that is in the datamodel.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Registry Modification for Safe Mode Persistence - Rule]
 type = detection
@@ -7857,7 +8047,17 @@ explanation = The following analytic identifies a modification or registry add t
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001", "T1547"]}
 known_false_positives = updated windows application needed in safe boot may used this registry
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Remote Access Software RMS Registry - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic is to identify a modification or creation of Windows registry related to the Remote Manipulator System (RMS) Remote Admin tool. RMS is a legitimate tool developed by russian organization TektonIT and has been observed being abused by adversaries to gain remote access to the targeted host. Azorult malware utilized RMS to gain remote access.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1219"], "nist": ["DE.CM"]}
+known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Remote Assistance Spawning Process - Rule]
 type = detection
@@ -7867,7 +8067,47 @@ explanation = The following analytic identifies the use of Microsoft Remote Assi
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = False positives should be limited, filter as needed. Add additional shells as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Remote Service Rdpwinst Tool Execution - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies RDPWInst.exe tool, which is a RDP wrapper library tool designed to enable remote desktop host support and concurrent RDP session on reduced functionality system. Unfortunately, this open project was abused by adversaries to enable RDP connection to the targeted host for remote access and potentially be for lateral movement.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"]}
+known_false_positives = This tool was designed for home usage and not commonly seen in production environment. Filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Remote Services Allow Rdp In Firewall - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic is to identify a modification in the Windows firewall to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer to remotely access the compromised or targeted host by allowing this protocol in firewall. Even this protocol might be allowed in some production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through firewall which is also common traits of attack to start lateral movement.
+how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"]}
+known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Remote Services Allow Remote Assistance - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic is to identify a modification in the Windows registry to enable remote desktop assistance on a targeted machine. This technique was seen in several adversaries, malware or red teamer like azorult to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This Anomaly behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common. And as per stated in microsoft documentation the default value of this registry is false that makes this a good indicator of suspicious behavior.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"]}
+known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Remote Services Rdp Enable - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic is to identify a modification in the Windows registry to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"]}
+known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Root Domain linked policies Discovery - Rule]
 type = detection
@@ -7877,7 +8117,7 @@ explanation = The following analytic utilizes PowerShell Script Block Logging (E
 how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "nist": ["DE.CM"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Windows Schtasks Create Run As System - Rule]
 type = detection
@@ -7887,7 +8127,7 @@ explanation = The following analytic identifies Schtasks.exe creating a new task
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"]}
 known_false_positives = False positives will be limited to legitimate applications creating a task to run as SYSTEM. Filter as needed based on parent process, or modify the query to have world writeable paths to restrict it.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Security Account Manager Stopped - Rule]
 type = detection
@@ -7897,7 +8137,7 @@ explanation = The search looks for a Windows Security Account Manager (SAM) was
 how_to_implement = You must be ingesting data that records the process-system activity from your hosts to populate the Endpoint Processes data-model object. If you are using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you want to collect data.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1489"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = SAM is a critical windows service, stopping it would cause major issues on an endpoint this makes false positive rare. AlthoughNo false positives have been identified.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Service Create Kernel Mode Driver - Rule]
 type = detection
@@ -7907,7 +8147,7 @@ explanation = The following analytic identifes a new kernel driver being added t
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003", "T1543", "T1068"], "nist": ["DE.CM"]}
 known_false_positives = False positives may be present based on common applications adding new drivers, however, filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Service Created With Suspicious Service Path - Rule]
 type = detection
@@ -7917,7 +8157,7 @@ explanation = The following analytc uses Windows Event Id 7045, `New Service Was
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569", "T1569.002"]}
 known_false_positives = Legitimate applications may install services with uncommon services paths.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Windows Service Created Within Public Path - Rule]
 type = detection
@@ -7927,7 +8167,7 @@ explanation = The following analytc uses Windows Event Id 7045, `New Service Was
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543", "T1543.003"]}
 known_false_positives = Legitimate applications may install services with uncommon services paths.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Windows Service Creation on Remote Endpoint - Rule]
 type = detection
@@ -7937,7 +8177,7 @@ explanation = This analytic looks for the execution of `sc.exe` with command-lin
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543", "T1543.003"]}
 known_false_positives = Administrators may create Windows Services on remote systems, but this activity is usually limited to a small set of hosts or users.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Service Creation Using Registry Entry - Rule]
 type = detection
@@ -7947,7 +8187,7 @@ explanation = This analytic is to look for suspicious modification or creation o
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.011"], "nist": ["DE.CM"]}
 known_false_positives = Third party tools may used this technique to create services but not so common.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Service Initiation on Remote Endpoint - Rule]
 type = detection
@@ -7957,7 +8197,17 @@ explanation = This analytic looks for the execution of `sc.exe` with command-lin
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543", "T1543.003"]}
 known_false_positives = Administrators may start Windows Services on remote systems, but this activity is usually limited to a small set of hosts or users.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Service Stop By Deletion - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue there objective and evade detections.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "nist": ["DE.CM"]}
+known_false_positives = It is possible administrative scripts may start/stop/delete services. Filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows System File on Disk - Rule]
 type = detection
@@ -7967,7 +8217,7 @@ explanation = The following hunting analytic will assist with identifying new .s
 how_to_implement = To successfully implement this search you need to be ingesting information on files from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. In addition, filtering may occur by adding NOT (Filesystem.file_path IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")). This will level out the noise generated to potentally lead to generating notables.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]}
 known_false_positives = False positives will be present. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows Terminating Lsass Process - Rule]
 type = detection
@@ -7977,7 +8227,7 @@ explanation = This analytic is to detect a suspicious process terminating Lsass
 how_to_implement = This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Windows Users Authenticate Using Explicit Credentials - Rule]
 type = detection
@@ -7990,7 +8240,17 @@ The analytics returned fields allow analysts to investigate the event further by
 how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]}
 known_false_positives = A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
+
+[savedsearch://ESCU - Windows Valid Account With Never Expires Password - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies net.exe updating user account policies for password requirement with non-expiring password. This technique was seen in several adversaries and malware like Azorult to maintain the foothold (persistence), gaining privilege escalation, defense evasion and possible for lateral movement for specific users or created user account on the targeted host. This TTP detections is a good pivot to see further what other events that users executes on the machines.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "nist": ["DE.CM"]}
+known_false_positives = This behavior is not commonly seen in production environment and not advisable, filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows WMI Process Call Create - Rule]
 type = detection
@@ -8000,7 +8260,7 @@ explanation = This analytic is to look for wmi commandlines to execute or create
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1047"], "nist": ["DE.CM"]}
 known_false_positives = Administrators may execute this command for testing or auditing.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule]
 type = detection
@@ -8014,7 +8274,7 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task
 how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"]}
 known_false_positives = False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - WinEvent Scheduled Task Created Within Public Path - Rule]
 type = detection
@@ -8028,7 +8288,7 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v
 how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also required.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"]}
 known_false_positives = False positives are possible if legitimate applications are allowed to register tasks in public paths. Filter as needed based on paths that are used legitimately.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule]
 type = detection
@@ -8038,7 +8298,7 @@ explanation = The following hunting analytic assists with identifying suspicious
 how_to_implement = Task Scheduler logs are required to be collected. Enable logging with inputs.conf by adding a stanza for [WinEventLog://Microsoft-Windows-TaskScheduler/Operational] and renderXml=false. Note, not translating it in XML may require a proper extraction of specific items in the Message.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005"]}
 known_false_positives = False positives will be present. Filter based on ActionName paths or specify keywords of interest.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Winhlp32 Spawning a Process - Rule]
 type = detection
@@ -8048,7 +8308,7 @@ explanation = The following analytic identifies winhlp32.exe, found natively in
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = False positives should be limited as winhlp32.exe is typically not used with the latest flavors of Windows OS. However, filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Winword Spawning Cmd - Rule]
 type = detection
@@ -8058,7 +8318,7 @@ explanation = The following detection identifies Microsoft Word spawning `cmd.ex
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 known_false_positives = False positives should be limited, but if any are present, filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Winword Spawning PowerShell - Rule]
 type = detection
@@ -8068,7 +8328,7 @@ explanation = The following detection identifies Microsoft Word spawning PowerSh
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 known_false_positives = False positives should be limited, but if any are present, filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Winword Spawning Windows Script Host - Rule]
 type = detection
@@ -8078,7 +8338,7 @@ explanation = The following detection identifies Microsoft Winword.exe spawning
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566", "T1566.001"]}
 known_false_positives = There will be limited false positives and it will be different for every environment. Tune by child process or command-line as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - WMI Permanent Event Subscription - Sysmon - Rule]
 type = detection
@@ -8093,7 +8353,7 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons
 how_to_implement = To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields.
 annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.003", "T1546"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]}
 known_false_positives = Although unlikely, administrators may use event subscriptions for legitimate purposes.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - WMI Recon Running Process Or Services - Rule]
 type = detection
@@ -8103,7 +8363,7 @@ explanation = The following analytic identifies suspicious PowerShell script exe
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]}
 known_false_positives = network administrator may used this command for checking purposes
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Wmic Group Discovery - Rule]
 type = detection
@@ -8115,17 +8375,17 @@ During triage, review parallel processes and identify any further suspicious beh
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"]}
 known_false_positives = Administrators or power users may use this command for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Wmic NonInteractive App Uninstallation - Rule]
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This analytic is to detect a suspicious wmic commandlined that uninstall application non interactively. This technique was seen in IceID to uninstall av products to the compromised host to bypassed and evade detections. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
-how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+explanation = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
-known_false_positives = third party application may use this approach to uninstall there application
-providing_technologies = []
+known_false_positives = Third party application may use this approach to uninstall applications.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - WMIC XSL Execution via URL - Rule]
 type = detection
@@ -8135,7 +8395,7 @@ explanation = The following analytic identifies `wmic.exe` loading a remote XSL
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1220"]}
 known_false_positives = False positives are limited as legitimate applications typically do not download files or xsl using WMIC. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Wmiprsve LOLBAS Execution Process Spawn - Rule]
 type = detection
@@ -8145,7 +8405,7 @@ explanation = The following analytic identifies `wmiprsve.exe` spawning a LOLBAS
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1047"]}
 known_false_positives = Legitimate applications may trigger this behavior, filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Wscript Or Cscript Suspicious Child Process - Rule]
 type = detection
@@ -8155,7 +8415,7 @@ explanation = This analytic identifies a suspicious spawned process by WScript o
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1543", "T1134.004", "T1134"]}
 known_false_positives = Administrators may create vbs or js script that use several tool as part of its execution. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Wsmprovhost LOLBAS Execution Process Spawn - Rule]
 type = detection
@@ -8165,7 +8425,7 @@ explanation = The following analytic identifies `Wsmprovhost.exe` spawning a LOL
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.006"]}
 known_false_positives = Legitimate applications may trigger this behavior, filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - WSReset UAC Bypass - Rule]
 type = detection
@@ -8175,7 +8435,7 @@ explanation = This search is to detect a suspicious modification of registry rel
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - XMRIG Driver Loaded - Rule]
 type = detection
@@ -8185,7 +8445,7 @@ explanation = This analytic identifies XMRIG coinminer driver installation on th
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003", "T1543"]}
 known_false_positives = False positives should be limited.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - XSL Script Execution With WMIC - Rule]
 type = detection
@@ -8195,7 +8455,7 @@ explanation = This search is to detect a suspicious wmic.exe process or renamed
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1220"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect New Login Attempts to Routers - Rule]
 type = detection
@@ -8205,7 +8465,7 @@ explanation = The search queries the authentication logs for assets that are cat
 how_to_implement = To successfully implement this search, you must ensure the network router devices are categorized as "router" in the Assets and identity table. You must also populate the Authentication data model with logs related to users authenticating to routing infrastructure.
 annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "PR.AC", "PR.IP"]}
 known_false_positives = Legitimate router connections may appear as new connections
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Email Attachments With Lots Of Spaces - Rule]
 type = detection
@@ -8217,7 +8477,7 @@ how_to_implement = You need to ingest data from emails. Specifically, the sender
 If Splunk Phantom is also configured in your environment, a playbook called "Suspicious Email Attachment Investigate and Delete" can be configured to run when any results are found by this detection search. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/` and add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search. The notable event will be sent to Phantom and the playbook will gather further information about the file attachment and its network behaviors. If Phantom finds malicious behavior and an analyst approves of the results, the email will be deleted from the user's inbox.
 annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]}
 known_false_positives = None at this time
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Email files written outside of the Outlook directory - Rule]
 type = detection
@@ -8227,7 +8487,7 @@ explanation = The search looks at the change-analysis data model and detects ema
 how_to_implement = To successfully implement this search, you must be ingesting data that records the file-system activity from your hosts to populate the Endpoint.Filesystem data model node. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or by other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file-system reads and writes.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114", "T1114.001"]}
 known_false_positives = Administrators and users sometimes prefer backing up their email data by moving the email files into a different folder. These attempts will be detected by the search.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Email servers sending high volume traffic to hosts - Rule]
 type = detection
@@ -8237,7 +8497,7 @@ explanation = This search looks for an increase of data transfers from your emai
 how_to_implement = This search requires you to be ingesting your network traffic and populating the Network_Traffic data model.  Your email servers must be categorized as "email_server" for the search to work, as well. You may need to adjust the deviation_threshold and minimum_data_samples values based on the network traffic in your environment. The "deviation_threshold" field is a multiplying factor to control how much variation you're willing to tolerate. The "minimum_data_samples" field is the minimum number of connections of data samples required for the statistic to be valid.
 annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114", "T1114.002"], "nist": ["PR.PT", "DE.CM", "DE.AE"]}
 known_false_positives = The false-positive rate will vary based on how you set the deviation_threshold and data_samples values. Our recommendation is to adjust these values based on your network traffic to and from your email servers.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Monitor Email For Brand Abuse - Rule]
 type = detection
@@ -8247,7 +8507,7 @@ explanation = This search looks for emails claiming to be sent from a domain sim
 how_to_implement = You need to ingest email header data. Specifically the sender's address (src_user) must be populated.  You also need to have run the search "ESCU - DNSTwist Domain Names", which creates the permutations of the domain that will be checked for.
 annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]}
 known_false_positives = None at this time
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule]
 type = detection
@@ -8257,7 +8517,7 @@ explanation = This search detects Okta login failures due to bad credentials for
 how_to_implement = This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.001"], "nist": ["DE.CM"]}
 known_false_positives = A single public IP address servicing multiple legitmate users may trigger this search. In addition, the threshold of 5 distinct users may be too low for your needs. You may modify the included filter macro `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` to raise the threshold or except specific IP adresses from triggering this search.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - No Windows Updates in a time frame - Rule]
 type = detection
@@ -8267,7 +8527,7 @@ explanation = This search looks for Windows endpoints that have not generated an
 how_to_implement = To successfully implement this search, it requires that the 'Update' data model is being populated. This can be accomplished by ingesting Windows events or the Windows Update log via a universal forwarder on the Windows endpoints you wish to monitor. The Windows add-on should be also be installed and configured to properly parse Windows events in Splunk. There may be other data sources which can populate this data model, including vulnerability management systems.
 annotations = {"cis20": ["CIS 18"], "kill_chain_phases": ["Exploitation"], "nist": ["PR.PT", "PR.MA"]}
 known_false_positives = None identified
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Okta Account Lockout Events - Rule]
 type = detection
@@ -8277,7 +8537,7 @@ explanation = Detect Okta user lockout events
 how_to_implement = This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.001"], "nist": ["DE.CM"]}
 known_false_positives = None. Account lockouts should be followed up on to determine if the actual user was the one who caused the lockout, or if it was an unauthorized actor.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Okta Failed SSO Attempts - Rule]
 type = detection
@@ -8287,7 +8547,7 @@ explanation = Detect failed Okta SSO events
 how_to_implement = This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.001"], "nist": ["DE.CM"]}
 known_false_positives = There may be a faulty config preventing legitmate users from accessing apps they should have access to.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Okta User Logins From Multiple Cities - Rule]
 type = detection
@@ -8297,7 +8557,7 @@ explanation = This search detects logins from the same user from different citie
 how_to_implement = This search is specific to Okta and requires Okta logs are being ingested in your Splunk deployment.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.001"], "nist": ["DE.CM"]}
 known_false_positives = Users in your enviornment may legitmately be travelling and loggin in from different locations. This search is useful for those users that should *not* be travelling for some reason, such as the COVID-19 pandemic. The search also relies on the geographical information being populated in the Okta logs. It is also possible that a connection from another region may be attributed to a login from a remote VPN endpoint.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Suspicious Email Attachment Extensions - Rule]
 type = detection
@@ -8309,7 +8569,7 @@ how_to_implement = You need to ingest data from emails. Specifically, the sender
 If Splunk Phantom is also configured in your environment, a Playbook called "Suspicious Email Attachment Investigate and Delete" can be configured to run when any results are found by this detection search. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`, and add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search. The notable event will be sent to Phantom and the playbook will gather further information about the file attachment and its network behaviors. If Phantom finds malicious behavior and an analyst approves of the results, the email will be deleted from the user's inbox.
 annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 12"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001", "T1566"], "nist": ["DE.AE", "PR.IP"]}
 known_false_positives = None identified
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Suspicious Java Classes - Rule]
 type = detection
@@ -8319,7 +8579,7 @@ explanation = This search looks for suspicious Java classes that are often used
 how_to_implement = In order to properly run this search, Splunk needs to ingest data from your web-traffic appliances that serve or sit in the path of your Struts application servers. This can be accomplished by indexing data from a web proxy, or by using network traffic-analysis tools, such as Splunk Stream or Bro.
 annotations = {"cis20": ["CIS 7", "CIS 12"], "kill_chain_phases": ["Exploitation"], "nist": ["DE.AE"]}
 known_false_positives = There are no known false positives.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Web Servers Executing Suspicious Processes - Rule]
 type = detection
@@ -8329,7 +8589,7 @@ explanation = This search looks for suspicious processes on all systems labeled
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. In addition, web servers will need to be identified in the Assets and Identity Framework of Enterprise Security.
 annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["PR.IP"]}
 known_false_positives = Some of these processes may be used legitimately on web servers during maintenance or other administrative tasks.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule]
 type = detection
@@ -8339,7 +8599,7 @@ explanation = This search finds for the number successfully destroyed cloud inst
 how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Destroyed` to create the probability density function.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Abnormally High Number Of Cloud Instances Launched - Rule]
 type = detection
@@ -8349,7 +8609,7 @@ explanation = This search finds for the number successfully created cloud instan
 how_to_implement = You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Instances Launched` to create the probability density function.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1078"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Amazon EKS Kubernetes cluster scan detection - Rule]
 type = detection
@@ -8359,7 +8619,7 @@ explanation = This search provides information of unauthenticated requests via u
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudWatch EKS Logs inputs.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]}
 known_false_positives = Not all unauthenticated requests are malicious, but frequency, UA and source IPs will provide context.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Amazon EKS Kubernetes Pod scan detection - Rule]
 type = detection
@@ -8369,7 +8629,7 @@ explanation = This search provides detection information on unauthenticated requ
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on forAWS (version 4.4.0 or later), then configure your AWS CloudWatch EKS Logs.Please also customize the `kubernetes_pods_aws_scan_fingerprint_detection` macro to filter out the false positives.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]}
 known_false_positives = Not all unauthenticated requests are malicious, but frequency, UA and source IPs and direct request to API provide context.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - aws detect attach to role policy - Rule]
 type = detection
@@ -8379,7 +8639,7 @@ explanation = This search provides detection of an user attaching itself to a di
 how_to_implement = You must install splunk AWS add-on and Splunk App for AWS. This search works with cloudwatch logs
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078"]}
 known_false_positives = Attach to policy can create a lot of noise. This search can be adjusted to provide specific values to identify cases of abuse (i.e status=failure). The search can provide context for common users attaching themselves to higher privilege policies or even newly created policies.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - aws detect permanent key creation - Rule]
 type = detection
@@ -8389,7 +8649,7 @@ explanation = This search provides detection of accounts creating permanent keys
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078"]}
 known_false_positives = Not all permanent key creations are malicious. If there is a policy of rotating keys this search can be adjusted to provide better context.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - aws detect role creation - Rule]
 type = detection
@@ -8399,7 +8659,7 @@ explanation = This search provides detection of role creation by IAM users. Role
 how_to_implement = You must install splunk AWS add-on and Splunk App for AWS. This search works with cloudwatch logs
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078"]}
 known_false_positives = CreateRole is not very common in common users. This search can be adjusted to provide specific values to identify cases of abuse. In general AWS provides plenty of trust policies that fit most use cases.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - aws detect sts assume role abuse - Rule]
 type = detection
@@ -8409,7 +8669,7 @@ explanation = This search provides detection of suspicious use of sts:AssumeRole
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078"]}
 known_false_positives = Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross account and cross resources access. This search can be adjusted to provide specific values to identify cases of abuse.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - aws detect sts get session token abuse - Rule]
 type = detection
@@ -8419,7 +8679,7 @@ explanation = This search provides detection of suspicious use of sts:GetSession
 how_to_implement = You must install splunk AWS add-on and Splunk App for AWS. This search works with cloudwatch logs
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1550"]}
 known_false_positives = Sts:GetSessionToken can be very noisy as in certain environments numerous calls of this type can be executed. This search can be adjusted to provide specific values to identify cases of abuse. In specific environments the use of field requestParameters.serialNumber will need to be used.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect GCP Storage access from a new IP - Rule]
 type = detection
@@ -8429,7 +8689,7 @@ explanation = This search looks at GCP Storage bucket-access logs and detects ne
 how_to_implement = This search relies on the Splunk Add-on for Google Cloud Platform, setting up a Cloud Pub/Sub input, along with the relevant GCP PubSub topics and logging sink to capture GCP Storage Bucket events (https://cloud.google.com/logging/docs/routing/overview). In order to capture public GCP Storage Bucket access logs, you must also enable storage bucket logging to your PubSub Topic as per https://cloud.google.com/storage/docs/access-logs.  These logs are deposited into the nominated Storage Bucket on an hourly basis and typically show up by 15 minutes past the hour.  It is recommended to configure any saved searches or correlation searches in Enterprise Security to run on an hourly basis at 30 minutes past the hour (cron definition of 30 * * * *).  A lookup table (previously_seen_gcp_storage_access_from_remote_ip.csv) stores the previously seen access requests, and is used by this search to determine any newly seen IP addresses accessing the Storage Buckets.
 annotations = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = GCP Storage buckets can be accessed from any IP (if the ACLs are open to allow it), as long as it can make a successful connection. This will be a false postive, since the search is looking for a new IP within the past two hours.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect New Open GCP Storage Buckets - Rule]
 type = detection
@@ -8439,7 +8699,7 @@ explanation = This search looks for GCP PubSub events where a user has created a
 how_to_implement = This search relies on the Splunk Add-on for Google Cloud Platform, setting up a Cloud Pub/Sub input, along with the relevant GCP PubSub topics and logging sink to capture GCP Storage Bucket events (https://cloud.google.com/logging/docs/routing/overview).
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = While this search has no known false positives, it is possible that a GCP admin has legitimately created a public bucket for a specific purpose. That said, GCP strongly advises against granting full control to the "allUsers" group.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect S3 access from a new IP - Rule]
 type = detection
@@ -8449,7 +8709,7 @@ explanation = This search looks at S3 bucket-access logs and detects new or prev
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access logs' inputs. This search works best when you run the "Previously Seen S3 Bucket Access by Remote IP" support search once to create a history of previously seen remote IPs and bucket names.
 annotations = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = S3 buckets can be accessed from any IP, as long as it can make a successful connection. This will be a false postive, since the search is looking for a new IP within the past hour
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule]
 type = detection
@@ -8459,7 +8719,7 @@ explanation = This search looks for a spike in number of of AWS security Hub ale
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Exploitation"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = None
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule]
 type = detection
@@ -8469,7 +8729,7 @@ explanation = This search will detect spike in blocked outbound network connecti
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your VPC Flow logs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the number of data points required to meet the definition of "spike." The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of Blocked Outbound Connection" support search once to create a history of previously seen blocked outbound connections.
 annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives", "Command \u0026 Control"], "nist": ["DE.AE", "DE.CM", "PR.AC"]}
 known_false_positives = The false-positive rate may vary based on the values of`dataPointThreshold` and `deviationThreshold`. Additionally, false positives may result when AWS administrators roll out policies enforcing network blocks, causing sudden increases in the number of blocked outbound connections.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Spike in S3 Bucket deletion - Rule]
 type = detection
@@ -8479,7 +8739,7 @@ explanation = This search detects users creating spikes in API activity related
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike. This search works best when you run the "Baseline of S3 Bucket deletion activity by ARN" support search once to create a baseline of previously seen S3 bucket-deletion activity.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
 known_false_positives = Based on the values of`dataPointThreshold` and `deviationThreshold`, the false positive rate may vary. Please modify this according the your environment.
-providing_technologies = []
+providing_technologies = ["Amazon Web Services - Cloudtrail"]
 
 [savedsearch://ESCU - GCP Detect gcploit framework - Rule]
 type = detection
@@ -8489,7 +8749,7 @@ explanation = This search provides detection of GCPloit exploitation framework.
 how_to_implement = You must install splunk GCP add-on. This search works with gcp:pubsub:message logs
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078"]}
 known_false_positives = Payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - GCP Kubernetes cluster pod scan detection - Rule]
 type = detection
@@ -8499,7 +8759,7 @@ explanation = This search provides information of unauthenticated requests via u
 how_to_implement = You must install the GCP App for Splunk (version 2.0.0 or later), then configure stackdriver and set a Pub/Sub subscription to be imported to Splunk.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]}
 known_false_positives = Not all unauthenticated requests are malicious, but frequency, User Agent, source IPs and pods  will provide context.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Gdrive suspicious file sharing - Rule]
 type = detection
@@ -8509,7 +8769,7 @@ explanation = This search can help the detection of compromised accounts or inte
 how_to_implement = Need to implement Gsuite logging targeting Google suite drive activity. In order for the search to work for your environment please update `yourdomain.com` value in the query with the domain relavant for your organization.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566"]}
 known_false_positives = This is an anomaly search, you must specify your domain in the parameters so it either filters outside domains or focus on internal domains. This search may also help investigate compromise of accounts. By looking at for example source ip addresses, document titles and abnormal number of shares and shared target users.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Gsuite suspicious calendar invite - Rule]
 type = detection
@@ -8519,7 +8779,7 @@ explanation = This search can help the detection of compromised accounts or inte
 how_to_implement = In order to successfully implement this search, you need to be ingesting logs related to gsuite (gsuite:calendar:json) having the file sharing metadata like file type, source owner, destination target user, description, etc. This search can also be made more specific by selecting specific emails, subdomains timeframe, organizational units, targeted user, etc. In order for the search to work for your environment please update `yourdomain.com` value in the query with the domain relavant for your organization.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566"]}
 known_false_positives = This search will also produce normal activity statistics. Fields such as email, ip address, name, parameters.organizer_calendar_id, parameters.target_calendar_id and parameters.event_title may give away phishing intent.For more specific results use email parameter.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - High Number of Login Failures from a single source - Rule]
 type = detection
@@ -8529,7 +8789,7 @@ explanation = This search will detect more than 5 login failures in Office365 Az
 how_to_implement = 
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1110.001", "T1110"], "nist": ["DE.DP", "DE.AE"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule]
 type = detection
@@ -8539,17 +8799,7 @@ explanation = This search provides information on anonymous Kubectl calls with I
 how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs.
 annotations = {"kill_chain_phases": ["Exploitation"]}
 known_false_positives = Kubectl calls are not malicious by nature. However source IP, verb and Object can reveal potential malicious activity, specially anonymous suspicious IPs and sensitive objects such as configmaps or secrets
-providing_technologies = []
-
-[savedsearch://ESCU - New container uploaded to AWS ECR - Rule]
-type = detection
-asset_type = AWS ECR container
-confidence = medium
-explanation = This searches show information on uploaded containers including source user, image id, source IP user type, http user agent, region, first time, last time of operation (PutImage). These searches are based on Cloud Infrastructure Data Model.
-how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You must also install Cloud Infrastructure data model. Please also customize the `container_implant_aws_detection_filter` macro to filter out the false positives.
-annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1525"]}
-known_false_positives = Uploading container is a normal behavior from developers or users with access to container registry.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Child Processes of Spoolsv exe - Rule]
 type = detection
@@ -8559,7 +8809,7 @@ explanation = This search looks for child processes of spoolsv.exe. This activit
 how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. Update the `children_of_spoolsv_filter` macro to filter out legitimate child processes spawned by spoolsv.exe.
 annotations = {"cis20": ["CIS 5", "CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["PR.AC", "PR.PT", "DE.CM"]}
 known_false_positives = Some legitimate printer-related processes may show up as children of spoolsv.exe. You should confirm that any activity as legitimate and may be added as exclusions in the search.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detect Baron Samedit CVE-2021-3156 - Rule]
 type = detection
@@ -8569,7 +8819,7 @@ explanation = This search detects the heap-based buffer overflow of sudoedit
 how_to_implement = Splunk Universal Forwarder running on Linux systems, capturing logs from the /var/log directory. The vulnerability is exposed when a non privledged user tries passing in a single \ character at the end of the command while using the shell and edit flags.
 annotations = {"cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule]
 type = detection
@@ -8579,7 +8829,7 @@ explanation = This search detects the heap-based buffer overflow of sudoedit
 how_to_implement = Splunk Universal Forwarder running on Linux systems (tested on Centos and Ubuntu), where segfaults are being logged.  This also captures instances where the exploit has been compiled into a binary. The detection looks for greater than 5 instances of sudoedit combined with segfault over your search time period on a single host
 annotations = {"cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]}
 known_false_positives = If sudoedit is throwing segfaults for other reasons this will pick those up too.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule]
 type = detection
@@ -8589,7 +8839,7 @@ explanation = This search detects the heap-based buffer overflow of sudoedit
 how_to_implement = OSQuery installed and configured to pick up process events (info at https://osquery.io) as well as using the Splunk OSQuery Add-on https://splunkbase.splunk.com/app/4402. The vulnerability is exposed when a non privledged user tries passing in a single \ character at the end of the command while using the shell and edit flags.
 annotations = {"cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Computer Changed with Anonymous Account - Rule]
 type = detection
@@ -8599,7 +8849,7 @@ explanation = This search looks for Event Code 4742 (Computer Change) or EventCo
 how_to_implement = This search requires audit computer account management to be enabled on the system in order to generate Event ID 4742. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Event Logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
 annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1210"], "nist": ["DE.AE", "DE.CM"]}
 known_false_positives = None thus far found
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Detect Outlook exe writing a zip file - Rule]
 type = detection
@@ -8609,7 +8859,7 @@ explanation = This search looks for execution of process `outlook.exe` where the
 how_to_implement = You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response product, such as Carbon Black, or endpoint data sources, such as Sysmon.
 annotations = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["ID.AM", "PR.DS"]}
 known_false_positives = It is not uncommon for outlook to write legitimate zip files to the disk.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Rare Executables - Rule]
 type = detection
@@ -8619,7 +8869,7 @@ explanation = This search will return a table of rare processes, the names of th
 how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts and populating the endpoint data model with the resultant dataset. The macro `filter_rare_process_allow_list` searches two lookup files for allowed processes.  These consist of `rare_process_allow_list_default.csv` and `rare_process_allow_list_local.csv`. To add your own processes to the allow list, add them to `rare_process_allow_list_local.csv`. If you wish to remove an entry from the default lookup file, you will have to modify the macro itself to set the allow_list value for that process to false. You can modify the limit parameter and search scheduling to better suit your environment.
 annotations = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Installation", "Command \u0026 Control", "Actions on Objectives"], "nist": ["ID.AM", "PR.PT", "PR.DS", "DE.CM"]}
 known_false_positives = Some legitimate processes may be only rarely executed in your environment. As these are identified, update `rare_process_allow_list_local.csv` to filter them out of your search results.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Detection of tools built by NirSoft - Rule]
 type = detection
@@ -8629,7 +8879,7 @@ explanation = This search looks for specific command-line arguments that may ind
 how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"cis20": ["CIS 3"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1072"], "nist": ["PR.IP"]}
 known_false_positives = While legitimate, these NirSoft tools are prone to abuse. You should verfiy that the tool was used for a legitimate purpose.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Exchange PowerShell Abuse via SSRF - Rule]
 type = detection
@@ -8643,7 +8893,7 @@ Review the source attempting to perform this activity against your environment.
 how_to_implement = The following analytic requires on-premise Exchange to be logging to Splunk using the TA - https://splunkbase.splunk.com/app/3225. Ensure logs are parsed correctly, or tune the analytic for your environment.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"]}
 known_false_positives = Limited false positives, however, tune as needed.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Exchange PowerShell Module Usage - Rule]
 type = detection
@@ -8656,7 +8906,7 @@ Module - New-managementroleassignment can assign a management role to a manageme
 how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 annotations = {"kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1059", "T1059.001"]}
 known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - First Time Seen Child Process of Zoom - Rule]
 type = detection
@@ -8666,7 +8916,7 @@ explanation = This search looks for child processes spawned by zoom.exe or zoom.
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You should run the baseline search `Previously Seen Zoom Child Processes - Initial` to build the initial table of child processes and hostnames for this search to work. You should also schedule at the same interval as this search the second baseline search `Previously Seen Zoom Child Processes - Update` to keep this table up to date and to age out old child processes. Please update the `previously_seen_zoom_child_processes_window` macro to adjust the time window.
 annotations = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1068"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
 known_false_positives = A new child process of zoom isn't malicious by that fact alone. Further investigation of the actions of the child process is needed to verify any malicious behavior is taken.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - First Time Seen Running Windows Service - Rule]
 type = detection
@@ -8676,7 +8926,7 @@ explanation = This search looks for the first and last time a Windows service is
 how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows system event logs in order for this search to execute successfully. You should run the baseline search `Previously Seen Running Windows Services - Initial` to build the initial table of child processes and hostnames for this search to work. You should also schedule at the same interval as this search the second baseline search `Previously Seen Running Windows Services - Update` to keep this table up to date and to age out old Windows Services. Please update the `previously_seen_windows_services_window` macro to adjust the time window. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above.
 annotations = {"cis20": ["CIS 2", "CIS 9"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1569", "T1569.002"], "nist": ["ID.AM", "PR.DS", "PR.AC", "DE.AE"]}
 known_false_positives = A previously unseen service is not necessarily malicious. Verify that the service is legitimate and that was installed by a legitimate process.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Linux Stdout Redirection To Dev Null File - Rule]
 type = detection
@@ -8686,7 +8936,7 @@ explanation = This analytic looks for suspicious commandline that redirect the s
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.004", "T1562"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - MacOS - Re-opened Applications - Rule]
 type = detection
@@ -8696,7 +8946,7 @@ explanation = This search looks for processes referencing the plist files that d
 how_to_implement = In order to properly run this search, Splunk needs to ingest process data from your osquery deployed agents with the [splunk.conf](https://github.com/splunk/TA-osquery/blob/master/config/splunk.conf) pack enabled. Also the [TA-OSquery](https://github.com/splunk/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the data populate the Endpoint data model.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Installation", "Command \u0026 Control"], "nist": ["DE.DP", "DE.CM"]}
 known_false_positives = At this stage, there are no known false positives. During testing, no process events refering the com.apple.loginwindow.plist files were observed during normal operation of re-opening applications on reboot. Therefore, it can be asumed that any occurences of this in the process events would be worth investigating. In the event that the legitimate modification by the system of these files is in fact logged to the process log, then the process_name of that process can be added to an allow list.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule]
 type = detection
@@ -8706,7 +8956,7 @@ explanation = The following query identifies suspicious .aspx created in 3 paths
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003", "T1190"]}
 known_false_positives = The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Print Processor Registry Autostart - Rule]
 type = detection
@@ -8716,7 +8966,7 @@ explanation = This analytic is to detect a suspicious modification or new regist
 how_to_implement = To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012", "T1547"]}
 known_false_positives = possible new printer installation may add driver component on this registry.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Processes Tapping Keyboard Events - Rule]
 type = detection
@@ -8726,7 +8976,7 @@ explanation = This search looks for processes in an MacOS system that is tapping
 how_to_implement = In order to properly run this search, Splunk needs to ingest data from your osquery deployed agents with the [osx-attacks.conf](https://github.com/facebook/osquery/blob/experimental/packs/osx-attacks.conf#L599) pack enabled. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the Alerts data model.
 annotations = {"cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Command \u0026 Control"], "nist": ["DE.DP"]}
 known_false_positives = There might be some false positives as keyboard event taps are used by processes like Siri and Zoom video chat, for some good examples of processes to exclude please see [this](https://github.com/facebook/osquery/pull/5345#issuecomment-454639161) comment.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Randomly Generated Scheduled Task Name - Rule]
 type = detection
@@ -8736,7 +8986,7 @@ explanation = The following hunting analytic leverages Event ID 4698, `A schedul
 how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4698 EventCode enabled. The Windows TA as well as the URL ToolBox application are also required.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053", "T1053.005"]}
 known_false_positives = Legitimate applications may use random Scheduled Task names.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Randomly Generated Windows Service Name - Rule]
 type = detection
@@ -8746,7 +8996,7 @@ explanation = The following hunting analytic leverages Event ID 7045, `A new ser
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. The Windows TA as well as the URL ToolBox application are also required.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543", "T1543.003"]}
 known_false_positives = Legitimate applications may use random Windows Service names.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Remote Desktop Process Running On System - Rule]
 type = detection
@@ -8756,7 +9006,7 @@ explanation = This search looks for the remote desktop process mstsc.exe running
 how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. The search requires you to identify systems that do not commonly use remote desktop. You can use the included support search "Identify Systems Using Remote Desktop" to identify these systems. After identifying them, you will need to add the "common_rdp_source" category to that system using the Enterprise Security Assets and Identities framework. This can be done by adding an entry in the assets.csv file located in `SA-IdentityManagement/lookups`.
 annotations = {"cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.AE", "PR.AC", "PR.IP"]}
 known_false_positives = Remote Desktop may be used legitimately by users on the network.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Spike in File Writes - Rule]
 type = detection
@@ -8766,7 +9016,7 @@ explanation = The search looks for a sharp increase in the number of files writt
 how_to_implement = In order to implement this search, you must populate the Endpoint file-system data model node. This is typically populated via endpoint detection and response product, such as Carbon Black or endpoint data sources such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the file system.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM"]}
 known_false_positives = It is important to understand that if you happen to install any new applications on your hosts or are copying a large number of files, you can expect to see a large increase of file modifications.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Sunburst Correlation DLL and Network Event - Rule]
 type = detection
@@ -8776,7 +9026,7 @@ explanation = The malware sunburst will load the malicious dll by SolarWinds.Bus
 how_to_implement = This detection relies on sysmon logs with the Event ID 7, Driver loaded. Please tune your sysmon config that you DriverLoad event for SolarWinds.Orion.Core.BusinessLayer.dll is captured by Sysmon. Additionally, you need sysmon logs for Event ID 22, DNS Query. We suggest to run this detection at least once a day over the last 14 days.
 annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Suspicious Curl Network Connection - Rule]
 type = detection
@@ -8786,7 +9036,7 @@ explanation = The following analytic identifies the use of a curl contacting sus
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1105"]}
 known_false_positives = Unknown. Filter as needed.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious PlistBuddy Usage - Rule]
 type = detection
@@ -8803,7 +9053,7 @@ Upon triage, capture the property list file being written to disk and review for
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1543.001", "T1543"]}
 known_false_positives = Some legitimate applications may use PlistBuddy to create or modify property lists and possibly generate false positives. Review the property list being modified or created to confirm.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Suspicious PlistBuddy Usage via OSquery - Rule]
 type = detection
@@ -8820,7 +9070,7 @@ Upon triage, capture the property list file being written to disk and review for
 how_to_implement = OSQuery must be installed and configured to pick up process events (info at https://osquery.io) as well as using the Splunk OSQuery Add-on https://splunkbase.splunk.com/app/4402. Modify the macro and validate fields are correct.
 annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1543.001", "T1543"]}
 known_false_positives = Some legitimate applications may use PlistBuddy to create or modify property lists and possibly generate false positives. Review the property list being modified or created to confirm.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Suspicious SQLite3 LSQuarantine Behavior - Rule]
 type = detection
@@ -8830,7 +9080,7 @@ explanation = The following analytic identifies the use of a SQLite3 querying th
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1074"]}
 known_false_positives = Unknown.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Unusual Number of Computer Service Tickets Requested - Rule]
 type = detection
@@ -8841,7 +9091,7 @@ The detection calculates the standard deviation for each host and leverages the
 how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078"]}
 known_false_positives = An single endpoint requesting a large number of computer service tickets is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systeams and missconfigured systems.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule]
 type = detection
@@ -8852,7 +9102,7 @@ The detection calculates the standard deviation for each host and leverages the
 how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1078"]}
 known_false_positives = An single endpoint authenticating to a large number of hosts is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, jump servers and missconfigured systems.
-providing_technologies = []
+providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Unusually Long Command Line - Rule]
 type = detection
@@ -8862,7 +9112,7 @@ explanation = Command lines that are extremely long may be indicative of malicio
 how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships, from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the process field in the Endpoint data model.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Some legitimate applications start with long command lines.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Unusually Long Command Line - MLTK - Rule]
 type = detection
@@ -8872,7 +9122,7 @@ explanation = Command lines that are extremely long may be indicative of malicio
 how_to_implement = You must be ingesting endpoint data that monitors command lines and populates the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. In addition, MLTK version >= 4.2 must be installed on your search heads, along with any required dependencies. Finally, the support search "Baseline of Command Line Length - MLTK" must be executed before this detection search, as it builds an ML model over the historical data used by this search. It is important that this search is run in the same app context as the associated support search, so that the model created by the support search is available for use. You should periodically re-run the support search to rebuild the model with the latest data available in your environment.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Some legitimate applications use long command lines for installs or updates. You should review identified command lines for legitimacy. You may modify the first part of the search to omit legitimate command lines from consideration. If you are seeing more results than desired, you may consider changing the value of threshold in the search to a smaller value. You should also periodically re-run the support search to re-build the ML model on the latest data. You may get unexpected results if the user identified in the results is not present in the data used to build the associated model.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Windows Java Spawning Shells - Rule]
 type = detection
@@ -8882,7 +9132,7 @@ explanation = The following analytic identifies the process name of java.exe and
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. Restrict the analytic to publicly facing endpoints to reduce false positives. Add any additional identified web application process name to the query. Add any further Windows process names to the macro (ex. LOLBins) to further expand this query.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"]}
 known_false_positives = Filtering may be required on internal developer build systems or classify assets as web facing and restrict the analytic based on that.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - WinRM Spawning a Process - Rule]
 type = detection
@@ -8892,7 +9142,7 @@ explanation = The following analytic identifies suspicious processes spawning fr
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 annotations = {"kill_chain_phases": ["Exploitation", "Actions on Objectives"], "mitre_attack": ["T1190"]}
 known_false_positives = Unknown. Add new processes or filter as needed. It is possible system management software may spawn processes from `wsmprovhost.exe`.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - WMI Permanent Event Subscription - Rule]
 type = detection
@@ -8902,7 +9152,7 @@ explanation = This search looks for the creation of WMI permanent event subscrip
 how_to_implement = To successfully implement this search, you must be ingesting the Windows WMI activity logs. This can be done by adding a stanza to inputs.conf on the system generating logs with a title of [WinEventLog://Microsoft-Windows-WMI-Activity/Operational].
 annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]}
 known_false_positives = Although unlikely, administrators may use event subscriptions for legitimate purposes.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - WMI Temporary Event Subscription - Rule]
 type = detection
@@ -8912,7 +9162,7 @@ explanation = This search looks for the creation of WMI temporary event subscrip
 how_to_implement = To successfully implement this search, you must be ingesting the Windows WMI activity logs. This can be done by adding a stanza to inputs.conf on the system generating logs with a title of [WinEventLog://Microsoft-Windows-WMI-Activity/Operational].
 annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]}
 known_false_positives = Some software may create WMI temporary event subscriptions for various purposes. The included search contains an exception for two of these that occur by default on Windows 10 systems. You may need to modify the search to create exceptions for other legitimate events.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect ARP Poisoning - Rule]
 type = detection
@@ -8922,7 +9172,7 @@ explanation = By enabling Dynamic ARP Inspection as a Layer 2 Security measure o
 how_to_implement = This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with DHCP Snooping (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html) and Dynamic ARP Inspection (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-2_2_e/security/configuration_guide/b_sec_1522e_2960x_cg/b_sec_1522e_2960x_cg_chapter_01111.html) and log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices.
 annotations = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.DS"]}
 known_false_positives = This search might be prone to high false positives if DHCP Snooping or ARP inspection has been incorrectly configured, or if a device normally sends many ARP packets (unlikely).
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect IPv6 Network Infrastructure Threats - Rule]
 type = detection
@@ -8932,7 +9182,7 @@ explanation = By enabling IPv6 First Hop Security as a Layer 2 Security measure
 how_to_implement = This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with one or more First Hop Security measures such as RA Guard, DHCP Guard and/or device tracking. See References for more information. The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices.
 annotations = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.DS"]}
 known_false_positives = None currently known
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Large Outbound ICMP Packets - Rule]
 type = detection
@@ -8942,7 +9192,7 @@ explanation = This search looks for outbound ICMP packets with a packet size lar
 how_to_implement = In order to run this search effectively, we highly recommend that you leverage the Assets and Identity framework. It is important that you have a good understanding of how your network segments are designed and that you are able to distinguish internal from external address space. Add a category named `internal` to the CIDRs that host the company's assets in the `assets_by_cidr.csv` lookup file, which is located in `$SPLUNK_HOME/etc/apps/SA-IdentityManagement/lookups/`. More information on updating this lookup can be found here: https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Addassetandidentitydata. This search also requires you to be ingesting your network traffic and populating the Network_Traffic data model
 annotations = {"cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1095"], "nist": ["DE.AE"]}
 known_false_positives = ICMP packets are used in a variety of ways to help troubleshoot networking issues and ensure the proper flow of traffic. As such, it is possible that a large ICMP packet could be perfectly legitimate. If large ICMP packets are associated with command and control traffic, there will typically be a large number of these packets observed over time. If the search is providing a large number of false positives, you can modify the macro `detect_large_outbound_icmp_packets_filter` to adjust the byte threshold or add specific IP addresses to an allow list.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Outbound SMB Traffic - Rule]
 type = detection
@@ -8952,7 +9202,7 @@ explanation = This search looks for outbound SMB connections made by hosts withi
 how_to_implement = In order to run this search effectively, we highly recommend that you leverage the Assets and Identity framework. It is important that you have good understanding of how your network segments are designed, and be able to distinguish internal from external address space. Add a category named `internal` to the CIDRs that host the companys assets in `assets_by_cidr.csv` lookup file, which is located in `$SPLUNK_HOME/etc/apps/SA-IdentityManagement/lookups/`. More information on updating this lookup can be found here: https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Addassetandidentitydata. This search also requires you to be ingesting your network traffic and populating the Network_Traffic data model
 annotations = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command \u0026 Control"], "mitre_attack": ["T1071.002", "T1071"], "nist": ["DE.CM"]}
 known_false_positives = It is likely that the outbound Server Message Block (SMB) traffic is legitimate, if the company's internal networks are not well-defined in the Assets and Identity Framework. Categorize the internal CIDR blocks as `internal` in the lookup file to avoid creating notable events for traffic destined to those CIDR blocks. Any other network connection that is going out to the Internet should be investigated and blocked. Best practices suggest preventing external communications of all SMB versions and related protocols at the network boundary.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Port Security Violation - Rule]
 type = detection
@@ -8962,7 +9212,7 @@ explanation = By enabling Port Security on a Cisco switch you can restrict input
 how_to_implement = This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with Port Security and Error Disable for this to work (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec.html) and log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices.
 annotations = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Exploitation", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.DS"]}
 known_false_positives = This search might be prone to high false positives if you have malfunctioning devices connected to your ethernet ports or if end users periodically connect physical devices to the network.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Rogue DHCP Server - Rule]
 type = detection
@@ -8972,7 +9222,7 @@ explanation = By enabling DHCP Snooping as a Layer 2 Security measure on the org
 how_to_implement = This search uses a standard SPL query on logs from Cisco Network devices. The network devices must be configured with DHCP Snooping enabled (see https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg/b_sec_152ex_2960-x_cg_chapter_01101.html) and log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices.
 annotations = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557"], "nist": ["ID.AM", "PR.DS"]}
 known_false_positives = This search might be prone to high false positives if DHCP Snooping has been incorrectly configured or in the unlikely event that the DHCP server has been moved to another network interface.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect SNICat SNI Exfiltration - Rule]
 type = detection
@@ -8982,7 +9232,7 @@ explanation = This search looks for commands that the SNICat tool uses in the TL
 how_to_implement = You must be ingesting Zeek SSL data into Splunk. Zeek data should also be getting ingested in JSON format.  We are detecting when any of the predefined SNICat commands are found within the server_name (SNI) field. These commands are LIST, LS, SIZE, LD, CB, EX, ALIVE, EXIT, WHERE, and finito.  You can go further once this has been detected, and run other searches to decode the SNI data to prove or disprove if any data exfiltration has taken place.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1041"], "nist": ["PR.DS", "DE.CM", "DE.AE"]}
 known_false_positives = Unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Software Download To Network Device - Rule]
 type = detection
@@ -8992,7 +9242,7 @@ explanation = Adversaries may abuse netbooting to load an unauthorized network d
 how_to_implement = This search looks for Network Traffic events to TFTP, FTP or SSH/SCP ports from network devices. Make sure to tag any network devices as network, router or switch in order for this detection to work. If the TFTP traffic doesn't traverse a firewall nor packet inspection, these events will not be logged. This is typically an issue if the TFTP server is on the same subnet as the network device. There is also a chance of the network device loading software using a DHCP assigned IP address (netboot) which is not in the Asset inventory.
 annotations = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1542.005", "T1542"], "nist": ["ID.AM", "PR.DS"]}
 known_false_positives = This search will also report any legitimate attempts of software downloads to network devices as well as outbound SSH sessions from network devices.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Traffic Mirroring - Rule]
 type = detection
@@ -9002,7 +9252,7 @@ explanation = Adversaries may leverage traffic mirroring in order to automate da
 how_to_implement = This search uses a standard SPL query on logs from Cisco Network devices. The network devices must log with a severity level of minimum "5 - notification". The search also requires that the Cisco Networks Add-on for Splunk (https://splunkbase.splunk.com/app/1467) is used to parse the logs from the Cisco network devices and that the devices have been configured according to the documentation of the Cisco Networks Add-on. Also note that an attacker may disable logging from the device prior to enabling traffic mirroring.
 annotations = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1020", "T1498", "T1020.001"], "nist": ["ID.AM", "PR.DS"]}
 known_false_positives = This search will return false positives for any legitimate traffic captures by network administrators.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Unauthorized Assets by MAC address - Rule]
 type = detection
@@ -9012,7 +9262,7 @@ explanation = By populating the organization's assets within the assets_by_str.c
 how_to_implement = This search uses the Network_Sessions data model shipped with Enterprise Security. It leverages the Assets and Identity framework to populate the assets_by_str.csv file located in SA-IdentityManagement, which will contain a list of known authorized organizational assets including their MAC addresses. Ensure that all inventoried systems have their MAC address populated.
 annotations = {"cis20": ["CIS 1"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]}
 known_false_positives = This search might be prone to high false positives. Please consider this when conducting analysis or investigations. Authorized devices may be detected as unauthorized. If this is the case, verify the MAC address of the system responsible for the false positive and add it to the Assets and Identity framework with the proper information.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule]
 type = detection
@@ -9022,7 +9272,7 @@ explanation = This search detects SIGRed via Splunk Stream.
 how_to_implement = You must be ingesting Splunk Stream DNS and Splunk Stream TCP. We are detecting SIG and KEY records via stream:dns and TCP payload over 65KB in size via stream:tcp.  Replace the macro definitions ('stream:dns' and 'stream:tcp') with configurations for your Splunk environment.
 annotations = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Windows DNS SIGRed via Zeek - Rule]
 type = detection
@@ -9032,7 +9282,7 @@ explanation = This search detects SIGRed via Zeek DNS and Zeek Conn data.
 how_to_implement = You must be ingesting Zeek DNS and Zeek Conn data into Splunk. Zeek data should also be getting ingested in JSON format.  We are detecting SIG and KEY records via bro:dns:json and TCP payload over 65KB in size via bro:conn:json.  The Network Resolution and Network Traffic datamodels are in use for this search.
 annotations = {"cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Zerologon via Zeek - Rule]
 type = detection
@@ -9042,7 +9292,7 @@ explanation = This search detects attempts to run exploits for the Zerologon CVE
 how_to_implement = You must be ingesting Zeek DCE-RPC data into Splunk. Zeek data should also be getting ingested in JSON format.  We are detecting when all three RPC operations (NetrServerReqChallenge, NetrServerAuthenticate3, NetrServerPasswordSet2) are splunk_security_essentials_app via bro:rpc:json.  These three operations are then correlated on the Zeek UID field.
 annotations = {"cis20": ["CIS 8", "CIS 11"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - DNS Query Length Outliers - MLTK - Rule]
 type = detection
@@ -9058,7 +9308,7 @@ This search produces fields (`query`,`query_length`,`count`) that are not yet su
 Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`
 annotations = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1071.004", "T1071"], "nist": ["PR.PT", "DE.AE", "DE.CM"]}
 known_false_positives = If you are seeing more results than desired, you may consider reducing the value for threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Excessive DNS Failures - Rule]
 type = detection
@@ -9068,7 +9318,7 @@ explanation = This search identifies DNS query failures by counting the number o
 how_to_implement = To successfully implement this search you must ensure that DNS data is populating the Network_Resolution data model.
 annotations = {"cis20": ["CIS 8", "CIS 9", "CIS 12"], "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1071.004", "T1071"], "nist": ["PR.PT", "DE.AE", "DE.CM"]}
 known_false_positives = It is possible legitimate traffic can trigger this rule. Please investigate as appropriate. The threshold for generating an event can also be customized to better suit your environment.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Hosts receiving high volume of network traffic from email server - Rule]
 type = detection
@@ -9078,7 +9328,7 @@ explanation = This search looks for an increase of data transfers from your emai
 how_to_implement = This search requires you to be ingesting your network traffic and populating the Network_Traffic data model.  Your email servers must be categorized as "email_server" for the search to work, as well. You may need to adjust the deviation_threshold and minimum_data_samples values based on the network traffic in your environment. The "deviation_threshold" field is a multiplying factor to control how much variation you're willing to tolerate. The "minimum_data_samples" field is the minimum number of connections of data samples required for the statistic to be valid.
 annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002", "T1114"], "nist": ["PR.PT", "DE.CM", "DE.AE"]}
 known_false_positives = The false-positive rate will vary based on how you set the deviation_threshold and data_samples values. Our recommendation is to adjust these values based on your network traffic to and from your email servers.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Large Volume of DNS ANY Queries - Rule]
 type = detection
@@ -9088,7 +9338,7 @@ explanation = The search is used to identify attempts to use your DNS Infrastruc
 how_to_implement = To successfully implement this search you must ensure that DNS data is populating the Network_Resolution data model.
 annotations = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1498", "T1498.002"], "nist": ["PR.PT", "DE.AE", "PR.IP"]}
 known_false_positives = Legitimate ANY requests may trigger this search, however it is unusual to see a large volume of them under typical circumstances. You may modify the threshold in the search to better suit your environment.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Prohibited Network Traffic Allowed - Rule]
 type = detection
@@ -9098,7 +9348,7 @@ explanation = This search looks for network traffic defined by port and transpor
 how_to_implement = In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model be populated.
 annotations = {"cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Delivery", "Command \u0026 Control"], "mitre_attack": ["T1048"], "nist": ["DE.AE", "PR.AC"]}
 known_false_positives = None identified
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Protocol or Port Mismatch - Rule]
 type = detection
@@ -9108,7 +9358,7 @@ explanation = This search looks for network traffic on common ports where a high
 how_to_implement = Running this search properly requires a technology that can inspect network traffic and identify common protocols. Technologies such as Bro and Palo Alto Networks firewalls are two examples that will identify protocols via inspection, and not just assume a specific protocol based on the transport protocol and ports.
 annotations = {"cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1048.003", "T1048"], "nist": ["DE.AE", "PR.AC"]}
 known_false_positives = None identified
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Protocols passing authentication in cleartext - Rule]
 type = detection
@@ -9118,7 +9368,7 @@ explanation = The following analytic identifies cleartext protocols at risk of l
 how_to_implement = This search requires you to be ingesting your network traffic, and populating the Network_Traffic data model. For more accurate result it's better to limit destination to organization private and public IP range, like All_Traffic.dest IN(192.168.0.0/16,172.16.0.0/12,10.0.0.0/8, x.x.x.x/22)
 annotations = {"cis20": ["CIS 9", "CIS 14"], "kill_chain_phases": ["Reconnaissance", "Actions on Objectives"], "nist": ["PR.PT", "DE.AE", "PR.AC", "PR.DS"]}
 known_false_positives = Some networks may use kerberized FTP or telnet servers, however, this is rare.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Remote Desktop Network Bruteforce - Rule]
 type = detection
@@ -9128,7 +9378,7 @@ explanation = This search looks for RDP application network traffic and filters
 how_to_implement = You must ensure that your network traffic data is populating the Network_Traffic data model.
 annotations = {"cis20": ["CIS 12", "CIS 9", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Delivery"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.AE", "PR.AC", "PR.IP"]}
 known_false_positives = RDP gateways may have unusually high amounts of traffic from all other hosts' RDP applications in the network.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Remote Desktop Network Traffic - Rule]
 type = detection
@@ -9138,7 +9388,7 @@ explanation = This search looks for network traffic on TCP/3389, the default por
 how_to_implement = To successfully implement this search you need to identify systems that commonly originate remote desktop traffic and that commonly receive remote desktop traffic. You can use the included support search "Identify Systems Creating Remote Desktop Traffic" to identify systems that originate the traffic and the search "Identify Systems Receiving Remote Desktop Traffic" to identify systems that receive a lot of remote desktop traffic. After identifying these systems, you will need to add the "common_rdp_source" or "common_rdp_destination" category to that system depending on the usage, using the Enterprise Security Assets and Identities framework.  This can be done by adding an entry in the assets.csv file located in SA-IdentityManagement/lookups.
 annotations = {"cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.AE", "PR.AC", "PR.IP"]}
 known_false_positives = Remote Desktop may be used legitimately by users on the network.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - SMB Traffic Spike - Rule]
 type = detection
@@ -9148,7 +9398,7 @@ explanation = This search looks for spikes in the number of Server Message Block
 how_to_implement = This search requires you to be ingesting your network traffic logs and populating the `Network_Traffic` data model.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002", "T1021"], "nist": ["DE.CM"]}
 known_false_positives = A file server may experience high-demand loads that could cause this analytic to trigger.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - SMB Traffic Spike - MLTK - Rule]
 type = detection
@@ -9161,7 +9411,7 @@ This search produces a field (Number of events,count) that are not yet supported
 Detailed documentation on how to create a new field within Incident Review is found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002", "T1021"], "nist": ["DE.CM"]}
 known_false_positives = If you are seeing more results than desired, you may consider reducing the value of the threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data. Please update the `smb_traffic_spike_mltk_filter` macro to filter out false positive results
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - TOR Traffic - Rule]
 type = detection
@@ -9171,7 +9421,7 @@ explanation = This search looks for network traffic identified as The Onion Rout
 how_to_implement = In order to properly run this search, Splunk needs to ingest data from firewalls or other network control devices that mediate the traffic allowed into an environment. This is necessary so that the search can identify an 'action' taken on the traffic of interest. The search requires the Network_Traffic data model be populated.
 annotations = {"cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1071", "T1071.001"], "nist": ["DE.AE"]}
 known_false_positives = None at this time
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Unusually Long Content-Type Length - Rule]
 type = detection
@@ -9181,7 +9431,7 @@ explanation = This search looks for unusually long strings in the Content-Type h
 how_to_implement = This particular search leverages data extracted from Stream:HTTP. You must configure the http stream using the Splunk Stream App on your Splunk Stream deployment server to extract the cs_content_type field.
 annotations = {"cis20": ["CIS 3", "CIS 4", "CIS 18", "CIS 12"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "RS.MI", "PR.PT", "PR.IP", "DE.AE", "PR.MA", "DE.CM"]}
 known_false_positives = Very few legitimate Content-Type fields will have a length greater than 100 characters.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule]
 type = detection
@@ -9191,7 +9441,7 @@ explanation = This search looks for specific GET or HEAD requests to web servers
 how_to_implement = You must be ingesting data from the web server or network traffic that contains web specific information, and populating the Web data model.
 annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1082"]}
 known_false_positives = It's possible for legitimate HTTP requests to be made to URLs containing the suspicious paths.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule]
 type = detection
@@ -9201,7 +9451,7 @@ explanation = This search detects remote code exploit attempts on F5 BIG-IP, BIG
 how_to_implement = To consistently detect exploit attempts on F5 devices using the vulnerabilities contained within CVE-2020-5902 it is recommended to ingest logs via syslog.  As many BIG-IP devices will have SSL enabled on their management interfaces, detections via wire data may not pick anything up unless you are decrypting SSL traffic in order to inspect it.  I am using a regex string from a Cloudflare mitigation technique to try and always catch the offending string (..;), along with the other exploit of using (hsqldb;).
 annotations = {"cis20": ["CIS 8", "CIS 11"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect malicious requests to exploit JBoss servers - Rule]
 type = detection
@@ -9211,7 +9461,7 @@ explanation = This search is used to detect malicious HTTP requests crafted to e
 how_to_implement = You must ingest data from the web server or capture network data that contains web specific information with solutions such as Bro or Splunk Stream, and populating the Web data model
 annotations = {"cis20": ["CIS 12", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "PR.PT", "PR.IP", "DE.AE", "PR.MA", "DE.CM"]}
 known_false_positives = No known false positives for this detection.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Monitor Web Traffic For Brand Abuse - Rule]
 type = detection
@@ -9221,7 +9471,7 @@ explanation = This search looks for Web requests to faux domains similar to the
 how_to_implement = You need to ingest data from your web traffic. This can be accomplished by indexing data from a web proxy, or using a network traffic analysis tool, such as Bro or Splunk Stream. You also need to have run the search "ESCU - DNSTwist Domain Names", which creates the permutations of the domain that will be checked for.
 annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]}
 known_false_positives = None at this time
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - SQL Injection with Long URLs - Rule]
 type = detection
@@ -9231,7 +9481,7 @@ explanation = This search looks for long URLs that have several SQL commands vis
 how_to_implement = To successfully implement this search, you need to be monitoring network communications to your web servers or ingesting your HTTP logs and populating the Web data model. You must also identify your web servers in the Enterprise Security assets table.
 annotations = {"cis20": ["CIS 4", "CIS 13", "CIS 18"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["PR.DS", "ID.RA", "PR.PT", "PR.IP", "DE.CM"]}
 known_false_positives = It's possible that legitimate traffic will have long URLs or long user agent strings and that common SQL commands may be found within the URL. Please investigate as appropriate.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Supernova Webshell - Rule]
 type = detection
@@ -9241,7 +9491,7 @@ explanation = This search aims to detect the Supernova webshell used in the SUNB
 how_to_implement = To successfully implement this search, you need to be monitoring web traffic to your Solarwinds Orion. The logs should be ingested into splunk and populating/mapped to the Web data model.
 annotations = {"cis20": ["CIS 4", "CIS 13", "CIS 18"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"], "nist": ["PR.DS", "ID.RA", "PR.PT", "PR.IP", "DE.CM"]}
 known_false_positives = There might be false positives associted with this detection since items like args as a web argument is pretty generic.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect hosts connecting to dynamic domain providers - Rule]
 type = detection
@@ -9257,7 +9507,7 @@ This search produces fields (query, answer, isDynDNS) that are not yet supported
 Detailed documentation on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`
 annotations = {"cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1189"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]}
 known_false_positives = Some users and applications may leverage Dynamic DNS to reach out to some domains on the Internet since dynamic DNS by itself is not malicious, however this activity must be verified.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Detect Outbound LDAP Traffic - Rule]
 type = detection
@@ -9267,7 +9517,7 @@ explanation = Malicious actors often abuse misconfigured LDAP servers or applica
 how_to_implement = You must be ingesting Zeek DNS and Zeek Conn data into Splunk. Zeek data should also be getting ingested in JSON format and should be mapped to the Network Traffic datamodels that are in use for this search.
 annotations = {"cis20": ["CIS 12", "CIS 13"], "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1190", "T1059"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]}
 known_false_positives = Unknown at this moment. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. Please check those servers to verify if the activity is legitimate.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - DNS Query Length With High Standard Deviation - Rule]
 type = detection
@@ -9277,7 +9527,7 @@ explanation = This search allows you to identify DNS requests and compute the st
 how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model.
 annotations = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1048.003", "T1048"], "nist": ["PR.PT", "DE.AE", "DE.CM"]}
 known_false_positives = It's possible there can be long domain names that are legitimate.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - F5 BIG-IP iControl REST Vulnerability CVE-2022-1388 - Rule]
 type = detection
@@ -9287,7 +9537,7 @@ explanation = The following analytic identifies a recent unauthenticated remote
 how_to_implement = To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
 known_false_positives = False positives may be present if the activity is blocked or was not successful. Filter known vulnerablity scanners. Filter as needed.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Multiple Archive Files Http Post Traffic - Rule]
 type = detection
@@ -9297,7 +9547,7 @@ explanation = This search is designed to detect high frequency of archive files
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the stream HTTP logs or network logs that catch network traffic. Make sure that the http-request-body, payload, or request field is enabled in stream http configuration.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003", "T1048"]}
 known_false_positives = Normal archive transfer via HTTP protocol may trip this detection.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Plain HTTP POST Exfiltrated Data - Rule]
 type = detection
@@ -9307,7 +9557,7 @@ explanation = This search is to detect potential plain HTTP POST method data exf
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the stream HTTP logs or network logs that catch network traffic. Make sure that the http-request-body, payload, or request field is enabled.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048.003", "T1048"]}
 known_false_positives = unknown
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Splunk Identified SSL TLS Certificates - Rule]
 type = detection
@@ -9317,7 +9567,7 @@ explanation = The following analytic uses tags of SSL, TLS and certificate to id
 how_to_implement = Ingestion of SSL/TLS data is needed and to be tagged properly as ssl, tls or certificate. This data may come from a proxy, zeek, or Splunk Streams. Splunk SOAR customers can find a SOAR workbook that walks an analyst through the process of running these hunting searches in the references list of this detection. In order to use this workbook, a user will need to run a curl command to post the file to their SOAR instance such as "curl -u username:password https://soar.instance.name/rest/rest/workbook_template -d @splunk_psa_0622.json". A user should then create an empty container or case, attach the workbook, and begin working through the tasks.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1040"], "nist": ["DE.CM"]}
 known_false_positives = False positives will not be present as it is meant to assist with identifying default certificates being utilized.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Confluence Unauthenticated Remote Code Execution CVE-2022-26134 - Rule]
 type = detection
@@ -9327,7 +9577,7 @@ explanation = The following analytic assists with identifying CVE-2022-26134 bas
 how_to_implement = This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache or Splunk for Nginx. In addition, network based logs or event data like PAN Threat.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1190"], "nist": ["DE.CM"]}
 known_false_positives = Tune based on assets if possible, or restrict to known Confluence servers. Remove the ${ for a more broad query. To identify more exec, remove everything up to the last parameter (Runtime().exec) for a broad query.
-providing_technologies = []
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Log4Shell JNDI Payload Injection Attempt - Rule]
 type = detection
@@ -9337,7 +9587,7 @@ explanation = CVE-2021-44228 Log4Shell payloads can be injected via various meth
 how_to_implement = This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache or Splunk for Nginx.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
 known_false_positives = If there is a vulnerablility scannner looking for log4shells this will trigger, otherwise likely to have low false positives.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Log4Shell JNDI Payload Injection with Outbound Connection - Rule]
 type = detection
@@ -9347,7 +9597,7 @@ explanation = CVE-2021-44228 Log4Shell payloads can be injected via various meth
 how_to_implement = This detection requires the Web datamodel to be populated from a supported Technology Add-On like Splunk for Apache or Splunk for Nginx.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
 known_false_positives = If there is a vulnerablility scannner looking for log4shells this will trigger, otherwise likely to have low false positives.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Spring4Shell Payload URL Request - Rule]
 type = detection
@@ -9357,7 +9607,7 @@ explanation = The following analytic is static indicators related to CVE-2022-22
 how_to_implement = To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003", "T1505", "T1190"], "nist": ["DE.CM"]}
 known_false_positives = The jsp file names are static names used in current proof of concept code. =
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - VMware Server Side Template Injection Hunt - Rule]
 type = detection
@@ -9367,7 +9617,7 @@ explanation = The following hunting analytic identifies the server side template
 how_to_implement = To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
 known_false_positives = False positives may be present if the activity is blocked or was not successful. Filter known vulnerablity scanners. Filter as needed.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - VMware Workspace ONE Freemarker Server-side Template Injection - Rule]
 type = detection
@@ -9377,7 +9627,7 @@ explanation = The following analytic identifies the server side template injecti
 how_to_implement = To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the Web Datamodel. For additional filtering, allow list private IP space or restrict by known good.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
 known_false_positives = False positives may be present if the activity is blocked or was not successful. Filter known vulnerablity scanners. Filter as needed.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Web JSP Request via URL - Rule]
 type = detection
@@ -9387,7 +9637,7 @@ explanation = The following analytic identifies the common URL requests used by
 how_to_implement = To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003", "T1505", "T1190"], "nist": ["DE.CM"]}
 known_false_positives = False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to servers.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Web Spring4Shell HTTP Request Class Module - Rule]
 type = detection
@@ -9397,7 +9647,7 @@ explanation = The following analytic identifies the payload related to Spring4Sh
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the stream HTTP logs or network logs that catch network traffic. Make sure that the http-request-body, payload, or request field is enabled.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
 known_false_positives = False positives may occur and filtering may be required. Restrict analytic to asset type.
-providing_technologies = []
+providing_technologies = null
 
 [savedsearch://ESCU - Web Spring Cloud Function FunctionRouter - Rule]
 type = detection
@@ -9407,7 +9657,7 @@ explanation = The following analytic identifies activity related to the web appl
 how_to_implement = To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
 known_false_positives = False positives may be present with legitimate applications. Attempt to filter by dest IP or use Asset groups to restrict to servers.
-providing_technologies = []
+providing_technologies = null
 
 ### END DETECTIONS ###
 
@@ -9593,6 +9843,17 @@ In addition to compromising the security of your data, when bad actors leverage
 Fortunately, you can leverage Amazon Web Services (AWS) CloudTrail--a tool that helps you enable governance, compliance, and risk auditing of your AWS account--to give you increased visibility into your user and resource activity by recording AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from which the calls were made, and when the calls occurred.\
 The detection searches in this Analytic Story are designed to help you uncover AWS API activities from users not listed in the identity table, as well as similar activities from disabled accounts.
 
+[analytic_story://Azorult]
+category = Malware
+last_updated = 2022-06-09
+version = 1
+references = ["https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US\u0026sfdcIFrameOrigin=null", "https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}]
+spec_version = 3
+searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - CHCP Command Execution - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Disable Defender BlockAtFirstSeen Feature - Rule", "ESCU - Disable Defender Enhanced Notification - Rule", "ESCU - Disable Defender Spynet Reporting - Rule", "ESCU - Disable Defender Submit Samples Consent Feature - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Excessive Attempt To Disable Services - Rule", "ESCU - Excessive Usage Of Cacls App - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Excessive Usage Of Taskkill - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Firewall Allowed Program Enable - Rule", "ESCU - Hide User Account From Sign-In Screen - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Icacls Deny Command - Rule", "ESCU - Net Localgroup Discovery - Rule", "ESCU - Network Connection Discovery With Net - Rule", "ESCU - Non Firefox Process Access Firefox Profile Dir - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Windows Application Layer Protocol RMS Radmin Tool Namedpipe - Rule", "ESCU - Windows Defender Exclusion Registry Entry - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Gather Victim Network Info Through Ip Check Web Services - Rule", "ESCU - Windows Impair Defense Add Xml Applocker Rules - Rule", "ESCU - Windows Impair Defense Deny Security Software With Applocker - Rule", "ESCU - Windows Modify Registry Disable Toast Notifications - Rule", "ESCU - Windows Modify Registry Disable Win Defender Raw Write Notif - Rule", "ESCU - Windows Modify Registry Disable Windows Security Center Notif - Rule", "ESCU - Windows Modify Registry Disabling WER Settings - Rule", "ESCU - Windows Modify Registry DisAllow Windows App - Rule", "ESCU - Windows Modify Registry Regedit Silent Reg Import - Rule", "ESCU - Windows Modify Registry Suppress Win Defender Notif - Rule", "ESCU - Windows Powershell Import Applocker Policy - Rule", "ESCU - Windows Remote Access Software RMS Registry - Rule", "ESCU - Windows Remote Service Rdpwinst Tool Execution - Rule", "ESCU - Windows Remote Services Allow Rdp In Firewall - Rule", "ESCU - Windows Remote Services Allow Remote Assistance - Rule", "ESCU - Windows Remote Services Rdp Enable - Rule", "ESCU - Windows Service Stop By Deletion - Rule", "ESCU - Windows Valid Account With Never Expires Password - Rule", "ESCU - Wmic NonInteractive App Uninstallation - Rule"]
+description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Azorult malware including firewall modification, icacl execution, spawning more process, botnet c2 communication, defense evasion and etc. The AZORULT malware was first discovered in 2016 to be an information stealer that steals browsing history, cookies, ID/passwords, cryptocurrency information and more. It can also be a downloader of other malware. A variant of this malware was able to create a new, hidden administrator account on the machine to set a registry key to establish a Remote Desktop Protocol (RDP) connection. Exploit kits such as Fallout Exploit Kit (EK) and phishing mails with social engineering technique are one of the major infection vectors of the AZORult malware. The current malspam and phishing emails use fake product order requests, invoice documents and payment information requests. This Trojan-Spyware connects to command and control (C&C) servers of attacker to send and receive information.
+narrative = Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption is the goal.
+
 [analytic_story://Baron Samedit CVE-2021-3156]
 category = Adversary Tactics
 last_updated = 2021-01-27
@@ -9729,7 +9990,7 @@ version = 1
 references = ["https://github.com/splunk/cloud-datamodel-security-research"]
 maintainers = [{"company": "Rico Valdez, Splunk", "email": "-", "name": "Rod Soto"}]
 spec_version = 3
-searches = ["ESCU - GCP GCR container uploaded - Rule", "ESCU - New container uploaded to AWS ECR - Rule"]
+searches = []
 description = Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company's repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry.
 narrative = Container Registrys provide a way for organizations to keep customized images of their development and infrastructure environment in private. However if these repositories are misconfigured or priviledge users credentials are compromise, attackers can potentially upload implanted containers which can be deployed across the organization. These searches allow operator to monitor who, when and what was uploaded to container registry.
 
@@ -9974,7 +10235,7 @@ Suspicious activities--spikes in SMB traffic, processes that launch netsh (to mo
 category = Adversary Tactics
 last_updated = 2020-02-04
 version = 2
-references = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"]
+references = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://web.archive.org/web/20220425194457/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
 spec_version = 3
 searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
@@ -10143,7 +10404,7 @@ narrative = Hermetic Wiper is destructive malware operation found by Sentinel On
 category = Malware
 last_updated = 2020-01-22
 version = 2
-references = ["https://web.archive.org/web/20191220004307/https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"]
+references = ["https://web.archive.org/web/20191220004307/https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://web.archive.org/web/20220421112536/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
 spec_version = 3
 searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - Create or delete windows shares using net exe - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"]
@@ -10284,7 +10545,7 @@ version = 2
 references = ["https://lolbas-project.github.io/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}]
 spec_version = 3
-searches = ["ESCU - BITS Job Persistence - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - CertUtil With Decode Argument - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Control Loading from World Writable Directory - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regsvcs with Network Connection - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - MacOS LOLbin - Rule", "ESCU - MacOS plutil - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Rundll32 Shimcache Flush - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious microsoft workflow compiler usage - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Windows Diskshadow Proxy Execution - Rule", "ESCU - Windows Indirect Command Execution Via forfiles - Rule", "ESCU - Windows Indirect Command Execution Via pcalua - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows InstallUtil Remote Network Connection - Rule", "ESCU - Windows InstallUtil Uninstall Option - Rule", "ESCU - Windows InstallUtil Uninstall Option with Network - Rule", "ESCU - Windows InstallUtil URL in Command Line - Rule", "ESCU - WSReset UAC Bypass - Rule"]
+searches = ["ESCU - BITS Job Persistence - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - CertUtil With Decode Argument - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Control Loading from World Writable Directory - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regsvcs with Network Connection - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Living Off The Land - Rule", "ESCU - MacOS LOLbin - Rule", "ESCU - MacOS plutil - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Rundll32 Shimcache Flush - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious microsoft workflow compiler usage - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Windows Binary Proxy Execution Mavinject DLL Injection - Rule", "ESCU - Windows Diskshadow Proxy Execution - Rule", "ESCU - Windows Identify Protocol Handlers - Rule", "ESCU - Windows Indirect Command Execution Via forfiles - Rule", "ESCU - Windows Indirect Command Execution Via pcalua - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows InstallUtil Remote Network Connection - Rule", "ESCU - Windows InstallUtil Uninstall Option - Rule", "ESCU - Windows InstallUtil Uninstall Option with Network - Rule", "ESCU - Windows InstallUtil URL in Command Line - Rule", "ESCU - Windows MOF Event Triggered Execution via WMI - Rule", "ESCU - Windows Odbcconf Hunting - Rule", "ESCU - Windows Odbcconf Load DLL - Rule", "ESCU - Windows Odbcconf Load Response File - Rule", "ESCU - WSReset UAC Bypass - Rule"]
 description = Leverage analytics that allow you to identify the presence of an adversary leveraging native applications within your environment.
 narrative = Living Off The Land refers to an adversary methodology of using native applications already installed on the target operating system to achieve their objective. Native utilities provide the adversary with reduced chances of detection by antivirus software or EDR tools. This allows the adversary to blend in with native process behavior.
 
@@ -10317,7 +10578,7 @@ version = 5
 references = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Suspicious Powershell Command-Line Arguments - Rule", "ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - PowerShell 4104 Hunting - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - PowerShell Loading DotNET into Memory via Reflection - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Suspicious Powershell Command-Line Arguments - Rule", "ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - GetLocalUser with PowerShell Script Block - Rule", "ESCU - GetWmiObject User Account with PowerShell Script Block - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - PowerShell 4104 Hunting - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - PowerShell Loading DotNET into Memory via Reflection - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - ServicePrincipalNames Discovery with PowerShell - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
 narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope. \
 The following factors may assist you in determining whether the event is malicious: \
@@ -10707,7 +10968,7 @@ version = 1
 references = ["https://www.splunk.com/en_us/product-security/announcements.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}]
 spec_version = 3
-searches = ["ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"]
+searches = ["ESCU - Detect Risky SPL using Pretrained ML Model - Rule", "ESCU - Path traversal SPL injection - Rule", "ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule", "ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule", "ESCU - Splunk Digital Certificates Infrastructure Version - Rule", "ESCU - Splunk Digital Certificates Lack of Encryption - Rule", "ESCU - Splunk DoS via Malformed S2S Request - Rule", "ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule", "ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule", "ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule", "ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule", "ESCU - Splunk User Enumeration Attempt - Rule", "ESCU - Splunk XSS in Monitoring Console - Rule", "ESCU - Open Redirect in Splunk Web - Rule", "ESCU - Splunk Enterprise Information Disclosure - Rule", "ESCU - Splunk Identified SSL TLS Certificates - Rule"]
 description = Keeping your Splunk Enterprise deployment up to date is critical and will help you reduce the risk associated with vulnerabilities in the product.
 narrative = This analytic story includes detections that focus on attacker behavior targeted at your Splunk environment directly.
 
diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf
index 153febcd43..99106908db 100644
--- a/dist/escu/default/app.conf
+++ b/dist/escu/default/app.conf
@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 8568
+build = 9041
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 3.44.0
+version = 3.45.0
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]
diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf
index fe94cd16c4..1a53a08c84 100644
--- a/dist/escu/default/collections.conf
+++ b/dist/escu/default/collections.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-06-29T20:42:24 UTC
+# On Date: 2022-07-19T21:28:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf
index ca4a969ff9..82ced8506f 100644
--- a/dist/escu/default/content-version.conf
+++ b/dist/escu/default/content-version.conf
@@ -1,2 +1,2 @@
 [content-version]
-version = 3.44.0
+version = 3.45.0
diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf
index 3326807403..3e7f5e012d 100644
--- a/dist/escu/default/es_investigations.conf
+++ b/dist/escu/default/es_investigations.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-06-29T20:42:24 UTC
+# On Date: 2022-07-19T21:28:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf
index ce9c95c03f..45e6da488c 100644
--- a/dist/escu/default/macros.conf
+++ b/dist/escu/default/macros.conf
@@ -1,10 +1,14 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-06-29T20:42:24 UTC
+# On Date: 2022-07-19T21:28:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
 
+[detect_risky_spl_using_pretrained_ml_model_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [path_traversal_spl_injection_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -497,10 +501,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[gcp_gcr_container_uploaded_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 [gcp_kubernetes_cluster_scan_detection_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -1841,6 +1841,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[living_off_the_land_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [loading_of_dynwrapx_module_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -2777,6 +2781,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_application_layer_protocol_rms_radmin_tool_namedpipe_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_binary_proxy_execution_mavinject_dll_injection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_command_and_scripting_interpreter_hunting_path_traversal_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -2893,6 +2905,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_gather_victim_network_info_through_ip_check_web_services_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_get_adcomputer_unconstrained_delegation_discovery_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -2913,6 +2929,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_identify_protocol_handlers_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_impair_defense_add_xml_applocker_rules_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_impair_defense_delete_win_defender_context_menu_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -2921,6 +2945,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_impair_defense_deny_security_software_with_applocker_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_impair_defenses_disable_win_defender_auto_logging_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -2977,10 +3005,42 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_modify_registry_disable_toast_notifications_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_modify_registry_disable_win_defender_raw_write_notif_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_modify_registry_disable_windows_security_center_notif_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_modify_registry_disabling_wer_settings_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_modify_registry_disallow_windows_app_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_modify_registry_regedit_silent_reg_import_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_modify_registry_suppress_win_defender_notif_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_modify_show_compress_color_and_info_tip_registry_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_mof_event_triggered_execution_via_wmi_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_msiexec_dllregisterserver_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3013,6 +3073,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_odbcconf_hunting_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_odbcconf_load_dll_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_odbcconf_load_response_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_office_product_spawning_msdt_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3021,6 +3093,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_powershell_import_applocker_policy_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_powerview_constrained_delegation_discovery_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3073,10 +3149,30 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_remote_access_software_rms_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_remote_assistance_spawning_process_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_remote_service_rdpwinst_tool_execution_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_remote_services_allow_rdp_in_firewall_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_remote_services_allow_remote_assistance_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_remote_services_rdp_enable_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_root_domain_linked_policies_discovery_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3113,6 +3209,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_service_stop_by_deletion_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_system_file_on_disk_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3125,6 +3225,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_valid_account_with_never_expires_password_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_wmi_process_call_create_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3337,10 +3441,6 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
-[new_container_uploaded_to_aws_ecr_filter]
-definition = search *
-description = Update this macro to limit the output results to filter out false positives.
-
 [child_processes_of_spoolsv_exe_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf
index 8bdaa4d76e..739ac56e52 100644
--- a/dist/escu/default/savedsearches.conf
+++ b/dist/escu/default/savedsearches.conf
@@ -1,11 +1,51 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-06-29T20:42:24 UTC
+# On Date: 2022-07-19T21:28:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
 ### ESCU DETECTIONS ###
 
+[ESCU - Detect Risky SPL using Pretrained ML Model - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic uses a pretrained machine learning text classifier to detect potentially risky commands. The model is trained independently and then the model file is packaged within ESCU for usage. A command is deemed risky based on the presence of certain trigger keywords, along with the context and the role of the user (please see references). The model uses custom features to predict whether a SPL is risky using text classification. The model takes as input the command text, user and search type and outputs a risk score between [0,1]. A high score indicates higher likelihood of a command being risky. This model is on-prem only.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.AE"]}
+action.escu.data_models = ["Splunk_Audit"]
+action.escu.eli5 = The following analytic uses a pretrained machine learning text classifier to detect potentially risky commands. The model is trained independently and then the model file is packaged within ESCU for usage. A command is deemed risky based on the presence of certain trigger keywords, along with the context and the role of the user (please see references). The model uses custom features to predict whether a SPL is risky using text classification. The model takes as input the command text, user and search type and outputs a risk score between [0,1]. A high score indicates higher likelihood of a command being risky. This model is on-prem only.
+action.escu.how_to_implement = This detection depends on the MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need to be ingesting logs which include Search_Activity.search, Search_Activity.user, Search_Activity.search_type from your endpoints. The risk score threshold should be adjusted based on the environment. The detection uses a custom MLTK model hence we need a few more steps for deployment, as outlined here - https://gist.github.com/ksharad-splunk/be2a62227966049047f5e5c4f2adcabb.
+action.escu.known_false_positives = False positives may be present if suspicious behavior is observed, as determined by frequent usage of risky keywords.
+action.escu.creation_date = 2022-06-16
+action.escu.modification_date = 2022-06-16
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Detect Risky SPL using Pretrained ML Model - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Splunk Vulnerabilities"]
+action.risk = 1
+action.risk.param._risk_message = A potentially risky Splunk command has been run by $user$, kindly review.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 20}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Detect Risky SPL using Pretrained ML Model - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Splunk Vulnerabilities"], "cis20": ["CIS 3", "CIS 6"], "confidence": 40, "context": ["Source:Endpoint"], "cve": ["CVE-2022-32154"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1059"], "nist": ["DE.AE"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.user Search_Activity.search_type | eval spl_text = 'Search_Activity.search'. " " .'Search_Activity.user'. " " .'Search_Activity.search_type'| dedup spl_text | apply risky_spl_pre_trained_model | where risk_score > 0.5 | `drop_dm_object_name(Search_Activity)` | table search, user, search_type, risk_score | `detect_risky_spl_using_pretrained_ml_model_filter`
+
 [ESCU - Path traversal SPL injection - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -21,7 +61,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Path traversal SPL injection - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Splunk Vulnerabilities"]
 action.risk = 1
 action.risk.param._risk_message = Path traversal exploitation attempt from $clientip$
@@ -67,7 +107,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Splunk Command and Scripting Interpreter Delete Usage - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Splunk Vulnerabilities"]
 action.risk = 1
 action.risk.param._risk_message = $user$ executed the 'delete' command, if this is unexpected it should be reviewed.
@@ -107,7 +147,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Splunk Command and Scripting Interpreter Risky Commands - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Splunk Vulnerabilities"]
 action.risk = 1
 action.risk.param._risk_message = A risky Splunk command has ran by $user$ and should be reviewed.
@@ -147,7 +187,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Splunk Command and Scripting Interpreter Risky SPL MLTK - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Splunk Vulnerabilities"]
 action.risk = 1
 action.risk.param._risk_message = Abnormally long run time for risk SPL command seen by user $(Search_Activity.user).
@@ -187,7 +227,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Splunk Digital Certificates Infrastructure Version - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Splunk Vulnerabilities"]
 action.risk = 1
 action.risk.param._risk_message = $splunk_server$ may not be properly validating TLS Certificates
@@ -227,7 +267,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Splunk Digital Certificates Lack of Encryption - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Splunk Vulnerabilities"]
 action.risk = 1
 action.risk.param._risk_message = $hostname$ is not using TLS when forwarding data
@@ -267,7 +307,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Splunk DoS via Malformed S2S Request - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Splunk Vulnerabilities"]
 action.risk = 1
 action.risk.param._risk_message = An attempt to exploit CVE-2021-3422 was detected from $src$ against $host$
@@ -313,7 +353,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Splunk Process Injection Forwarder Bundle Downloads - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Splunk Vulnerabilities"]
 action.risk = 1
 action.risk.param._risk_message = $peer$ downloaded apps from $host$
@@ -353,7 +393,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Splunk Protocol Impersonation Weak Encryption Configuration - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Splunk Vulnerabilities"]
 action.risk = 1
 action.risk.param._risk_message = $splunk_server$ may not be properly validating TLS Certificates
@@ -393,7 +433,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Splunk protocol impersonation weak encryption selfsigned - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Splunk Vulnerabilities"]
 action.risk = 1
 action.risk.param._risk_message = Splunk default issued certificate at $host$
@@ -433,7 +473,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Splunk protocol impersonation weak encryption simplerequest - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Splunk Vulnerabilities"]
 action.risk = 1
 action.risk.param._risk_message = Failed to validate certificate on $host$
@@ -473,7 +513,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Splunk User Enumeration Attempt - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Splunk Vulnerabilities"]
 action.risk = 1
 action.risk.param._risk_message = $TotalFailedAuths$ failed authentication events to Splunk from $src$ detected.
@@ -519,7 +559,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Splunk XSS in Monitoring Console - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Splunk Vulnerabilities"]
 action.risk = 1
 action.risk.param._risk_message = A potential XSS attempt has been detected from $user$
@@ -565,7 +605,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.risk = 1
 action.risk.param._risk_message = user $user$ has made $api_calls$ api calls, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$.
@@ -605,7 +645,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.risk = 1
 action.risk.param._risk_message = user $user$ has made $api_calls$ api calls related to security groups, violating the dynamic threshold of $expected_upper_threshold$ with the following command $command$.
@@ -645,7 +685,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS Create Policy Version to allow all resources - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ created a policy version that allows them to access any resource in their account.
@@ -691,7 +731,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS CreateAccessKey - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
 action.risk.param._risk_message = User $user_arn$ is attempting to create access keys for $requestParameters.userName$ from this IP $src$
@@ -731,7 +771,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS CreateLoginProfile - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
 action.risk.param._risk_message = User $user_arn$ is attempting to create a login profile for $requestParameters.userName$ and did a console login from this IP $src_ip$
@@ -777,7 +817,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
 action.risk = 1
 action.risk.param._risk_message = AWS account $requestingAccountId$ is trying to access resource from some other account $requestedAccountId$, for the first time.
@@ -817,7 +857,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Ransomware Cloud"]
 action.risk = 1
 action.risk.param._risk_message = AWS account is potentially compromised and user $userIdentity.principalId$ is trying to compromise other accounts.
@@ -863,7 +903,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Ransomware Cloud"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ with KMS keys is performing encryption, against S3 buckets on these files $dest_file$
@@ -903,7 +943,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings High - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = Vulnerabilities with severity high found in image $image$
@@ -949,7 +989,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings Low Informational Unknown - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = Vulnerabilities with severity high found in repository $repositoryName$
@@ -989,7 +1029,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS ECR Container Scanning Findings Medium - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = Vulnerabilities with severity high found in image $image$
@@ -1029,7 +1069,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS ECR Container Upload Outside Business Hours - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = Container uploaded outside business hours from $user$
@@ -1069,7 +1109,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS ECR Container Upload Unknown User - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = Container uploaded from unknown user $user$
@@ -1109,7 +1149,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS Excessive Security Scanning - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.risk = 1
 action.risk.param._risk_message = user $user$ has excessive number of api calls $dc_events$ from these IP addresses $src$, violating the threshold of 50,  using the following commands $command$.
@@ -1155,7 +1195,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS IAM AccessDenied Discovery Events - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.risk = 1
 action.risk.param._risk_message = User $userIdentity.arn$ is seen to perform excessive number of discovery related api calls- $failures$, within an hour where the access was denied.
@@ -1195,7 +1235,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS IAM Assume Role Policy Brute Force - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
 action.risk.param._risk_message = User $user_arn$ has caused multiple failures with errorCode $errorCode$, which potentially means adversary is attempting to identify a role name.
@@ -1241,7 +1281,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS IAM Delete Policy - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
 action.risk.param._risk_message = User $user_arn$ has deleted AWS Policies from IP address $src$ by executing the following command $eventName$
@@ -1281,7 +1321,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS IAM Failure Group Deletion - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
 action.risk.param._risk_message = User $user_arn$ has had mulitple failures while attempting to delete groups from $src$
@@ -1321,7 +1361,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS IAM Successful Group Deletion - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
 action.risk.param._risk_message = User $user_arn$ has sucessfully deleted mulitple groups $group_deleted$ from $src$
@@ -1361,7 +1401,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS Lambda UpdateFunctionCode - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.risk = 1
 action.risk.param._risk_message = User $user_arn$ is attempting to update the lambda function code of $function_updated$ from this IP $src_ip$
@@ -1401,7 +1441,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS Network Access Control List Created with All Open Ports - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS Network ACL Activity"]
 action.risk = 1
 action.risk.param._risk_message = User $user_arn$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$
@@ -1447,7 +1487,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS Network Access Control List Deleted - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS Network ACL Activity"]
 action.risk = 1
 action.risk.param._risk_message = User $user_arn$ from $src$ has sucessfully deleted network ACLs entry (eventName= $eventName$), such that the instance is accessible from anywhere
@@ -1487,7 +1527,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS SAML Access by Provider User and Principal - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Cloud Federated Credential Abuse"]
 action.risk = 1
 action.risk.param._risk_message = From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for account ID $recipientAccountId$
@@ -1527,7 +1567,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS SAML Update identity provider - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Cloud Federated Credential Abuse"]
 action.risk = 1
 action.risk.param._risk_message = User $userIdentity.principalId$ from IP address $sourceIPAddress$ has trigged an event $eventName$ to update the SAML provider to $requestParameters.sAMLProviderArn$
@@ -1573,7 +1613,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS SetDefaultPolicyVersion - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
 action.risk.param._risk_message = From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the the default policy version
@@ -1619,7 +1659,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS UpdateLoginProfile - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS IAM Privilege Escalation"]
 action.risk = 1
 action.risk.param._risk_message = From IP address $sourceIPAddress$, user agent $userAgent$ has trigged an event $eventName$ for updating the existing login profile, potentially giving user $user_arn$ more access privilleges
@@ -1665,7 +1705,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Circle CI Disable Security Job - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = disable security job $mandatory_job$ in workflow $workflow_name$ from user $user$
@@ -1705,7 +1745,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Circle CI Disable Security Step - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = disable security step $mandatory_step$ in job $job_name$ from user $user$
@@ -1745,7 +1785,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Cloud API Calls From Previously Unseen User Roles - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Cloud User Activities"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ of type AssumedRole attempting to execute new API calls $command$ that have not been seen before
@@ -1785,7 +1825,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ is creating a new instance $dest$ for the first time
@@ -1825,7 +1865,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ is creating an instance $dest$ in a new region for the first time
@@ -1865,7 +1905,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ is creating an instance $dest$ with an image that has not been previously seen.
@@ -1905,7 +1945,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Cloud Cryptomining"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ is creating an instance $dest$ with an instance type $instance_type$ that has not been previously seen.
@@ -1945,7 +1985,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Cloud Instance Modified By Previously Unseen User - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ is modifying an instance $dest$ for the first time.
@@ -1986,7 +2026,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ is starting or creating an instance $dest$ for the first time in City $City$ from IP address $src$
@@ -2027,7 +2067,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ is starting or creating an instance $object$ for the first time in Country $Country$ from IP address $src$
@@ -2068,7 +2108,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ is starting or creating an instance $object_id$ for the first time from IP address $src$
@@ -2109,7 +2149,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ is starting or creating an instance $object$ for the first time in region $Region$ from IP address $src$
@@ -2149,7 +2189,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Correlation by Repository and Risk - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = Correlation triggered for user $user$
@@ -2195,7 +2235,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Correlation by User and Risk - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = Correlation triggered for user $user$
@@ -2241,7 +2281,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect AWS Console Login by New User - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ is logging into the AWS console for the first time
@@ -2281,7 +2321,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect AWS Console Login by User from New City - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ is logging into the AWS console from City $City$ for the first time
@@ -2321,7 +2361,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect AWS Console Login by User from New Country - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ is logging into the AWS console from Country $Country$ for the first time
@@ -2361,7 +2401,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect AWS Console Login by User from New Region - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ is logging into the AWS console from Region $Region$ for the first time
@@ -2401,7 +2441,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect New Open S3 buckets - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
 action.risk = 1
 action.risk.param._risk_message = User $user_arn$ has created an open/public bucket $bucketName$ with the following permissions $permission$
@@ -2447,7 +2487,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
 action.risk = 1
 action.risk.param._risk_message = User $userIdentity.userName$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$
@@ -2493,7 +2533,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect shared ec2 snapshot - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Suspicious Cloud Instance Activities", "Data Exfiltration"]
 action.risk = 1
 action.risk.param._risk_message = AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$ by user $user_arn$ from $src_ip$
@@ -2539,7 +2579,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["AWS Security Hub Alerts"]
 action.risk = 1
 action.risk.param._risk_message = Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$
@@ -2579,7 +2619,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GitHub Actions Disable Security Workflow - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = Security Workflow is disabled in branch $branch$ for repository $repository$
@@ -2619,7 +2659,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Github Commit Changes In Master - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = suspicious commit by $commit.commit.author.email$ to main branch
@@ -2659,7 +2699,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Github Commit In Develop - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = suspicious commit by $commit.commit.author.email$ to develop branch
@@ -2699,7 +2739,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GitHub Dependabot Alert - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = Vulnerabilities found in packages used by GitHub repository $repository$
@@ -2739,7 +2779,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GitHub Pull Request from Unknown User - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = Vulnerabilities found in packages used by GitHub repository $repository$
@@ -2779,7 +2819,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Gsuite Drive Share In External Email - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops", "Insider Threat"]
 action.risk = 1
 action.risk.param._risk_message = suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
@@ -2819,7 +2859,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GSuite Email Suspicious Attachment - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
@@ -2859,7 +2899,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Gsuite Email Suspicious Subject With Attachment - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
@@ -2899,7 +2939,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Gsuite Email With Known Abuse Web Service Link - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
@@ -2939,7 +2979,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Gsuite Outbound Email With Attachment To External Domain - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops", "Insider Threat"]
 action.risk = 1
 action.risk.param._risk_message = suspicious email from $source.address$ to $destination{}.address$
@@ -2979,7 +3019,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Gsuite Suspicious Shared File Name - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
@@ -3019,7 +3059,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes Nginx Ingress LFI - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = Local File Inclusion Attack detected on $host$
@@ -3065,7 +3105,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes Nginx Ingress RFI - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = Remote File Inclusion Attack detected on $host$
@@ -3111,7 +3151,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes Scanner Image Pulling - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops"]
 action.risk = 1
 action.risk.param._risk_message = Kubernetes Scanner image pulled on host $host$
@@ -3157,7 +3197,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - O365 Add App Role Assignment Grant User - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"]
 action.risk = 1
 action.risk.param._risk_message = User $Actor.ID$ has created a new federation setting on $dest$ from IP Address $ActorIpAddress$
@@ -3203,7 +3243,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - O365 Added Service Principal - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"]
 action.risk = 1
 action.risk.param._risk_message = User $Actor.ID$ created a new federation setting on $Target.ID$ and added service principal credentials from IP Address $ActorIpAddress$
@@ -3249,7 +3289,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - O365 Bypass MFA via Trusted IP - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Office 365 Detections"]
 action.risk = 1
 action.risk.param._risk_message = User $user_id$ has added new IP addresses $ip_addresses_new_added$ to a list of trusted IPs to bypass MFA
@@ -3295,7 +3335,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - O365 Disable MFA - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Office 365 Detections"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ has executed an operation $Operation$ for this destination $dest$
@@ -3341,7 +3381,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - O365 Excessive Authentication Failures Alert - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Office 365 Detections"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ has caused excessive number of authentication failures from $src_ip$ using UserAgent $UserAgent$.
@@ -3381,7 +3421,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - O365 Excessive SSO logon errors - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"]
 action.risk = 1
 action.risk.param._risk_message = User $UserId$ has caused excessive number of SSO logon errors from $ActorIpAddress$ using UserAgent $UserAgent$.
@@ -3421,7 +3461,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - O365 New Federated Domain Added - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"]
 action.risk = 1
 action.risk.param._risk_message = User $UserId$ has added a new federated domaain $Parameters.Value$ for $OrganizationName$
@@ -3467,7 +3507,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - O365 PST export alert - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"]
 action.risk = 1
 action.risk.param._risk_message = User $Source$ has exported a PST file from the search using this operation- $Operation$ with a severity of $Severity$
@@ -3513,7 +3553,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - O365 Suspicious Admin Email Forwarding - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ has configured a forwarding rule for multiple mailboxes to the same destination $ForwardingAddress$
@@ -3553,7 +3593,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - O365 Suspicious Rights Delegation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Office 365 Detections"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ has delegated suspicious rights $AccessRights$ to user $dest_user$ that allow access to sensitive
@@ -3599,7 +3639,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - O365 Suspicious User Email Forwarding - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ configured multiple users $src_user$ with a count of $count_src_user$, a forwarding rule to same destination $ForwardingSmtpAddress$
@@ -3639,7 +3679,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Abnormally High AWS Instances Launched by User - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -3679,7 +3719,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Abnormally High AWS Instances Launched by User - MLTK - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -3719,7 +3759,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Abnormally High AWS Instances Terminated by User - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Suspicious AWS EC2 Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -3759,7 +3799,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Abnormally High AWS Instances Terminated by User - MLTK - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Suspicious AWS EC2 Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -3800,7 +3840,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -3841,7 +3881,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -3882,7 +3922,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -3923,7 +3963,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS Cloud Provisioning From Previously Unseen Region - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -3965,7 +4005,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Clients Connecting to Multiple DNS Servers - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["DNS Hijacking", "Suspicious DNS Traffic", "Host Redirection", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4011,7 +4051,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Cloud Network Access Control List Deleted - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Cloud Network ACL Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4057,7 +4097,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect API activity from users without MFA - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4103,7 +4143,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect AWS API Activities From Unapproved Accounts - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4147,7 +4187,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Common Phishing Frameworks"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4193,7 +4233,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Long DNS TXT Record Response - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious DNS Traffic", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4239,7 +4279,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Cloud Federated Credential Abuse"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4285,7 +4325,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect new API calls from user roles - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4325,7 +4365,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect new user AWS Console Login - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Suspicious AWS Login Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4371,7 +4411,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Spike in AWS API Activity - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4411,7 +4451,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Spike in Network ACL Activity - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS Network ACL Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4451,7 +4491,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Spike in Security Group Activity - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS User Monitoring"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4491,7 +4531,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect USB device insertion - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Data Protection"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4539,7 +4579,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect web traffic to dynamic domain providers - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dynamic DNS"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4587,7 +4627,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detection of DNS Tunnels - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Data Protection", "Suspicious DNS Traffic", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4634,7 +4674,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["DNS Hijacking", "Suspicious DNS Traffic", "Host Redirection", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4684,7 +4724,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - DNS record changed - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["DNS Hijacking"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4732,7 +4772,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Dump LSASS via procdump Rename - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"]
 action.risk = 1
 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$, attempting to dump lsass.exe.
@@ -4772,7 +4812,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - EC2 Instance Modified With Previously Unseen User - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Unusual AWS EC2 Modifications"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4812,7 +4852,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - EC2 Instance Started In Previously Unseen Region - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4852,7 +4892,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - EC2 Instance Started With Previously Unseen AMI - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS Cryptomining"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4892,7 +4932,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - EC2 Instance Started With Previously Unseen Instance Type - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS Cryptomining"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4932,7 +4972,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - EC2 Instance Started With Previously Unseen User - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -4972,7 +5012,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Execution of File With Spaces Before Extension - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows File Extension and Association Abuse", "Masquerading - Rename System Utilities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5018,7 +5058,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Extended Period Without Successful Netbackup Backups - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Monitor Backup Solution"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5058,7 +5098,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - First time seen command line argument - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["DHS Report TA18-074A", "Suspicious Command-Line Executions", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Hidden Cobra Malware"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5098,7 +5138,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GCP Detect accounts with high risk roles by project - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["GCP Cross Account Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5138,7 +5178,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GCP Detect high risk permissions by resource and account - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["GCP Cross Account Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5178,7 +5218,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - gcp detect oauth token abuse - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["GCP Cross Account Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5203,46 +5243,6 @@ realtime_schedule = 0
 is_visible = false
 search = `google_gcp_pubsub_message` type.googleapis.com/google.cloud.audit.AuditLog |table protoPayload.@type protoPayload.status.details{}.@type protoPayload.status.details{}.violations{}.callerIp protoPayload.status.details{}.violations{}.type protoPayload.status.message  | `gcp_detect_oauth_token_abuse_filter`
 
-[ESCU - GCP GCR container uploaded - Rule]
-action.escu = 0
-action.escu.enabled = 1
-description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search show information on uploaded containers including source user, account, action, bucket name event name, http user agent, message and destination path. 
-action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1525"]}
-action.escu.data_models = []
-action.escu.eli5 = This search show information on uploaded containers including source user, account, action, bucket name event name, http user agent, message and destination path.
-action.escu.how_to_implement = You must install the GCP App for Splunk (version 2.0.0 or later), then configure stackdriver and set a subpub subscription to be imported to Splunk. You must also install Cloud Infrastructure data model. Please also customize the `container_implant_gcp_detection_filter` macro to filter out the false positives.
-action.escu.known_false_positives = Uploading container is a normal behavior from developers or users with access to container registry. GCP GCR registers container upload as a Storage event, this search must be considered under the context of CONTAINER upload creation which automatically generates a bucket entry for destination path.
-action.escu.creation_date = 2020-02-20
-action.escu.modification_date = 2020-02-20
-action.escu.confidence = high
-action.escu.full_search_name = ESCU - GCP GCR container uploaded - Rule
-action.escu.search_type = detection
-action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Container Implantation Monitoring and Investigation"]
-action.risk = 1
-action.risk.param._risk_message = tbd
-action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}]
-action.risk.param._risk_score = 0
-action.risk.param.verbose = 0
-cron_schedule = 0 * * * *
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
-action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Deprecated - GCP GCR container uploaded - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Container Implantation Monitoring and Investigation"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1525"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]}
-schedule_window = auto
-alert.digest_mode = 1
-disabled = true
-enableSched = 1
-allow_skew = 100%
-counttype = number of events
-relation = greater than
-quantity = 0
-realtime_schedule = 0
-is_visible = false
-search = |tstats count min(_time) as firstTime max(_time) as lastTime  FROM datamodel=Cloud_Infrastructure.Storage where Storage.event_name=storage.objects.create by Storage.src_user Storage.account Storage.action Storage.bucket_name Storage.event_name Storage.http_user_agent Storage.msg Storage.object_path | `drop_dm_object_name("Storage")`  | `gcp_gcr_container_uploaded_filter` 
-
 [ESCU - GCP Kubernetes cluster scan detection - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -5258,7 +5258,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GCP Kubernetes cluster scan detection - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Scanning Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5304,7 +5304,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Identify New User Accounts - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Account Monitoring and Controls"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5344,7 +5344,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes AWS detect most active service accounts by pod - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5384,7 +5384,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes AWS detect RBAC authorization by account - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5424,7 +5424,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5464,7 +5464,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes AWS detect sensitive role access - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5504,7 +5504,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5544,7 +5544,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes Azure active service accounts by pod namespace - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5584,7 +5584,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes Azure detect RBAC authorization by account - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5624,7 +5624,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes Azure detect sensitive object access - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5664,7 +5664,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes Azure detect sensitive role access - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5704,7 +5704,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5744,7 +5744,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5784,7 +5784,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes Azure pod scan fingerprint - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Scanning Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5824,7 +5824,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes Azure scan fingerprint - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Scanning Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5864,7 +5864,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5904,7 +5904,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes GCP detect most active service accounts by pod - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5944,7 +5944,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes GCP detect sensitive object access - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -5984,7 +5984,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes GCP detect sensitive role access - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6024,7 +6024,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6064,7 +6064,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6104,7 +6104,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Monitor DNS For Brand Abuse - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Brand Monitoring"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6150,7 +6150,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Open Redirect in Splunk Web - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Splunk Vulnerabilities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6196,7 +6196,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Osquery pack - ColdRoot detection - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["ColdRoot MacOS RAT"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6242,7 +6242,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Processes created by netsh - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Netsh Abuse"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6288,7 +6288,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Prohibited Software On Endpoint - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Monitor for Unauthorized Software", "Emotet Malware  DHS Report TA18-201A ", "SamSam Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6328,7 +6328,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Reg exe used to hide files directories via registry keys - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Windows Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6374,7 +6374,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote Registry Key modifications - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Windows Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6420,7 +6420,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Scheduled tasks used in BadRabbit ransomware - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6466,7 +6466,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Spectre and Meltdown Vulnerable Systems - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Spectre And Meltdown Vulnerabilities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6512,7 +6512,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Splunk Enterprise Information Disclosure - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Splunk Vulnerabilities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6558,7 +6558,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Changes to File Associations - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows File Extension and Association Abuse"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6604,7 +6604,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Email - UBA Anomaly - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Emails"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6644,7 +6644,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious File Write - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Hidden Cobra Malware"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6684,7 +6684,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Powershell Command-Line Arguments - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Malicious PowerShell", "Hermetic Wiper"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6730,7 +6730,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Rundll32 Rename - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Masquerading - Rename System Utilities"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious renamed rundll32.exe binary ran on $dest$ by $user$
@@ -6770,7 +6770,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious writes to System Volume Information - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Collection and Staging"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6810,7 +6810,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Uncommon Processes On Endpoint - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Privilege Escalation", "Unusual Processes", "Hermetic Wiper"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6850,7 +6850,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Unsigned Image Loaded by LSASS - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6896,7 +6896,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Unsuccessful Netbackup backups - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Monitor Backup Solution"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6936,7 +6936,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Web Fraud - Account Harvesting - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Web Fraud Detection"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -6982,7 +6982,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Web Fraud - Anomalous User Clickspeed - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Web Fraud Detection"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -7022,7 +7022,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Web Fraud - Password Sharing Across Accounts - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Web Fraud Detection"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -7062,7 +7062,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows connhost exe started forcefully - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Ryuk Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -7108,7 +7108,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows hosts file modification - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Host Redirection"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -7154,7 +7154,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - 7zip CommandLine To SMB Share Path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = archive process $process_name$ with suspicious cmdline $process$ in host $dest$
@@ -7194,7 +7194,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Access LSASS Memory for Dump Creation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
 action.risk.param._risk_message = process $SourceImage$ injected into $TargetImage$ and was attempted dump LSASS on $dest$. Adversaries tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
@@ -7240,7 +7240,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Account Discovery With Net App - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Trickbot", "IcedID"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious $process_name$ usage detected on endpoint $dest$ by user $user$.
@@ -7286,7 +7286,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Active Setup Registry Autostart - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Persistence Techniques", "Windows Privilege Escalation", "Hermetic Wiper"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$
@@ -7332,7 +7332,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Add DefaultUser And Password In Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["BlackMatter Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon
@@ -7372,7 +7372,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Add or Set Windows Defender Exclusion - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Remcos", "Windows Defense Evasion Tactics", "WhisperGate"]
 action.risk = 1
 action.risk.param._risk_message = exclusion command $process$ executed on $dest$
@@ -7418,7 +7418,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - AdsiSearcher Account Discovery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Industroyer2", "Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = powershell process having commandline $Message$ for user enumeration
@@ -7464,7 +7464,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Allow File And Printing Sharing In Firewall - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = 
@@ -7504,17 +7504,17 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
 action.escu.known_false_positives = network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered.
-action.escu.creation_date = 2022-01-26
-action.escu.modification_date = 2022-01-26
+action.escu.creation_date = 2022-07-19
+action.escu.modification_date = 2022-07-19
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Windows Registry Abuse"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
-action.risk.param._risk_message = Suspicious firewall modifications were detected via the registry on endpoint $dest$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 3}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 3}]
+action.risk.param._risk_message = Suspicious firewall allow rule modifications were detected via the registry on endpoint $dest$ by user $user$.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -7522,7 +7522,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Windows Registry Abuse"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 10, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Windows Registry Abuse", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -7539,7 +7539,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data = "*|Dir=In|*" Registry.registry_value_data = "*|Profile=Public|*" Registry.registry_value_data = "*|LPort=*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `allow_inbound_traffic_by_firewall_rule_registry_filter`
+search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data = "*|Dir=In|*"  Registry.registry_value_data = "*|LPort=*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name | `allow_inbound_traffic_by_firewall_rule_registry_filter`
 
 [ESCU - Allow Inbound Traffic In Firewall Rule - Rule]
 action.escu = 0
@@ -7556,7 +7556,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Allow Inbound Traffic In Firewall Rule - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious firewall modification detected on endpoint $ComputerName$ by user $user$.
@@ -7602,7 +7602,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Allow Network Discovery In Firewall - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware", "Revil Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = 
@@ -7648,8 +7648,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Allow Operation with Consent Admin - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Ransomware", "Windows Registry Abuse"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Ransomware", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious registry modification was performed on endpoint $dest$ by user $user$. This behavior is indicative of privilege escalation.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
@@ -7660,7 +7660,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Allow Operation with Consent Admin - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Windows Registry Abuse"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Windows Registry Abuse", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -7694,7 +7694,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Anomalous usage of 7zip - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Cobalt Strike", "NOBELIUM Group"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip.
@@ -7734,7 +7734,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Any Powershell DownloadFile - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell", "Ingress Tool Transfer", "Log4Shell CVE-2021-44228"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell.
@@ -7780,7 +7780,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Any Powershell DownloadString - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell", "HAFNIUM Group", "Ingress Tool Transfer"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString within PowerShell.
@@ -7826,7 +7826,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Attacker Tools On Endpoint - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Monitor for Unauthorized Software", "XMRig", "SamSam Ransomware", "Unusual Processes"]
 action.risk = 1
 action.risk.param._risk_message = An attacker tool $process_name$,listed in attacker_tools.csv is executed on host $dest$ by User $user$. This process $process_name$ is known to do- $description$
@@ -7872,7 +7872,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Attempt To Add Certificate To Untrusted Store - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Disabling Security Tools"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified attempting to add a certificate to the store on endpoint $dest$ by user $user$.
@@ -7918,8 +7918,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Attempt To Stop Security Service - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Disabling Security Tools", "Trickbot", "WhisperGate"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Disabling Security Tools", "Trickbot", "WhisperGate", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 20}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 20}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -7930,7 +7930,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Attempt To Stop Security Service - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools", "Trickbot", "WhisperGate"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools", "Trickbot", "WhisperGate", "Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -7964,7 +7964,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Attempted Credential Dump From Registry via Reg exe - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Credential Dumping", "DarkSide Ransomware", "Windows Registry Abuse", "Industroyer2"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys.
@@ -8010,7 +8010,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Auto Admin Logon Registry Entry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["BlackMatter Ransomware", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon
@@ -8056,7 +8056,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Batch File Write to System32 - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["SamSam Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$.
@@ -8102,7 +8102,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Bcdedit Command Back To Normal Mode Boot - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["BlackMatter Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = bcdedit process with commandline $process$ to bring back to normal boot configuration the $dest$
@@ -8148,7 +8148,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - BCDEdit Failure Recovery Modification - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ryuk Ransomware", "Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting disable the ability to recover the endpoint.
@@ -8194,7 +8194,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - BITS Job Persistence - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["BITS Jobs", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to persist using BITS.
@@ -8240,7 +8240,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - BITSAdmin Download File - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ingress Tool Transfer", "BITS Jobs", "DarkSide Ransomware", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file.
@@ -8286,7 +8286,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - CertUtil Download With URLCache and Split Arguments - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file.
@@ -8332,7 +8332,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file.
@@ -8372,13 +8372,13 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
 action.escu.known_false_positives = Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services.
-action.escu.creation_date = 2021-01-26
-action.escu.modification_date = 2021-01-26
+action.escu.creation_date = 2022-07-15
+action.escu.modification_date = 2022-07-15
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Certutil exe certificate extraction - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Persistence Techniques", "Cloud Federated Credential Abuse", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate.
@@ -8407,7 +8407,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `certutil_exe_certificate_extraction_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter`
 
 [ESCU - CertUtil With Decode Argument - Rule]
 action.escu = 0
@@ -8424,7 +8424,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - CertUtil With Decode Argument - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Deobfuscate-Decode Files or Information", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file.
@@ -8470,7 +8470,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Change Default File Association - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Registry Abuse", "Hermetic Wiper"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$
@@ -8516,7 +8516,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Change To Safe Mode With Network Config - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["BlackMatter Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = bcdedit process with commandline $process$ to force safemode boot the $dest$
@@ -8562,8 +8562,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - CHCP Command Execution - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["IcedID"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["IcedID", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = parent process $parent_process_name$ spawning chcp process $process_name$ with parent command line $parent_process$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 9}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 9}]
@@ -8574,7 +8574,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - CHCP Command Execution - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Azorult"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -8608,7 +8608,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Check Elevated CMD using whoami - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["FIN7"]
 action.risk = 1
 action.risk.param._risk_message = Process name $process_name$ with commandline $process$ in $dest$
@@ -8654,7 +8654,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Clear Unallocated Sector Using Cipher App - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors of a specific disk.
@@ -8700,7 +8700,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Clop Common Exec Parameter - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Clop Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting using arguments to execute its main code or feature of its code related to Clop ransomware.
@@ -8746,7 +8746,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Clop Ransomware Known Service Name - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Clop Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ executing known Clop Ransomware service names.
@@ -8792,8 +8792,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - CMD Carry Out String Command Parameter - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Data Destruction", "IcedID", "Log4Shell CVE-2021-44228", "WhisperGate", "Hermetic Wiper", "Living Off The Land"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Data Destruction", "IcedID", "Log4Shell CVE-2021-44228", "WhisperGate", "Hermetic Wiper", "Living Off The Land", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting spawn a new process.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}]
@@ -8804,7 +8804,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - CMD Carry Out String Command Parameter - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Data Destruction", "IcedID", "Log4Shell CVE-2021-44228", "WhisperGate", "Hermetic Wiper", "Living Off The Land"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "cve": ["CVE-2021-44228"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003", "T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Data Destruction", "IcedID", "Log4Shell CVE-2021-44228", "WhisperGate", "Hermetic Wiper", "Living Off The Land", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "cve": ["CVE-2021-44228"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003", "T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -8832,7 +8832,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - CMD Echo Pipe - Escalation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Cobalt Strike"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ potentially performing privilege escalation using named pipes related to Cobalt Strike and other frameworks.
@@ -8878,7 +8878,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Cmdline Tool Not Executed In CMD Shell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["FIN7"]
 action.risk = 1
 action.risk.param._risk_message = A non-standard parent process $parent_process_name$ spawned child process $process_name$ to execute command-line tool on $dest$.
@@ -8924,7 +8924,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$.
@@ -8972,7 +8972,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Cobalt Strike Named Pipes - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Cobalt Strike", "Trickbot", "DarkSide Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $process_name$ was identified on endpoint $Computer$ by user $user$ accessing known suspicious named pipes related to Cobalt Strike.
@@ -9023,7 +9023,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Common Ransomware Extensions - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware", "Clop Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware file extension and should be reviewed immediately.
@@ -9063,7 +9063,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Common Ransomware Notes - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["SamSam Ransomware", "Ransomware", "Ryuk Ransomware", "Clop Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware note file and should be reviewed immediately.
@@ -9103,7 +9103,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Conti Common Exec parameter - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing specific Conti Ransomware related parameters.
@@ -9149,7 +9149,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Control Loading from World Writable Directory - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Microsoft MSHTML Remote Code Execution CVE-2021-40444", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
@@ -9195,8 +9195,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Create local admin accounts using net exe - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["DHS Report TA18-074A"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["DHS Report TA18-074A", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators group.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -9207,7 +9207,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Create local admin accounts using net exe - Rule
-action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "Azorult"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -9241,7 +9241,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Create or delete windows shares using net exe - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Hidden Cobra Malware"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares.
@@ -9287,7 +9287,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Create Remote Thread In Shell Application - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["IcedID"]
 action.risk = 1
 action.risk.param._risk_message = process $SourceImage$ create a remote thread to shell app process $TargetImage$ in host $Computer$
@@ -9333,7 +9333,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Create Remote Thread into LSASS - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
 action.risk.param._risk_message = A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated.
@@ -9379,7 +9379,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Creation of lsass Dump with Taskmgr - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
 action.risk.param._risk_message = $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager.
@@ -9425,7 +9425,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Creation of Shadow Copy - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking.
@@ -9471,7 +9471,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Creation of Shadow Copy with wmic and powershell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Credential Dumping", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking.
@@ -9517,7 +9517,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline password cracking.
@@ -9563,7 +9563,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Credential Dumping via Symlink to Shadow Copy - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy to grab credentials.
@@ -9609,7 +9609,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - CSC Net On The Fly Compilation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
 action.risk.param._risk_message = csc.exe with commandline $process$ to compile .net code on $dest$ by $user$
@@ -9649,7 +9649,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Curl Download and Bash Execution - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ingress Tool Transfer", "Log4Shell CVE-2021-44228"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $process_name$ was identified on endpoint $dest$ attempting to download a remote file and run it with bash.
@@ -9689,17 +9689,17 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
 action.escu.known_false_positives = unknown
-action.escu.creation_date = 2021-05-12
-action.escu.modification_date = 2021-05-12
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Delete ShadowCopy With PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware", "Revil Ransomware"]
 action.risk = 1
-action.risk.param._risk_message = An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$ by $User$.
-action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 81}]
+action.risk.param._risk_message = An attempt to delete ShadowCopy was performed using PowerShell on $Computer$ by $User$.
+action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 81}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -9707,7 +9707,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Delete ShadowCopy With PowerShell - Rule
-action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware", "Revil Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware", "Revil Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -9724,7 +9724,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*" OR Message = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `delete_shadowcopy_with_powershell_filter`
+search = `powershell` EventCode=4104 ScriptBlockText= "*ShadowCopy*" (ScriptBlockText = "*Delete*" OR ScriptBlockText = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `delete_shadowcopy_with_powershell_filter`
 
 [ESCU - Deleting Of Net Users - Rule]
 action.escu = 0
@@ -9741,7 +9741,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Deleting Of Net Users - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete accounts.
@@ -9787,7 +9787,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Deleting Shadow Copies - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Log Manipulation", "SamSam Ransomware", "Ransomware", "Clop Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete shadow copies.
@@ -9833,7 +9833,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Activity Related to Pass the Hash Attacks - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the pass the hash technique.
@@ -9879,7 +9879,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect AzureHound Command-Line Arguments - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Discovery Techniques"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD.
@@ -9925,7 +9925,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect AzureHound File Modifications - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Discovery Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A file - $file_name$ was written to disk that is related to AzureHound, a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$.
@@ -9975,7 +9975,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
 action.risk.param._risk_message = PowerShell was identified running a script to capture the SAM hive on endpoint $ComputerName$ by user $user$.
@@ -10023,7 +10023,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Credential Dumping through LSASS access - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack"]
 action.risk = 1
 action.risk.param._risk_message = The $source_image$ has attempted access to read $TargetImage$ was identified on endpoint $Computer$, this is indicative of credential dumping and should be investigated.
@@ -10067,17 +10067,17 @@ This analytic identifies the common PowerShell stager used by PowerShell-Empire.
 During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = False positives may only pertain to it not being related to Empire, but another framework. Filter as needed if any applications use the same pattern.
-action.escu.creation_date = 2021-06-09
-action.escu.modification_date = 2021-06-09
+action.escu.creation_date = 2022-02-24
+action.escu.modification_date = 2022-02-24
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Empire with PowerShell Script Block Logging - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_message = The following behavior was identified and typically related to PowerShell-Empire on $ComputerName$ by $User$.
-action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 81}]
+action.risk.param._risk_message = The following behavior was identified and typically related to PowerShell-Empire on $Computer$ by $UserID$.
+action.risk.param._risk = [{"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 81}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -10085,7 +10085,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detect Empire with PowerShell Script Block Logging - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "UserID", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -10104,7 +10104,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104  (Message=*system.net.webclient* AND Message=*frombase64string*) | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_empire_with_powershell_script_block_logging_filter`
+search = `powershell` EventCode=4104  (ScriptBlockText=*system.net.webclient* AND ScriptBlockText=*frombase64string*) | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_empire_with_powershell_script_block_logging_filter`
 
 [ESCU - Detect Excessive Account Lockouts From Endpoint - Rule]
 action.escu = 0
@@ -10125,7 +10125,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Excessive Account Lockouts From Endpoint - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Account Monitoring and Controls"]
 action.risk = 1
 action.risk.param._risk_message = Multiple accounts have been locked out. Review $dest$ and results related to $user$.
@@ -10165,7 +10165,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Excessive User Account Lockouts - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Account Monitoring and Controls"]
 action.risk = 1
 action.risk.param._risk_message = Multiple accounts have been locked out. Review $nodename$ and $result$ related to $user$.
@@ -10205,7 +10205,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Exchange Web Shell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["HAFNIUM Group", "ProxyShell"]
 action.risk = 1
 action.risk.param._risk_message = A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$.
@@ -10251,7 +10251,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect HTML Help Renamed - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Compiled HTML Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$.
@@ -10291,7 +10291,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect HTML Help Spawn Child Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Compiled HTML Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior.
@@ -10337,7 +10337,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect HTML Help URL in Command Line - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Compiled HTML Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_proces_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally download a malicious payload.
@@ -10383,7 +10383,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Compiled HTML Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$.
@@ -10429,7 +10429,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Mimikatz Using Loaded Images - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = A process, $Image$, has loaded $ImageLoaded$ that are typically related to credential dumping on $Computer$. Review for further details.
@@ -10466,24 +10466,24 @@ action.escu.enabled = 1
 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
 This analytic identifies common Mimikatz functions that may be identified in the script block, including `mimikatz`. This will catch the most basic use cases for Pass the Ticket, Pass the Hash and `-DumprCreds`. \
 During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
-action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003"]}
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003", "T1059.001"]}
 action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
 This analytic identifies common Mimikatz functions that may be identified in the script block, including `mimikatz`. This will catch the most basic use cases for Pass the Ticket, Pass the Hash and `-DumprCreds`. \
 During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = False positives should be limited as the commands being identifies are quite specific to EventCode 4104 and Mimikatz. Filter as needed.
-action.escu.creation_date = 2021-06-09
-action.escu.modification_date = 2021-06-09
+action.escu.creation_date = 2022-02-24
+action.escu.modification_date = 2022-02-24
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_message = The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $ComputerName$ by $User$.
-action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 90}]
+action.risk.param._risk_message = The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $Computer$ by $UserID$.
+action.risk.param._risk = [{"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 90}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -10491,7 +10491,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003", "T1059.001"], "observable": [{"name": "UserID", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -10510,7 +10510,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*, *kerberos::ptt*, *kerberos::golden*) | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_mimikatz_with_powershell_script_block_logging_filter`
+search = `powershell` EventCode=4104 ScriptBlockText IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*, *kerberos::ptt*, *kerberos::golden*) | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_mimikatz_with_powershell_script_block_logging_filter`
 
 [ESCU - Detect mshta inline hta execution - Rule]
 action.escu = 0
@@ -10527,7 +10527,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect mshta inline hta execution - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious MSHTA Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense evasion.
@@ -10573,7 +10573,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect mshta renamed - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious MSHTA Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$.
@@ -10613,7 +10613,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect MSHTA Url in Command Line - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious MSHTA Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $est$ by user $user$ attempting to access a remote destination to download an additional payload.
@@ -10659,7 +10659,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect New Local Admin account - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["DHS Report TA18-074A", "HAFNIUM Group"]
 action.risk = 1
 action.risk.param._risk_message = A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not.
@@ -10705,7 +10705,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Path Interception By Creation Of program exe - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by using unquoted service paths.
@@ -10751,7 +10751,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect processes used for System Network Configuration Discovery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Unusual Processes"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning multiple $process_name$ was identified on endpoint $dest$ by user $user$ typically not a normal behavior of the process.
@@ -10797,7 +10797,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Prohibited Applications Spawning cmd exe - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "NOBELIUM Group"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running prohibited applications.
@@ -10837,7 +10837,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect PsExec With accepteula Flag - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running the utility for possibly the first time.
@@ -10883,7 +10883,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect RClone Command-Line Usage - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service to move files or folders.
@@ -10929,7 +10929,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Regasm Spawning a Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior for $parent_process_name$.
@@ -10975,7 +10975,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Regasm with Network Connection - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$.
@@ -11021,7 +11021,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Regasm with no Command Line Arguments - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$.
@@ -11067,7 +11067,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Regsvcs Spawning a Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$  was identified on endpoint $dest$ by user $user$ typically not normal for this process.
@@ -11113,7 +11113,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Regsvcs with Network Connection - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$.
@@ -11159,7 +11159,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Regsvcs with No Command Line Arguments - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$.
@@ -11207,7 +11207,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Regsvr32 Application Control Bypass - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Cobalt Strike", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$.
@@ -11254,7 +11254,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Renamed 7-Zip - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Collection and Staging"]
 action.risk = 1
 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$.
@@ -11294,7 +11294,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Renamed PSExec - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$.
@@ -11334,7 +11334,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Renamed RClone - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$.
@@ -11374,7 +11374,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Renamed WinRAR - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Collection and Staging"]
 action.risk = 1
 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$.
@@ -11414,7 +11414,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$.
@@ -11460,7 +11460,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$.
@@ -11506,7 +11506,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$.
@@ -11552,7 +11552,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Rundll32 Inline HTA Execution - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious MSHTA Activity", "NOBELIUM Group", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious rundll32.exe inline HTA execution on $dest$
@@ -11598,7 +11598,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect SharpHound Command-Line Arguments - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Discovery Techniques", "Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = Possible SharpHound command-Line arguments identified on $dest$
@@ -11644,7 +11644,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect SharpHound File Modifications - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Discovery Techniques", "Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = Potential SharpHound file modifications identified on $dest$
@@ -11690,7 +11690,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect SharpHound Usage - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Discovery Techniques", "Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = Potential SharpHound binary identified on $dest$
@@ -11736,8 +11736,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Emotet Malware  DHS Report TA18-201A ", "Suspicious Command-Line Executions"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Emotet Malware  DHS Report TA18-201A ", "Suspicious Command-Line Executions", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = cmd.exe launching script interpreters on $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}]
@@ -11748,7 +11748,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware  DHS Report TA18-201A ", "Suspicious Command-Line Executions"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware  DHS Report TA18-201A ", "Suspicious Command-Line Executions", "Azorult"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -11792,7 +11792,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect WMI Event Subscription Persistence - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious WMI Use"]
 action.risk = 1
 action.risk.param._risk_message = Possible malicious WMI Subscription created on $dest$
@@ -11843,7 +11843,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable AMSI Through Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = Disable AMSI Through Registry
@@ -11889,7 +11889,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Defender AntiVirus Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["IceID", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
@@ -11935,8 +11935,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Defender BlockAtFirstSeen Feature - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["IceID", "Windows Registry Abuse"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
@@ -11947,7 +11947,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disable Defender BlockAtFirstSeen Feature - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -11981,8 +11981,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Defender Enhanced Notification - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["IceID", "Windows Registry Abuse"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
@@ -11993,7 +11993,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disable Defender Enhanced Notification - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -12027,7 +12027,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Defender MpEngine Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["IceID", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
@@ -12073,8 +12073,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Defender Spynet Reporting - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["IceID", "Windows Registry Abuse"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
@@ -12085,7 +12085,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disable Defender Spynet Reporting - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -12107,10 +12107,10 @@ search = | tstats `security_content_summariesonly` count from datamodel=Endpoint
 [ESCU - Disable Defender Submit Samples Consent Feature - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = his analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
+description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = his analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
+action.escu.eli5 = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin or user may choose to disable windows defender product
 action.escu.creation_date = 2022-01-26
@@ -12119,8 +12119,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Defender Submit Samples Consent Feature - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["IceID", "Windows Registry Abuse"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["IceID", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}]
@@ -12131,11 +12131,11 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disable Defender Submit Samples Consent Feature - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IceID", "Windows Registry Abuse", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = his analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
+action.notable.param.rule_description = This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
 action.notable.param.rule_title = Disable Defender Submit Samples Consent Feature
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
@@ -12165,7 +12165,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable ETW Through Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = Disable ETW Through Registry
@@ -12211,7 +12211,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Logs Using WevtUtil - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = WevtUtil.exe used to disable Event Logging on $dest
@@ -12257,7 +12257,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Registry Tool - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = Disabled Registry Tools on $dest$
@@ -12303,7 +12303,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Schedule Task - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["IcedID", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = schtask process with commandline $process$ to disable schedule task in $dest$
@@ -12349,7 +12349,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Security Logs Using MiniNt Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$
@@ -12395,8 +12395,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Show Hidden Files - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = Disabled 'Show Hidden Files' on $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}]
@@ -12407,7 +12407,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disable Show Hidden Files - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001", "T1564", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Registry Abuse", "Azorult"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001", "T1564", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -12441,7 +12441,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable UAC Remote Restriction - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$
@@ -12487,7 +12487,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Windows App Hotkeys - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["XMRig", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = Disabled 'Windows App Hotkeys' on $dest$
@@ -12533,8 +12533,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Windows Behavior Monitoring - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware", "Windows Registry Abuse"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = Windows Defender real time behavior monitoring disabled on $dest
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}]
@@ -12545,7 +12545,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disable Windows Behavior Monitoring - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware", "Windows Registry Abuse"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware", "Windows Registry Abuse", "Azorult"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -12579,7 +12579,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disable Windows SmartScreen Protection - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = The Windows Smartscreen was disabled on $dest$ by $user$.
@@ -12619,13 +12619,13 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADUser` commandlet with specific parameters. `Get-ADUser` is part of the Active Directory PowerShell module used to manage Windows Active Directory networks. As the name suggests, `Get-ADUser` is used to query for domain users. With the appropiate parameters, Get-ADUser allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = Administrators or power users may use search for accounts with Kerberos Pre Authentication disabled for legitimate purposes.
-action.escu.creation_date = 2022-02-22
-action.escu.modification_date = 2022-02-22
+action.escu.creation_date = 2022-05-03
+action.escu.modification_date = 2022-05-03
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabled Kerberos Pre-Authentication Discovery With Get-ADUser - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest$
@@ -12654,7 +12654,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search =  `powershell` EventCode=4104 (Message = "*Get-ADUser*" AND Message="*4194304*") | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`
+search =  `powershell` EventCode=4104 (ScriptBlockText = "*Get-ADUser*" AND ScriptBlockText="*4194304*") | stats count min(_time)  as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`
 
 [ESCU - Disabled Kerberos Pre-Authentication Discovery With PowerView - Rule]
 action.escu = 0
@@ -12665,13 +12665,13 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet with specific parameters. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows Active Directory networks. As the name suggests, `Get-DomainUser` is used to identify domain users and combining it with `-PreauthNotRequired` allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = Administrators or power users may use PowerView for troubleshooting
-action.escu.creation_date = 2022-02-18
-action.escu.modification_date = 2022-02-18
+action.escu.creation_date = 2022-05-03
+action.escu.modification_date = 2022-05-03
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabled Kerberos Pre-Authentication Discovery With PowerView - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest$
@@ -12700,7 +12700,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search =  `powershell` EventCode=4104 (Message = "*Get-DomainUser*" AND Message="*PreauthNotRequired*") | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`
+search =  `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainUser*" AND ScriptBlockText="*PreauthNotRequired*") | stats count min(_time)  as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`
 
 [ESCU - Disabling CMD Application - Rule]
 action.escu = 0
@@ -12717,7 +12717,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabling CMD Application - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = The Windows command prompt was disabled on $dest$ by $user$.
@@ -12763,7 +12763,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabling ControlPanel - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = The Windows Control Panel was disabled on $dest$ by $user$.
@@ -12809,7 +12809,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabling Defender Services - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["IceID", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $registry_path$ in $dest$
@@ -12855,7 +12855,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabling Firewall with Netsh - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
 action.risk.param._risk_message = The Windows Firewall was disabled on $dest$ by $user$.
@@ -12901,7 +12901,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabling FolderOptions Windows Feature - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = The Windows Folder Options, to hide files, was disabled on $dest$ by $user$.
@@ -12947,7 +12947,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabling Net User Account - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified disabling a user account on endpoint $dest$ by user $user$.
@@ -12993,7 +12993,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabling NoRun Windows App - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = The Windows registry was modified to disable run application in window start menu on $dest$ by $user$.
@@ -13039,8 +13039,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabling Remote User Account Control - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Remcos", "Windows Registry Abuse"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Remcos", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = The Windows registry keys that control the enforcement of Windows User Account Control (UAC) were modified on $dest$ by $user$.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}]
@@ -13051,7 +13051,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Disabling Remote User Account Control - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Remcos", "Windows Registry Abuse"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002", "T1548"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Remcos", "Windows Registry Abuse", "Azorult"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002", "T1548"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -13085,7 +13085,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabling SystemRestore In Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = The Windows registry was modified to disable system restore on $dest$ by $user$.
@@ -13131,7 +13131,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Disabling Task Manager - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = The Windows Task Manager was disabled on $dest$ by $user$.
@@ -13177,7 +13177,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - DLLHost with no Command Line Arguments with Network - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Cobalt Strike"]
 action.risk = 1
 action.risk.param._risk_message = The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$.
@@ -13223,7 +13223,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - DNS Exfiltration Using Nslookup App - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Data Exfiltration", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration.
@@ -13269,7 +13269,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Domain Account Discovery with Dsquery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = an instance of process $process_name$ with commandline $process$ in $dest$
@@ -13309,7 +13309,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Domain Account Discovery With Net App - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = an instance of process $process_name$ with commandline $process$ in $dest$
@@ -13355,7 +13355,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Domain Account Discovery with Wmic - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = an instance of process $process_name$ with commandline $process$ in $dest$
@@ -13401,7 +13401,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Domain Controller Discovery with Nltest - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Domain controller discovery on $dest$ by $user$
@@ -13447,7 +13447,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Domain Controller Discovery with Wmic - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Domain controller discovery on $dest$ by $user$
@@ -13487,7 +13487,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Domain Group Discovery with Adsisearcher - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Domain group discovery enumeration using PowerShell on $dest$ by $user$
@@ -13533,7 +13533,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Domain Group Discovery With Dsquery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Domain group discovery enumeration on $dest$ by $user$
@@ -13573,7 +13573,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Domain Group Discovery With Net - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Domain group discovery enumeration on $dest$ by $user$
@@ -13613,7 +13613,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Domain Group Discovery With Wmic - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Domain group discovery enumeration on $dest$ by $user$
@@ -13653,7 +13653,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Download Files Using Telegram - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious files were downloaded with the Telegram application on $dest$ by $user$.
@@ -13699,7 +13699,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Drop IcedID License dat - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["IcedID"]
 action.risk = 1
 action.risk.param._risk_message = process $SourceImage$ create a file $TargetImage$ in host $Computer$
@@ -13749,7 +13749,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - DSQuery Domain Discovery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Domain Trust Discovery", "Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified performing domain discovery on endpoint $dest$ by user $user$.
@@ -13800,7 +13800,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Dump LSASS via comsvcs DLL - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group", "Living Off The Land", "Industroyer2"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$.
@@ -13848,7 +13848,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Dump LSASS via procdump - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified attempting to dump lsass.exe on endpoint $dest$ by user $user$.
@@ -13895,7 +13895,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Elevated Group Discovery With Net - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Elevated domain group discovery enumeration on $dest$ by $user$
@@ -13941,7 +13941,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Elevated Group Discovery with PowerView - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Elevated group discovery using PowerView on $dest$ by $user$
@@ -13981,7 +13981,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Elevated Group Discovery With Wmic - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Elevated domain group discovery enumeration on $dest$ by $user$
@@ -14027,7 +14027,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Enable RDP In Other Port Number - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = RDP was moved to a non-standard port on $dest$ by $user$.
@@ -14073,7 +14073,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Enable WDigest UseLogonCredential Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Credential Dumping", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = wdigest registry $registry_path$ was modified in $dest$
@@ -14119,7 +14119,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Enumerate Users Local Group Using Telegram - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
 action.risk.param._risk_message = The Telegram application has been identified enumerating local groups on $ComputerName$ by $user$.
@@ -14165,7 +14165,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Esentutl SAM Copy - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Credential Dumping", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user user$ attempting to capture credentials for offline cracking or observability.
@@ -14205,7 +14205,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - ETW Registry Disabled - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Registry Abuse", "Hermetic Wiper"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$
@@ -14251,7 +14251,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Eventvwr UAC Bypass - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "IcedID", "Living Off The Land", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = Registry values were modified to bypass UAC using Event Viewer on $dest$ by $user$.
@@ -14297,7 +14297,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Excel Spawning PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution.
@@ -14343,7 +14343,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Excel Spawning Windows Script Host - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution.
@@ -14389,8 +14389,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Excessive Attempt To Disable Services - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["XMRig"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["XMRig", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to disable services.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -14401,7 +14401,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Excessive Attempt To Disable Services - Rule
-action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Azorult"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -14412,7 +14412,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime  from datamodel=Endpoint.Processes where   Processes.process_name = "sc.exe" AND Processes.process="*config*" OR Processes.process="*Disabled*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_attempt_to_disable_services_filter`
+search = | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime  from datamodel=Endpoint.Processes where   Processes.process_name = "sc.exe" AND Processes.process="*config*" OR Processes.process="*Disabled*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m | where count >=4 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_attempt_to_disable_services_filter`
 
 [ESCU - Excessive distinct processes from Windows Temp - Rule]
 action.escu = 0
@@ -14429,7 +14429,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Excessive distinct processes from Windows Temp - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Meterpreter"]
 action.risk = 1
 action.risk.param._risk_message = Multiple processes were executed out of windows\temp within a short amount of time on $dest$.
@@ -14469,7 +14469,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Excessive File Deletion In WinDefender Folder - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["WhisperGate"]
 action.risk = 1
 action.risk.param._risk_message = High frequency file deletion activity detected on host $Computer$
@@ -14515,7 +14515,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Excessive number of service control start as disabled - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
 action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to disable services.
@@ -14555,7 +14555,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Excessive number of taskhost processes - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Meterpreter"]
 action.risk = 1
 action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ indicative of suspicious behavior.
@@ -14595,7 +14595,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Excessive Service Stop Attempt - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["XMRig", "Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to disable services.
@@ -14635,8 +14635,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Excessive Usage Of Cacls App - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["XMRig"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["XMRig", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to modify permissions.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -14647,7 +14647,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Excessive Usage Of Cacls App - Rule
-action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Azorult"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -14675,8 +14675,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Excessive Usage Of Net App - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["XMRig", "Ransomware"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["XMRig", "Ransomware", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = Excessive usage of net1.exe or net.exe within 1m, with command line $process$ has been detected on $dest$ by $user$
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 28}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -14687,7 +14687,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Excessive Usage Of Net App - Rule
-action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Scope:Local", "Stage:Execution"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Ransomware", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Scope:Local", "Stage:Execution"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -14715,7 +14715,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Excessive Usage of NSLOOKUP App - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Data Exfiltration", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = Excessive usage of nslookup.exe has been detected on $Computer$. This detection is triggered as as it violates the dynamic threshold
@@ -14755,8 +14755,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Excessive Usage Of SC Service Utility - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Ransomware"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Ransomware", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = Excessive Usage Of SC Service Utility
 action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 25}]
@@ -14767,7 +14767,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Excessive Usage Of SC Service Utility - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Scope:Local", "Stage:Exfiltration"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569", "T1569.002"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Scope:Local", "Stage:Exfiltration"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569", "T1569.002"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -14795,8 +14795,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Excessive Usage Of Taskkill - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["XMRig"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["XMRig", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = Excessive usage  of taskkill.exe with process id $process_id$ (more than 10 within 1m) has been detected on $dest$ with a parent process of $parent_process_name$.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}]
@@ -14807,7 +14807,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Excessive Usage Of Taskkill - Rule
-action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]}
+action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -14835,7 +14835,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Executable File Written in Administrative SMB Share - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Data Destruction", "Active Directory Lateral Movement", "Trickbot", "Hermetic Wiper", "Industroyer2"]
 action.risk = 1
 action.risk.param._risk_message = $user$ dropped or created an executable file in known sensitive SMB share.  Share name=$Share_Name$, Target name=$Relative_Target_Name$, and Access mask=$Access_Mask$
@@ -14881,8 +14881,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Executables Or Script Creation In Suspicious Path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Double Zero Destructor", "Data Destruction", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper", "Industroyer2"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Double Zero Destructor", "Data Destruction", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper", "Industroyer2", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious executable or scripts with file name $file_name$, $file_path$ and process_id $process_id$ executed in suspicious file path in Windows by $user$
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_name", "threat_object_type": "file name"}]
@@ -14893,7 +14893,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Executables Or Script Creation In Suspicious Path - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Double Zero Destructor", "Data Destruction", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper", "Industroyer2"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_id", "role": ["Attacker"], "type": "Process"}, {"name": "file_name", "role": ["Other", "Attacker"], "type": "File Name"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Double Zero Destructor", "Data Destruction", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper", "Industroyer2", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_id", "role": ["Attacker"], "type": "Process"}, {"name": "file_name", "role": ["Other", "Attacker"], "type": "File Name"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -14927,7 +14927,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Execute Javascript With Jscript COM CLSID - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious process of cscript.exe with a parent process $parent_process_name$ where it tries to execute javascript using jscript.encode CLSID (COM OBJ), detected on $dest$ by $user$
@@ -14973,7 +14973,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Execution of File with Multiple Extensions - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows File Extension and Association Abuse", "Masquerading - Rename System Utilities"]
 action.risk = 1
 action.risk.param._risk_message = process $process$ have double extensions in the file name is executed on $dest$ by $user$
@@ -15019,7 +15019,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Extraction of Registry Hives - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["DarkSide Ransomware", "Credential Dumping"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious use of `reg.exe` exporting Windows Registry hives containing credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$
@@ -15065,7 +15065,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - File with Samsam Extension - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["SamSam Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = File writes $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$
@@ -15111,8 +15111,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Firewall Allowed Program Enable - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = firewall allowed program commandline $process$ of $process_name$ on $dest$ by $user$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
@@ -15123,7 +15123,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Firewall Allowed Program Enable - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1562.004", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1562.004", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -15134,7 +15134,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*firewall*" Processes.process = "*allowedprogram*" Processes.process = "*add*" Processes.process = "*ENABLE*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `firewall_allowed_program_enable_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*firewall*" Processes.process = "*allow*" Processes.process = "*add*" Processes.process = "*ENABLE*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `firewall_allowed_program_enable_filter`
 
 [ESCU - FodHelper UAC Bypass - Rule]
 action.escu = 0
@@ -15159,7 +15159,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - FodHelper UAC Bypass - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "IcedID"]
 action.risk = 1
 action.risk.param._risk_message = Suspcious registy keys added by process fodhelper.exe (process_id- $process_id), with a parent_process of $parent_process_name$ that has been executed on $dest$ by $user$.
@@ -15209,7 +15209,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Fsutil Zeroing File - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = Possible file data deletion on $dest$ using $process$
@@ -15255,7 +15255,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Get ADDefaultDomainPasswordPolicy with Powershell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = an instance of process $process_name$ with commandline $process$ in $dest$
@@ -15295,7 +15295,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Get ADDefaultDomainPasswordPolicy with Powershell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = powershell process having commandline $Message$ to query domain password policy
@@ -15335,7 +15335,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Get ADUser with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = an instance of process $process_name$ with commandline $process$ in $dest$
@@ -15375,7 +15375,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Get ADUser with PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = powershell process having commandline $Message$ for user enumeration
@@ -15415,7 +15415,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Get ADUserResultantPasswordPolicy with Powershell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = an instance of process $process_name$ with commandline $process$ in $dest$
@@ -15455,17 +15455,17 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADUserResultantPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery.
 action.escu.how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting.
-action.escu.creation_date = 2021-08-26
-action.escu.modification_date = 2021-08-26
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
-action.risk.param._risk_message = powershell process having commandline $Message$ to query domain user password policy.
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 9}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 9}]
+action.risk.param._risk_message = powershell process having commandline $ScriptBlockText$ to query domain user password policy.
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 9}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 9}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -15473,7 +15473,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -15490,7 +15490,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`
+search = `powershell` EventCode=4104 ScriptBlockText="*Get-ADUserResultantPasswordPolicy*" | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`
 
 [ESCU - Get DomainPolicy with Powershell - Rule]
 action.escu = 0
@@ -15507,7 +15507,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Get DomainPolicy with Powershell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = an instance of process $process_name$ with commandline $process$ in $dest$
@@ -15547,17 +15547,17 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery.
 action.escu.how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting.
-action.escu.creation_date = 2021-08-26
-action.escu.modification_date = 2021-08-26
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Get DomainPolicy with Powershell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
-action.risk.param._risk_message = powershell process having commandline $Message$ to query domain policy.
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 30}]
+action.risk.param._risk_message = powershell process having commandline $ScriptBlockText$ to query domain policy.
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 30}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -15565,7 +15565,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Get DomainPolicy with Powershell Script Block - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1201"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "UserID", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -15582,7 +15582,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`
+search = `powershell` EventCode=4104 ScriptBlockText ="*Get-DomainPolicy*" | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`
 
 [ESCU - Get-DomainTrust with PowerShell - Rule]
 action.escu = 0
@@ -15599,7 +15599,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Get-DomainTrust with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious PowerShell Get-DomainTrust was identified on endpoint $dest$ by user $user$.
@@ -15643,17 +15643,17 @@ This analytic identifies Get-DomainTrust from PowerView in order to gather domai
 During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = It is possible certain system management frameworks utilize this command to gather trust information.
-action.escu.creation_date = 2021-08-24
-action.escu.modification_date = 2021-08-24
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Get-DomainTrust with PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
-action.risk.param._risk_message = Suspicious PowerShell Get-DomainTrust was identified on endpoint $ComputerName$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 12}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 12}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}]
+action.risk.param._risk_message = Suspicious PowerShell Get-DomainTrust was identified on endpoint $Computer$ by user $UserID$.
+action.risk.param._risk = [{"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 12}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 12}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -15661,7 +15661,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Get-DomainTrust with PowerShell Script Block - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 40, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 40, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"], "observable": [{"name": "UserID", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -15680,7 +15680,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message = "*get-foresttrust*" | stats count min(_time) as firstTime max(_time) as lastTime by Message ComputerName User EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter`
+search = `powershell` EventCode=4104 ScriptBlockText = "*get-domaintrust*" | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter`
 
 [ESCU - Get DomainUser with PowerShell - Rule]
 action.escu = 0
@@ -15697,7 +15697,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Get DomainUser with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = an instance of process $process_name$ with commandline $process$ in $dest$
@@ -15743,7 +15743,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Get DomainUser with PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = powershell process having commandline $Message$ for user enumeration
@@ -15789,7 +15789,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Get-ForestTrust with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious PowerShell Get-ForestTrust was identified on endpoint $dest$ by user $user$.
@@ -15826,24 +15826,24 @@ action.escu.enabled = 1
 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \
 This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. \
 During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
-action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"]}
+action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482", "T1059.001"]}
 action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \
 This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. \
 During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = False positives may be present. Tune as needed.
-action.escu.creation_date = 2021-09-02
-action.escu.modification_date = 2021-09-02
+action.escu.creation_date = 2022-02-24
+action.escu.modification_date = 2022-02-24
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Get-ForestTrust with PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
-action.risk.param._risk_message = Suspicious PowerShell Get-ForestTrust was identified on endpoint $ComputerName$ by user $User$.
-action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 12}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 12}]
+action.risk.param._risk_message = Suspicious PowerShell Get-ForestTrust was identified on endpoint $Computer$ by user $UserID$.
+action.risk.param._risk = [{"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 12}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 12}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -15851,7 +15851,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Get-ForestTrust with PowerShell Script Block - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 40, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 40, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1482", "T1059.001"], "observable": [{"name": "UserID", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -15887,7 +15887,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Get WMIObject Group Discovery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = System group discovery on $dest$ by $user$.
@@ -15931,7 +15931,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Get WMIObject Group Discovery with Script Block Logging - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = System group discovery enumeration on $dest$ by $user$.
@@ -15971,7 +15971,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetAdComputer with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$
@@ -16005,17 +16005,17 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-action.escu.creation_date = 2021-09-01
-action.escu.modification_date = 2021-09-01
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetAdComputer with PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
-action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
+action.risk.param._risk_message = Remote system discovery enumeration on $Computer$ by $UserID$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 15}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -16023,7 +16023,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - GetAdComputer with PowerShell Script Block - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -16034,7 +16034,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 (Message = "*Get-AdComputer*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getadcomputer_with_powershell_script_block_filter`
+search = `powershell` EventCode=4104 (ScriptBlockText = "*Get-AdComputer*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getadcomputer_with_powershell_script_block_filter`
 
 [ESCU - GetAdGroup with PowerShell - Rule]
 action.escu = 0
@@ -16051,7 +16051,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetAdGroup with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Domain group discovery enumeration on $dest$ by $user$
@@ -16091,7 +16091,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetAdGroup with PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Domain group discovery enumeration using PowerShell on $dest$ by $user$
@@ -16131,7 +16131,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetCurrent User with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = System user discovery on $dest$
@@ -16171,7 +16171,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetCurrent User with PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = System user discovery on $dest$
@@ -16211,7 +16211,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetDomainComputer with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$
@@ -16251,17 +16251,17 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainComputer` commandlet. `GetDomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = Administrators or power users may use PowerView for troubleshooting.
-action.escu.creation_date = 2021-09-02
-action.escu.modification_date = 2021-09-02
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetDomainComputer with PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
-action.risk.param._risk_message = Remote system discovery with PowerView on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}]
+action.risk.param._risk_message = Remote system discovery with PowerView on $Computer$ by $user$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 24}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -16269,7 +16269,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - GetDomainComputer with PowerShell Script Block - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -16286,7 +16286,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 (Message = "*Get-DomainComputer*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getdomaincomputer_with_powershell_script_block_filter`
+search = `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainComputer*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getdomaincomputer_with_powershell_script_block_filter`
 
 [ESCU - GetDomainController with PowerShell - Rule]
 action.escu = 0
@@ -16303,7 +16303,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetDomainController with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Remote system discovery using PowerView on $dest$ by $user$
@@ -16337,17 +16337,17 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainController` commandlet. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-action.escu.creation_date = 2021-09-02
-action.escu.modification_date = 2021-09-02
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetDomainController with PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
-action.risk.param._risk_message = Remote system discovery with PowerView on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}]
+action.risk.param._risk_message = Remote system discovery with PowerView on $Computer$ by $UserID$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 24}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -16355,7 +16355,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - GetDomainController with PowerShell Script Block - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -16372,7 +16372,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 (Message = "*Get-DomainController*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getdomaincontroller_with_powershell_script_block_filter`
+search = `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainController*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getdomaincontroller_with_powershell_script_block_filter`
 
 [ESCU - GetDomainGroup with PowerShell - Rule]
 action.escu = 0
@@ -16389,7 +16389,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetDomainGroup with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Domain group discovery with PowerView on $dest$ by $user$
@@ -16429,17 +16429,17 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams and adversaries may leverage this function to enumerate domain groups for situational awareness and Active Directory Discovery.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = Administrators or power users may use this PowerView functions for troubleshooting.
-action.escu.creation_date = 2021-08-26
-action.escu.modification_date = 2021-08-26
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetDomainGroup with PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
-action.risk.param._risk_message = Domain group discovery enumeration using PowerView on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
+action.risk.param._risk_message = Domain group discovery enumeration using PowerView on $Computer$ by $UserID$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 15}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -16447,7 +16447,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - GetDomainGroup with PowerShell Script Block - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.002"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -16464,7 +16464,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 (Message = "*Get-DomainGroup*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getdomaingroup_with_powershell_script_block_filter`
+search = `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainGroup*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getdomaingroup_with_powershell_script_block_filter`
 
 [ESCU - GetLocalUser with PowerShell - Rule]
 action.escu = 0
@@ -16481,7 +16481,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetLocalUser with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Local user discovery enumeration using PowerShell on $dest$ by $user$
@@ -16510,7 +16510,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
 action.escu = 0
 action.escu.enabled = 1
 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-LocalUser` commandlet. The `Get-LocalUser` commandlet is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
-action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]}
+action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001", "T1059.001"]}
 action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-LocalUser` commandlet. The `Get-LocalUser` commandlet is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -16521,11 +16521,11 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetLocalUser with PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Active Directory Discovery"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Active Directory Discovery", "Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_message = Local user discovery enumeration using PowerShell on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
+action.risk.param._risk_message = Local user discovery enumeration using PowerShell on $Computer$ by $user$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 15}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -16533,7 +16533,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - GetLocalUser with PowerShell Script Block - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery", "Malicious PowerShell"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001", "T1059.001"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -16561,7 +16561,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetNetTcpconnection with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Network Connection discovery on $dest$ by $user$
@@ -16595,17 +16595,17 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-NetTcpconnection ` commandlet. This commandlet is used to return a listing of network connections on a compromised system. Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-action.escu.creation_date = 2021-09-10
-action.escu.modification_date = 2021-09-10
+action.escu.creation_date = 2022-04-02
+action.escu.modification_date = 2022-04-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetNetTcpconnection with PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
-action.risk.param._risk_message = Network Connection discovery on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
+action.risk.param._risk_message = Network Connection discovery on $Computer$ by $user$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 15}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -16613,7 +16613,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - GetNetTcpconnection with PowerShell Script Block - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -16624,7 +16624,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 (Message = "*Get-NetTcpconnection*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getnettcpconnection_with_powershell_script_block_filter`
+search = `powershell` EventCode=4104 (ScriptBlockText = "*Get-NetTcpconnection*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getnettcpconnection_with_powershell_script_block_filter`
 
 [ESCU - GetWmiObject Ds Computer with PowerShell - Rule]
 action.escu = 0
@@ -16641,7 +16641,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetWmiObject Ds Computer with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Remote system discovery enumeration using WMI on $dest$ by $user$
@@ -16681,17 +16681,17 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_Computer` class parameter leverages WMI to query for all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-action.escu.creation_date = 2021-09-01
-action.escu.modification_date = 2021-09-01
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetWmiObject Ds Computer with PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
-action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
+action.risk.param._risk_message = Remote system discovery enumeration on $Computer$ by $UserID$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 15}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -16699,7 +16699,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - GetWmiObject Ds Computer with PowerShell Script Block - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -16716,7 +16716,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace root\\directory\\ldap*" AND Message="*class ds_computer*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_computer_with_powershell_script_block_filter`
+search = `powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace root\\directory\\ldap*" AND ScriptBlockText="*class ds_computer*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getwmiobject_ds_computer_with_powershell_script_block_filter`
 
 [ESCU - GetWmiObject Ds Group with PowerShell - Rule]
 action.escu = 0
@@ -16733,7 +16733,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetWmiObject Ds Group with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Domain group discovery enumeration on $dest$ by $user$
@@ -16773,16 +16773,16 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-action.escu.creation_date = 2021-08-25
-action.escu.modification_date = 2021-08-25
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetWmiObject Ds Group with PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
-action.risk.param._risk_message = Domain group discovery enumeration using PowerShell on $dest$ by $user$
+action.risk.param._risk_message = Domain group discovery enumeration using PowerShell on $Computer$ by $UserID$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
@@ -16808,7 +16808,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace root\\directory\\ldap*" AND Message="*class ds_group*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_group_with_powershell_script_block_filter`
+search = `powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace root\\directory\\ldap*" AND ScriptBlockText="*class ds_group*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getwmiobject_ds_group_with_powershell_script_block_filter`
 
 [ESCU - GetWmiObject DS User with PowerShell - Rule]
 action.escu = 0
@@ -16825,7 +16825,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetWmiObject DS User with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = an instance of process $process_name$ with commandline $process$ in $dest$
@@ -16865,17 +16865,17 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_User` class parameter leverages WMI to query for all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain users for situational awareness and Active Directory Discovery.
 action.escu.how_to_implement = he following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting.
-action.escu.creation_date = 2021-08-24
-action.escu.modification_date = 2021-08-24
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetWmiObject DS User with PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
-action.risk.param._risk_message = powershell process having commandline $Message$ for user enumeration
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 25}]
+action.risk.param._risk_message = powershell process having commandline $ScriptBlockText$ for user enumeration
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 25}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -16883,7 +16883,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - GetWmiObject DS User with PowerShell Script Block - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -16900,7 +16900,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*" Message = "*-namespace*" Message = "*root\\directory\\ldap*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter`
+search = `powershell` EventCode=4104 ScriptBlockText = "*get-wmiobject*" ScriptBlockText = "*ds_user*" ScriptBlockText = "*-namespace*" ScriptBlockText = "*root\\directory\\ldap*" | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter`
 
 [ESCU - GetWmiObject User Account with PowerShell - Rule]
 action.escu = 0
@@ -16917,7 +16917,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetWmiObject User Account with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Local user discovery enumeration using PowerShell on $dest$ by $user$
@@ -16946,22 +16946,22 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
 action.escu = 0
 action.escu.enabled = 1
 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters. The `Win32_UserAccount` parameter is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
-action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"]}
+action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001", "T1059.001"]}
 action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters. The `Win32_UserAccount` parameter is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-action.escu.creation_date = 2021-08-23
-action.escu.modification_date = 2021-08-23
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - GetWmiObject User Account with PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Active Directory Discovery"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Active Directory Discovery", "Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_message = Local user discovery enumeration using PowerShell on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
+action.risk.param._risk_message = Local user discovery enumeration using PowerShell on $Computer$ by $UserID$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 15}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -16969,7 +16969,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - GetWmiObject User Account with PowerShell Script Block - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery", "Malicious PowerShell"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087", "T1087.001", "T1059.001"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -16980,7 +16980,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 (Message="*Get-WmiObject*" AND Message="*Win32_UserAccount*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_user_account_with_powershell_script_block_filter`
+search = `powershell` EventCode=4104 (ScriptBlockText="*Get-WmiObject*" AND ScriptBlockText="*Win32_UserAccount*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `getwmiobject_user_account_with_powershell_script_block_filter`
 
 [ESCU - GPUpdate with no Command Line Arguments with Network - Rule]
 action.escu = 0
@@ -16997,7 +16997,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GPUpdate with no Command Line Arguments with Network - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Cobalt Strike"]
 action.risk = 1
 action.risk.param._risk_message = Process gpupdate.exe  with parent_process $parent_process_name$ is executed on $dest$ by user $user$, followed by an outbound network connection to $connection_to_CNC$ on port $dest_port$. This behaviour is seen with cobaltstrike.
@@ -17043,8 +17043,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Hide User Account From Sign-In Screen - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["XMRig", "Windows Registry Abuse"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["XMRig", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious registry modification ($registry_value_name$) which is used go hide a user account on the Windows Login screen detected on $dest$ executed by $user$
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "registry_value_name", "threat_object_type": "other"}]
@@ -17055,7 +17055,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Hide User Account From Sign-In Screen - Rule
-action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Windows Registry Abuse"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "registry_value_name", "role": ["Attacker"], "type": "Other"}]}
+action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Windows Registry Abuse", "Azorult"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "registry_value_name", "role": ["Attacker"], "type": "Other"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -17089,8 +17089,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Hiding Files And Directories With Attrib exe - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Persistence Techniques"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Persistence Techniques", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process", "threat_object_type": "other"}]
@@ -17101,7 +17101,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Hiding Files And Directories With Attrib exe - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Persistence"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1222", "T1222.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process", "role": ["Attacker", "Parent Process"], "type": "Other"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Persistence Techniques", "Azorult"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Persistence"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1222", "T1222.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process", "role": ["Attacker", "Parent Process"], "type": "Other"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -17135,7 +17135,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - High Frequency Copy Of Files In Network Share - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Information Sabotage", "Insider Threat"]
 action.risk = 1
 action.risk.param._risk_message = high frequency copy of document in network share $Share_Name$ from $Source_Address$ by $user$
@@ -17175,7 +17175,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - High Process Termination Frequency - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Clop Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = High frequency process termination (more than 15 processes within 3s) detected on host $Computer$
@@ -17235,7 +17235,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Hunting for Log4Shell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Log4Shell CVE-2021-44228"]
 action.risk = 1
 action.risk.param._risk_message = Hunting for Log4Shell exploitation has occurred.
@@ -17275,8 +17275,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Icacls Deny Command - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["XMRig"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["XMRig", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = Process name $process_name$ with deny argument executed by $user$ to change security permission of a specific file or directory on host $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}]
@@ -17287,7 +17287,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Icacls Deny Command - Rule
-action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Azorult"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -17321,7 +17321,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - ICACLS Grant Command - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["XMRig", "Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = Process name $process_name$ with grant argument executed by $user$ to change security permission of a specific file or directory on host $dest$
@@ -17367,7 +17367,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - IcedID Exfiltrated Archived File Creation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["IcedID"]
 action.risk = 1
 action.risk.param._risk_message = process $SourceImage$ create a file $TargetImage$ in host $Computer$
@@ -17407,7 +17407,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Impacket Lateral Movement Commandline Parameters - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Lateral Movement", "WhisperGate", "Industroyer2"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious command line parameters on $dest may represent a lateral movement attack with Impackets tools
@@ -17453,7 +17453,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Interactive Session on Remote Endpoint with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = An interactive session was opened on a remote endpoint from $ComputerName
@@ -17499,7 +17499,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Java Class File download by Java User Agent - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Log4Shell CVE-2021-44228"]
 action.risk = 1
 action.risk.param._risk_message = A Java user agent $http_user_agent$ was performing a $http_method$ to retrieve a remote class file.
@@ -17545,7 +17545,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Java Writing JSP File - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spring4Shell CVE-2022-22965", "Atlassian Confluence Server and Data Center CVE-2022-26134"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $process_name$ was identified on endpoint $dest$ writing a jsp file to disk, potentially indicative of exploitation.
@@ -17591,7 +17591,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Jscript Execution Using Cscript App - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["FIN7", "Remcos"]
 action.risk = 1
 action.risk.param._risk_message = Process name $process_name$ with commandline $process$ to execute jscript in $dest$
@@ -17637,7 +17637,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kerberoasting spn request with RC4 encryption - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Windows Privilege Escalation", "Active Directory Kerberos Attacks", "Hermetic Wiper"]
 action.risk = 1
 action.risk.param._risk_message = Potential kerberoasting attack via service principal name requests detected on $dest$
@@ -17683,7 +17683,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kerberos Pre-Authentication Flag Disabled in UserAccountControl - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = Kerberos Pre Authentication was Disabled for $Account_Name$
@@ -17729,7 +17729,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kerberos Pre-Authentication Flag Disabled with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = Kerberos Pre Authentication was Disabled using PowerShell on $dest$
@@ -17775,7 +17775,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kerberos Service Ticket Request Using RC4 Encryption - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = A Kerberos Service TTicket request with RC4 encryption was requested from $Client_Address$
@@ -17821,7 +17821,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kerberos TGT Request Using RC4 Encryption - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = A Kerberos TGT request with RC4 encryption was requested for $Account_Name$ from $Client_Address$
@@ -17867,7 +17867,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kerberos User Enumeration - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = Potential Kerberos based user enumeration attack $Client_Address$
@@ -17907,7 +17907,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Known Services Killed by Ransomware - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware", "BlackMatter Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = Known services $Message$ terminated by a potential ransomware on $dest$
@@ -17953,7 +17953,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Account Manipulation Of SSH Config and Keys - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Acidrain"]
 action.risk = 1
 action.risk.param._risk_message = a $process_name$ deleting a SSH key in $dest$
@@ -17993,7 +17993,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Add Files In Known Crontab Directories - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = a file $file_name$ is created in $file_path$ on $dest$
@@ -18033,7 +18033,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Add User Account - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A commandline $process$ that may create user account on $dest$
@@ -18073,7 +18073,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Adding Crontab Using List Parameter - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Industroyer2", "Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A possible crontab list command $process$ executed on $dest$
@@ -18113,7 +18113,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux At Allow Config File Creation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A file $file_name$ is created in $file_path$ on $dest$
@@ -18153,7 +18153,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux At Application Execution - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = At application was executed in $dest$
@@ -18193,7 +18193,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Change File Owner To Root - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A commandline $process$ that may change ownership to root on $dest$
@@ -18233,7 +18233,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Common Process For Elevation Control - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A commandline $process$ with process $process_name$ on $dest$
@@ -18273,7 +18273,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux DD File Overwrite - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Data Destruction", "Industroyer2"]
 action.risk = 1
 action.risk.param._risk_message = A commandline $process$ executed on $dest$
@@ -18319,7 +18319,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Deleting Critical Directory Using RM Command - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Industroyer2", "Data Destruction"]
 action.risk = 1
 action.risk.param._risk_message = A deletion in known critical list of folder using rm command $process$ executed on $dest$
@@ -18365,7 +18365,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Deletion Of Cron Jobs - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["AcidRain"]
 action.risk = 1
 action.risk.param._risk_message = a $process_name$ deleting cron jobs in $dest$
@@ -18405,7 +18405,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Deletion Of Init Daemon Script - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["AcidRain"]
 action.risk = 1
 action.risk.param._risk_message = a $process_name$ deleting a daemon script in $dest$
@@ -18451,7 +18451,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Deletion Of Services - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["AcidRain"]
 action.risk = 1
 action.risk.param._risk_message = a $process_name$ deleting a services in $dest$
@@ -18497,7 +18497,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Deletion of SSL Certificate - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Acidrain"]
 action.risk = 1
 action.risk.param._risk_message = a $process_name$ deleting a SSL certificate in $dest$
@@ -18537,7 +18537,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Disable Services - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Industroyer2"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable services on endpoint $dest$ by $user$.
@@ -18583,7 +18583,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Doas Conf File Creation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A file $file_name$ is created in $file_path$ on $dest$
@@ -18623,7 +18623,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Doas Tool Execution - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A doas $process_name$ with commandline $process$ was executed on $dest$
@@ -18663,7 +18663,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Edit Cron Table Parameter - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A possible crontab edit command $process$ executed on $dest$
@@ -18703,7 +18703,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux File Created In Kernel Driver Directory - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A file $file_name$ is created in $file_path$ on $dest$
@@ -18743,7 +18743,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux File Creation In Init Boot Directory - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A file $file_name$ is created in $file_path$ on $dest$
@@ -18783,7 +18783,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux File Creation In Profile Directory - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A file $file_name$ is created in $file_path$ on $dest$
@@ -18823,7 +18823,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux High Frequency Of File Deletion In Boot Folder - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Industroyer2", "Data Destruction"]
 action.risk = 1
 action.risk.param._risk_message = a $process_name$ deleting multiple files in /boot/ folder in $dest$
@@ -18869,7 +18869,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux High Frequency Of File Deletion In Etc Folder - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["AcidRain"]
 action.risk = 1
 action.risk.param._risk_message = a $process_name$ deleting multiple files in /etc/ folder in $dest$
@@ -18909,7 +18909,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Insert Kernel Module Using Insmod Utility - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A commandline $process$ that may install kernel module on $dest$
@@ -18949,7 +18949,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Install Kernel Module Using Modprobe Utility - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A commandline $process$ that may install kernel module on $dest$
@@ -18989,7 +18989,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Iptables Firewall Modification - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["CyclopsBLink"]
 action.risk = 1
 action.risk.param._risk_message = A commandline $process$ that may modify iptables firewall on $dest$
@@ -19029,7 +19029,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Java Spawning Shell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Hermetic Wiper", "Log4Shell CVE-2021-44228", "Spring4Shell CVE-2022-22965"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ spawning a Linux shell, potentially indicative of exploitation.
@@ -19075,7 +19075,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Kworker Process In Writable Process Path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["CyclopsBLink"]
 action.risk = 1
 action.risk.param._risk_message = a $process_name$ with kworker commandline in $dest$
@@ -19115,7 +19115,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux NOPASSWD Entry In Sudoers File - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = a commandline $process$ executed on $dest$
@@ -19155,7 +19155,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux pkexec Privilege Escalation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to a local privilege escalation in polkit pkexec.
@@ -19201,7 +19201,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Possible Access Or Modification Of sshd Config File - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = a commandline $process$ executed on $dest$
@@ -19241,7 +19241,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Possible Access To Credential Files - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A commandline $process$ executed on $dest$
@@ -19281,7 +19281,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Possible Access To Sudoers File - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A commandline $process$ executed on $dest$
@@ -19321,7 +19321,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Possible Append Command To At Allow Config File - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A commandline $process$ that may modify at allow config file in $dest$
@@ -19361,7 +19361,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Possible Append Command To Profile Config File - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = a commandline $process$ that may modify profile files in $dest$
@@ -19401,7 +19401,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Possible Append Cronjob Entry on Existing Cronjob File - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A commandline $process$ that may modify cronjob file in $dest$
@@ -19441,7 +19441,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Possible Cronjob Modification With Editor - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A commandline $process$ that may modify cronjob file using editor in $dest$
@@ -19481,7 +19481,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Possible Ssh Key File Creation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A file $file_name$ is created in $file_path$ on $dest$
@@ -19521,7 +19521,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Preload Hijack Library Calls - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A commandline $process$ that may hijack library function on $dest$
@@ -19567,7 +19567,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Service File Created In Systemd Directory - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A service file named as $file_path$ is created in systemd folder on $dest$
@@ -19607,7 +19607,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Service Restarted - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A commandline $process$ that may create or start a service on $dest$
@@ -19647,7 +19647,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Service Started Or Enabled - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = a commandline $process$ that may create or start a service on $dest
@@ -19687,7 +19687,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Setuid Using Chmod Utility - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = a commandline $process$ that may set suid or sgid on $dest$
@@ -19727,7 +19727,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Setuid Using Setcap Utility - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A commandline $process$ that may set suid or sgid on $dest$
@@ -19767,7 +19767,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Shred Overwrite Command - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Industroyer2", "Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A possible shred overwrite command $process$ executed on $dest$
@@ -19813,7 +19813,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Stop Services - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Industroyer2"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified attempting to stop services on endpoint $dest$ by $user$.
@@ -19859,7 +19859,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Sudo OR Su Execution - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A commandline $process$ that execute sudo or su in $dest$
@@ -19899,7 +19899,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Sudoers Tmp File Creation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A file $file_name$ is created in $file_path$ on $dest$
@@ -19939,7 +19939,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux System Network Discovery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Network Discovery", "Industroyer2"]
 action.risk = 1
 action.risk.param._risk_message = A commandline $process$ executed on $dest$
@@ -19979,7 +19979,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Visudo Utility Execution - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A commandline $process$ executed on $dest$
@@ -20004,6 +20004,52 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = visudo by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_visudo_utility_execution_filter`
 
+[ESCU - Living Off The Land - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following correlation identifies a distinct amount of analytics associated with the Living Off The Land analytic story that identify potentially suspicious behavior.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1105", "T1190", "T1059"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Risk"]
+action.escu.eli5 = The following correlation identifies a distinct amount of analytics associated with the Living Off The Land analytic story that identify potentially suspicious behavior.
+action.escu.how_to_implement = To implement this correlation search a user needs to enable all detections in the Living Off The Land Analytic Story and confirm it is generating risk events. A simple search `index=risk analyticstories="Living Off The Land"` should contain events.
+action.escu.known_false_positives = There are no known false positive for this search, but it could contain false positives as multiple detections can trigger and not have successful exploitation. Modify the static value distinct_detection_name to a higher value. It is also required to tune analytics that are also tagged to ensure volume is never too much.
+action.escu.creation_date = 2022-07-08
+action.escu.modification_date = 2022-07-08
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Living Off The Land - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Living Off The Land"]
+action.risk = 1
+action.risk.param._risk_message = An increase of Living Off The Land behavior has been detected on $affected_systems$
+action.risk.param._risk = [{"risk_object_field": "affected_systems", "risk_object_type": "system", "risk_score": 63}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Living Off The Land - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint"], "impact": 90, "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1105", "T1190", "T1059"], "nist": ["DE.CM"], "observable": [{"name": "affected_systems", "role": ["Victim"], "type": "Hostname"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following correlation identifies a distinct amount of analytics associated with the Living Off The Land analytic story that identify potentially suspicious behavior.
+action.notable.param.rule_title = Living Off The Land
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Risk.All_Risk where All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.annotations.mitre_attack.mitre_tactic source | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | stats  values(source) as detection_name values(annotations.mitre_attack.mitre_tactic) as tactics values(firstTime) as firstTime values(lastTime) as lastTime dc(annotations.mitre_attack.mitre_tactic) as distinct_tactics dc(source) as distinct_detection_name by risk_object | where distinct_detection_name >= 2 | `living_off_the_land_filter`
+
 [ESCU - Loading Of Dynwrapx Module - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -20019,7 +20065,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Loading Of Dynwrapx Module - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Remcos"]
 action.risk = 1
 action.risk.param._risk_message = dynwrapx.dll loaded by process $process_name$ on $Computer$
@@ -20065,7 +20111,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Local Account Discovery with Net - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Local user discovery enumeration on $dest$ by $user$
@@ -20105,7 +20151,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Local Account Discovery With Wmic - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Local user discovery enumeration on $dest$ by $user$
@@ -20145,7 +20191,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Log4Shell CVE-2021-44228 Exploitation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Log4Shell CVE-2021-44228"]
 action.risk = 1
 action.risk.param._risk_message = Log4Shell Exploitation detected against $affected_systems$
@@ -20191,7 +20237,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Logon Script Event Trigger Execution - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Persistence Techniques", "Windows Privilege Escalation", "Hermetic Wiper"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$
@@ -20237,7 +20283,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - MacOS LOLbin - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = Multiplle LOLbin are executed on host $host$ by user $user$
@@ -20283,7 +20329,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - MacOS plutil - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = plutil are executed on $host$ from $user$
@@ -20323,17 +20369,17 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
 action.escu.known_false_positives = unknown
-action.escu.creation_date = 2021-05-19
-action.escu.modification_date = 2021-05-19
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Mailsniper Invoke functions - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Data Exfiltration"]
 action.risk = 1
-action.risk.param._risk_message = mailsniper.ps1 functions $Message$ executed on a $ComputerName$ by user $user$.
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}]
+action.risk.param._risk_message = mailsniper.ps1 functions $ScriptBlockText$ executed on a $Computer$ by user $user$.
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -20341,7 +20387,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Mailsniper Invoke functions - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Data Exfiltration"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114", "T1114.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Data Exfiltration"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114", "T1114.001"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -20358,7 +20404,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*", "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*", "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mailsniper_invoke_functions_filter`
+search = `powershell` EventCode=4104 ScriptBlockText IN ("*Invoke-GlobalO365MailSearch*", "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*", "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mailsniper_invoke_functions_filter`
 
 [ESCU - Malicious InProcServer32 Modification - Rule]
 action.escu = 0
@@ -20375,7 +20421,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Malicious InProcServer32 Modification - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Remcos"]
 action.risk = 1
 action.risk.param._risk_message = The $process_name$ was identified on endpoint $dest$ modifying the registry with a known malicious clsid under InProcServer32.
@@ -20421,7 +20467,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Malicious Powershell Executed As A Service - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Malicious Powershell"]
 action.risk = 1
 action.risk.param._risk_message = Identifies the abuse the Windows SC.exe to execute malicious powerShell as a service $Service_File_Name$ by $user$ on $dest$
@@ -20473,7 +20519,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Malicious PowerShell Process - Encoded Command - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell", "NOBELIUM Group", "WhisperGate"]
 action.risk = 1
 action.risk.param._risk_message = Powershell.exe running potentially malicious encodede commands on $dest$
@@ -20513,7 +20559,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["DHS Report TA18-074A", "HAFNIUM Group"]
 action.risk = 1
 action.risk.param._risk_message = PowerShell local execution policy bypass attempt on $dest$
@@ -20559,7 +20605,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell"]
 action.risk = 1
 action.risk.param._risk_message = Powershell.exe running with potential obfuscated arguments on $dest$
@@ -20605,7 +20651,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Mimikatz PassTheTicket CommandLine Parameters - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = Mimikatz command line parameters for pass the ticket attacks were used on $dest$
@@ -20640,7 +20686,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
 action.escu = 0
 action.escu.enabled = 1
 description = The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the DCOM protocol and the MMC20 COM object, the executed command is spawned as a child processs of `mmc.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of mmc.exe that are part of the LOLBAS project can help defenders identify lateral movement activity.
-action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003"]}
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003", "T1218.014"]}
 action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the DCOM protocol and the MMC20 COM object, the executed command is spawned as a child processs of `mmc.exe`. The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code. Looking for child processes of mmc.exe that are part of the LOLBAS project can help defenders identify lateral movement activity.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
@@ -20651,10 +20697,10 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Mmc LOLBAS Execution Process Spawn - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Lateral Movement", "Living Off The Land"]
 action.risk = 1
-action.risk.param._risk_message = Mmc.exe spawned a LOLBAS process on $dest
+action.risk.param._risk_message = Mmc.exe spawned a LOLBAS process on $dest$.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 54}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
@@ -20663,7 +20709,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Mmc LOLBAS Execution Process Spawn - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "Living Off The Land"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "Living Off The Land"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003", "T1218.014"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -20697,7 +20743,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Modification Of Wallpaper - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware", "Revil Ransomware", "BlackMatter Ransomware", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = Wallpaper modification on $dest$
@@ -20743,7 +20789,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Modify ACL permission To Files Or Folder - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious ACL permission modification on $dest$
@@ -20783,7 +20829,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Monitor Registry Keys for Print Monitors - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows Persistence Techniques", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = New print monitor added on $dest$
@@ -20829,7 +20875,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - MS Scripting Process Loading Ldap Module - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["FIN7"]
 action.risk = 1
 action.risk.param._risk_message = $process_name$ loading ldap modules $ImageLoaded$ in $dest$
@@ -20869,7 +20915,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - MS Scripting Process Loading WMI Module - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["FIN7"]
 action.risk = 1
 action.risk.param._risk_message = $process_name$ loading wmi modules $ImageLoaded$ in $dest$
@@ -20909,7 +20955,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - MSBuild Suspicious Spawned By Script Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild"]
 action.risk = 1
 action.risk.param._risk_message = Msbuild.exe process spawned by $parent_process_name$ on $dest$ executed by $user$
@@ -20955,7 +21001,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Trickbot", "IcedID", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = a mshta parent process $parent_process_name$ spawn child process $process_name$ in host $dest$
@@ -21001,7 +21047,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - MSHTML Module Load in Office Product - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $process_name$ was identified on endpoint $dest$ loading mshtml.dll.
@@ -21057,7 +21103,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - MSI Module Loaded by Non-System Binary - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Windows Privilege Escalation", "Hermetic Wiper"]
 action.risk = 1
 action.risk.param._risk_message = The following module $ImageLoaded$ was loaded by $Image$ outside of the normal system paths on endpoint $Computer$, potentally related to DLL side-loading.
@@ -21097,7 +21143,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Msmpeng Application DLL Side Loading - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware", "Revil Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = 
@@ -21149,7 +21195,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Password Spraying"]
 action.risk = 1
 action.risk.param._risk_message = Potential NTLM based password spraying attack from $Source_Workstation$
@@ -21195,7 +21241,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Password Spraying", "Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$
@@ -21241,7 +21287,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Password Spraying"]
 action.risk = 1
 action.risk.param._risk_message = Potential NTLM based password spraying attack from $Source_Workstation$
@@ -21287,7 +21333,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Multiple Users Failing To Authenticate From Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Password Spraying", "Insider Threat"]
 action.risk = 1
 action.risk.param._risk_message = Potential password spraying attack from $ComputerName$
@@ -21333,7 +21379,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Password Spraying"]
 action.risk = 1
 action.risk.param._risk_message = Potential password spraying attack on $ComputerName$
@@ -21373,8 +21419,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Net Localgroup Discovery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Active Directory Discovery", "Windows Discovery Techniques"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Active Directory Discovery", "Windows Discovery Techniques", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = Local group discovery on $dest$ by $user$.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}]
@@ -21385,7 +21431,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Net Localgroup Discovery - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery", "Windows Discovery Techniques"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery", "Windows Discovery Techniques", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -21413,7 +21459,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - NET Profiler UAC bypass - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
@@ -21459,7 +21505,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Network Connection Discovery With Arp - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Network Connection discovery on $dest$ by $user$
@@ -21499,8 +21545,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Network Connection Discovery With Net - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Active Directory Discovery"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Active Directory Discovery", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = Network Connection discovery on $dest$ by $user$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
@@ -21511,7 +21557,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Network Connection Discovery With Net - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1049"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -21539,7 +21585,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Network Connection Discovery With Netstat - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Network Connection discovery on $dest$ by $user$
@@ -21579,7 +21625,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Network Discovery Using Route Windows App - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Network Connection discovery on $dest$ by $user$
@@ -21619,7 +21665,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Nishang PowershellTCPOneLine - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["HAFNIUM Group"]
 action.risk = 1
 action.risk.param._risk_message = Possible Nishang Invoke-PowerShellTCPOneLine behavior on $dest$
@@ -21665,7 +21711,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - NLTest Domain Trust Discovery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ryuk Ransomware", "Domain Trust Discovery", "IcedID", "Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Domain trust discovery execution on $dest$
@@ -21711,7 +21757,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Non Chrome Process Accessing Chrome Default Dir - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["FIN7", "Remcos"]
 action.risk = 1
 action.risk.param._risk_message = a non firefox browser process $process_name$ accessing $Object_Name$
@@ -21751,8 +21797,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Non Firefox Process Access Firefox Profile Dir - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["FIN7", "Remcos"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["FIN7", "Remcos", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = a non firefox browser process $process_name$ accessing $Object_Name$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 35}]
@@ -21763,7 +21809,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Non Firefox Process Access Firefox Profile Dir - Rule
-action.correlationsearch.annotations = {"analytic_story": ["FIN7", "Remcos"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1555", "T1555.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["FIN7", "Remcos", "Azorult"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1555", "T1555.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -21795,7 +21841,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Ntdsutil Export NTDS - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = Active Directory NTDS export on $dest$
@@ -21843,7 +21889,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Office Application Drop Executable - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["FIN7"]
 action.risk = 1
 action.risk.param._risk_message = process $process_name$ drops a file $TargetFilename$ in host $dest$
@@ -21889,7 +21935,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Office Application Spawn Regsvr32 process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["IcedID"]
 action.risk = 1
 action.risk.param._risk_message = Office application spawning regsvr32.exe on $dest$
@@ -21935,7 +21981,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Office Application Spawn rundll32 process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments", "Trickbot", "IcedID"]
 action.risk = 1
 action.risk.param._risk_message = Office application spawning rundll32.exe on $dest$
@@ -21981,7 +22027,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Office Document Creating Schedule Task - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
 action.risk.param._risk_message = Office document creating a schedule task on $dest$
@@ -22027,7 +22073,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Office Document Executing Macro Code - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments", "Trickbot", "IcedID"]
 action.risk = 1
 action.risk.param._risk_message = Office document executing a macro on $dest$
@@ -22073,7 +22119,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Office Document Spawned Child Process To Download - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
 action.risk.param._risk_message = Office document spawning suspicious child process on $dest$
@@ -22119,7 +22165,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Office Product Spawn CMD Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Trickbot"]
 action.risk = 1
 action.risk.param._risk_message = an office product parent process $parent_process_name$ spawn child process $process_name$ in host $dest$
@@ -22165,7 +22211,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Office Product Spawning BITSAdmin - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
 action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$
@@ -22211,7 +22257,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Office Product Spawning CertUtil - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
 action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$
@@ -22257,7 +22303,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Office Product Spawning MSHTA - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments", "IcedID"]
 action.risk = 1
 action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$
@@ -22303,7 +22349,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Office Product Spawning Rundll32 with no DLL - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
 action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ and no dll commandline $process$ in host $dest$
@@ -22349,7 +22395,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Office Product Spawning Wmic - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments", "FIN7"]
 action.risk = 1
 action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$
@@ -22389,13 +22435,13 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = The following analytic identifies behavior related to CVE-2021-40444. Whereas the malicious document will load ActiveX and download the remote payload (.inf, .cab). During triage, review parallel processes and further activity on endpoint to identify additional patterns. Retrieve the file modifications and analyze further.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node.
 action.escu.known_false_positives = The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
-action.escu.creation_date = 2021-09-10
-action.escu.modification_date = 2021-09-10
+action.escu.creation_date = 2022-07-07
+action.escu.modification_date = 2022-07-07
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Office Product Writing cab or inf - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $process_name$ was identified on $dest$ writing an inf or cab file to this. This is not typical of $process_name$.
@@ -22424,7 +22470,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.inf","*.cab") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process] | dedup file_create_time | table dest, process_name, process, file_create_time, file_name, file_path | `office_product_writing_cab_or_inf_filter`
+search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.inf","*.cab") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields _time dest file_create_time file_name file_path process_name process_path process proc_guid] | dedup file_create_time | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid | `office_product_writing_cab_or_inf_filter`
 
 [ESCU - Office Spawning Control - Rule]
 action.escu = 0
@@ -22441,7 +22487,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Office Spawning Control - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ clicking a suspicious attachment.
@@ -22487,7 +22533,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Outbound Network Connection from Java Using Default Ports - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Log4Shell CVE-2021-44228"]
 action.risk = 1
 action.risk.param._risk_message = Java performed outbound connections to default ports of LDAP or RMI on $dest$
@@ -22533,7 +22579,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Overwriting Accessibility Binaries - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Privilege Escalation", "Hermetic Wiper"]
 action.risk = 1
 action.risk.param._risk_message = A suspicious file modification or replace in $file_path$  in host $dest$
@@ -22579,7 +22625,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Password Policy Discovery with Net - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = an instance of process $process_name$ with commandline $process$ in $dest$
@@ -22619,7 +22665,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Permission Modification using Takeown App - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = A suspicious of execution of $process_name$ with process id $process_id$ and commandline $process$ to modify permission of directory or files in host $dest$
@@ -22671,7 +22717,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - PetitPotam Network Share Access Request - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["PetitPotam NTLM Relay on Active Directory Certificate Services"]
 action.risk = 1
 action.risk.param._risk_message = A remote host is enumerating a $dest$ to identify permissions. This is a precursor event to CVE-2021-36942, PetitPotam.
@@ -22720,7 +22766,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - PetitPotam Suspicious Kerberos TGT Request - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["PetitPotam NTLM Relay on Active Directory Certificate Services", "Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = A Kerberos TGT was requested in a non-standard manner against $dest$, potentially related to CVE-2021-36942, PetitPotam.
@@ -22766,7 +22812,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Ping Sleep Batch Command - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["WhisperGate"]
 action.risk = 1
 action.risk.param._risk_message = suspicious $process$ commandline run in $dest$
@@ -22806,7 +22852,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Possible Browser Pass View Parameter - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Remcos"]
 action.risk = 1
 action.risk.param._risk_message = suspicious process $process_name$ contains commandline $process$ on $dest$
@@ -22835,7 +22881,7 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
 action.escu = 0
 action.escu.enabled = 1
 description = The following analytic assists with identifying a PowerShell process spawned as a child or grand child process of commonly abused processes during lateral movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe` and `mmc.exe`. Legitimate Windows features such as the Service Control Manager, Windows Management Instrumentation, Task Scheduler, Windows Remote Management and the DCOM protocol can be abused to start a process on a remote endpoint. Looking for PowerShell spawned out of this processes may reveal a lateral movement attack. Red Teams and adversaries alike may abuse these services during a breach for lateral movement and remote code execution.
-action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003", "T1021.006", "T1047", "T1053.005", "T1543.003", "T1059.001"]}
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003", "T1021.006", "T1047", "T1053.005", "T1543.003", "T1059.001", "T1218.014"]}
 action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = The following analytic assists with identifying a PowerShell process spawned as a child or grand child process of commonly abused processes during lateral movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe` and `mmc.exe`. Legitimate Windows features such as the Service Control Manager, Windows Management Instrumentation, Task Scheduler, Windows Remote Management and the DCOM protocol can be abused to start a process on a remote endpoint. Looking for PowerShell spawned out of this processes may reveal a lateral movement attack. Red Teams and adversaries alike may abuse these services during a breach for lateral movement and remote code execution.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints.
@@ -22846,7 +22892,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Possible Lateral Movement PowerShell Spawn - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Hermetic Wiper", "Active Directory Lateral Movement", "Malicious PowerShell"]
 action.risk = 1
 action.risk.param._risk_message = A PowerShell process was spawned as a child process of typically abused processes on $dest$
@@ -22858,7 +22904,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Possible Lateral Movement PowerShell Spawn - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Active Directory Lateral Movement", "Malicious PowerShell"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003", "T1021.006", "T1047", "T1053.005", "T1543.003", "T1059.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Active Directory Lateral Movement", "Malicious PowerShell"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003", "T1021.006", "T1047", "T1053.005", "T1543.003", "T1059.001", "T1218.014"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -22892,7 +22938,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Potential password in username - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Credential Dumping", "Insider Threat"]
 action.risk = 1
 action.risk.param._risk_message = Potential password in username ($user$) with Shannon entropy ($ut_shannon$)
@@ -22932,7 +22978,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Potentially malicious code on commandline - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Command-Line Executions"]
 action.risk = 1
 action.risk.param._risk_message = Unusual command-line execution with hallmarks of malicious activity run by $user$ found on $dest$ with commandline $process$
@@ -22966,17 +23012,17 @@ action.escu.data_models = []
 action.escu.eli5 = The following Hunting analytic assists with identifying suspicious PowerShell execution using Script Block Logging, or EventCode 4104. This analytic is not meant to be ran hourly, but occasionally to identify malicious or suspicious PowerShell. This analytic is a combination of work completed by Alex Teixeira and Splunk Threat Research Team.
 action.escu.how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 action.escu.known_false_positives = Limited false positives. May filter as needed.
-action.escu.creation_date = 2021-08-18
-action.escu.modification_date = 2021-08-18
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - PowerShell 4104 Hunting - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing suspicious commands.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $Computer$ by user $user$ executing suspicious commands.
+action.risk.param._risk = [{"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -22984,7 +23030,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - PowerShell 4104 Hunting - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "UserID", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -22995,7 +23041,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 | eval DoIt = if(match(Message,"(?i)(\$doit)"), "4", 0) | eval enccom=if(match(Message,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)") OR match(Message, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) | eval suspcmdlet=if(match(Message, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-Jboss|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|get-net\S+|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|Kerberos.*(policy|ticket)|netfirewall|Uninstall-Windows|Verb\s+Runas|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0) | eval base64 = if(match(lower(Message),"frombase64"), "4", 0) | eval empire=if(match(lower(Message),"system.net.webclient") AND match(lower(Message), "frombase64string") ,5,0) | eval mimikatz=if(match(lower(Message),"mimikatz") OR match(lower(Message), "-dumpcr") OR match(lower(Message), "SEKURLSA::Pth") OR match(lower(Message), "kerberos::ptt") OR match(lower(Message), "kerberos::golden") ,5,0) | eval iex = if(match(lower(Message),"iex"), "2", 0) | eval webclient=if(match(lower(Message),"http") OR match(lower(Message),"web(client|request)") OR match(lower(Message),"socket") OR match(lower(Message),"download(file|string)") OR match(lower(Message),"bitstransfer") OR match(lower(Message),"internetexplorer.application") OR match(lower(Message),"xmlhttp"),5,0) | eval get = if(match(lower(Message),"get-"), "1", 0) | eval rundll32 = if(match(lower(Message),"rundll32"), "4", 0) | eval suspkeywrd=if(match(Message, "(?i)(bitstransfer|mimik|metasp|AssemblyBuilderAccess|Reflection\.Assembly|shellcode|injection|cnvert|shell\.application|start-process|Rc4ByteStream|System\.Security\.Cryptography|lsass\.exe|localadmin|LastLoggedOn|hijack|BackupPrivilege|ngrok|comsvcs|backdoor|brute.?force|Port.?Scan|Exfiltration|exploit|DisableRealtimeMonitoring|beacon)"),1,0) | eval syswow64 = if(match(lower(Message),"syswow64"), "3", 0) | eval httplocal = if(match(lower(Message),"http://127.0.0.1"), "4", 0) | eval reflection = if(match(lower(Message),"reflection"), "1", 0) | eval invokewmi=if(match(lower(Message), "(?i)(wmiobject|WMIMethod|RemoteWMI|PowerShellWmi|wmicommand)"),5,0) | eval downgrade=if(match(Message, "(?i)([-]ve*r*s*i*o*n*\s+2)") OR match(lower(Message),"powershell -version"),3,0) | eval compressed=if(match(Message, "(?i)GZipStream|::Decompress|IO.Compression|write-zip|(expand|compress)-Archive"),5,0) | eval invokecmd = if(match(lower(Message),"invoke-command"), "4", 0) | addtotals fieldname=Score DoIt, enccom, suspcmdlet, suspkeywrd, compressed, downgrade, mimikatz, iex, empire, rundll32, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get | stats values(Score) by DoIt, enccom, compressed, downgrade, iex, mimikatz, rundll32, empire, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get, suspcmdlet, suspkeywrd | `powershell_4104_hunting_filter`
+search = `powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"), "4", 0) | eval enccom=if(match(ScriptBlockText,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)") OR match(ScriptBlockText, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) | eval suspcmdlet=if(match(ScriptBlockText, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-Jboss|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|get-net\S+|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|Kerberos.*(policy|ticket)|netfirewall|Uninstall-Windows|Verb\s+Runas|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0) | eval base64 = if(match(lower(ScriptBlockText),"frombase64"), "4", 0) | eval empire=if(match(lower(ScriptBlockText),"system.net.webclient") AND match(lower(ScriptBlockText), "frombase64string") ,5,0) | eval mimikatz=if(match(lower(ScriptBlockText),"mimikatz") OR match(lower(ScriptBlockText), "-dumpcr") OR match(lower(ScriptBlockText), "SEKURLSA::Pth") OR match(lower(ScriptBlockText), "kerberos::ptt") OR match(lower(ScriptBlockText), "kerberos::golden") ,5,0) | eval iex = if(match(lower(ScriptBlockText),"iex"), "2", 0) | eval webclient=if(match(lower(ScriptBlockText),"http") OR match(lower(ScriptBlockText),"web(client|request)") OR match(lower(ScriptBlockText),"socket") OR match(lower(ScriptBlockText),"download(file|string)") OR match(lower(ScriptBlockText),"bitstransfer") OR match(lower(ScriptBlockText),"internetexplorer.application") OR match(lower(ScriptBlockText),"xmlhttp"),5,0) | eval get = if(match(lower(ScriptBlockText),"get-"), "1", 0) | eval rundll32 = if(match(lower(ScriptBlockText),"rundll32"), "4", 0) | eval suspkeywrd=if(match(ScriptBlockText, "(?i)(bitstransfer|mimik|metasp|AssemblyBuilderAccess|Reflection\.Assembly|shellcode|injection|cnvert|shell\.application|start-process|Rc4ByteStream|System\.Security\.Cryptography|lsass\.exe|localadmin|LastLoggedOn|hijack|BackupPrivilege|ngrok|comsvcs|backdoor|brute.?force|Port.?Scan|Exfiltration|exploit|DisableRealtimeMonitoring|beacon)"),1,0) | eval syswow64 = if(match(lower(ScriptBlockText),"syswow64"), "3", 0) | eval httplocal = if(match(lower(ScriptBlockText),"http://127.0.0.1"), "4", 0) | eval reflection = if(match(lower(ScriptBlockText),"reflection"), "1", 0) | eval invokewmi=if(match(lower(ScriptBlockText), "(?i)(wmiobject|WMIMethod|RemoteWMI|PowerShellWmi|wmicommand)"),5,0) | eval downgrade=if(match(ScriptBlockText, "(?i)([-]ve*r*s*i*o*n*\s+2)") OR match(lower(ScriptBlockText),"powershell -version"),3,0) | eval compressed=if(match(ScriptBlockText, "(?i)GZipStream|::Decompress|IO.Compression|write-zip|(expand|compress)-Archive"),5,0) | eval invokecmd = if(match(lower(ScriptBlockText),"invoke-command"), "4", 0) | addtotals fieldname=Score DoIt, enccom, suspcmdlet, suspkeywrd, compressed, downgrade, mimikatz, iex, empire, rundll32, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get | stats values(Score) by DoIt, enccom, compressed, downgrade, iex, mimikatz, rundll32, empire, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get, suspcmdlet, suspkeywrd | `powershell_4104_hunting_filter`
 
 [ESCU - PowerShell - Connect To Internet With Hidden Window - Rule]
 action.escu = 0
@@ -23012,7 +23058,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - PowerShell - Connect To Internet With Hidden Window - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "HAFNIUM Group", "Log4Shell CVE-2021-44228"]
 action.risk = 1
 action.risk.param._risk_message = PowerShell processes $process$ started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet on host $dest$ executed by user $user$.
@@ -23041,22 +23087,22 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
 action.escu = 0
 action.escu.enabled = 1
 description = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using the `mutex` function. This function is commonly seen in some obfuscated PowerShell scripts to make sure that only one instance of there process is running on a compromise machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
-action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027", "T1027.005"]}
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027", "T1027.005", "T1059.001"]}
 action.escu.data_models = []
 action.escu.eli5 = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using the `mutex` function. This function is commonly seen in some obfuscated PowerShell scripts to make sure that only one instance of there process is running on a compromise machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = powershell developer may used this function in their script for instance checking too.
-action.escu.creation_date = 2021-06-10
-action.escu.modification_date = 2021-06-10
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Powershell Creating Thread Mutex - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_message = A suspicious powershell script contains Thread Mutex in $Message$ with EventCode $EventCode$ in host $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 40}]
+action.risk.param._risk_message = A suspicious powershell script contains Thread Mutex in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 40}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -23064,7 +23110,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Powershell Creating Thread Mutex - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027", "T1027.005"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027", "T1027.005", "T1059.001"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "UserID", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -23081,7 +23127,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message = "*Threading.Mutex*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`
+search = `powershell` EventCode=4104 ScriptBlockText = "*Threading.Mutex*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`
 
 [ESCU - Powershell Disable Security Monitoring - Rule]
 action.escu = 0
@@ -23092,13 +23138,13 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 action.escu.known_false_positives = Limited false positives. However, tune based on scripts that may perform this action.
-action.escu.creation_date = 2021-07-05
-action.escu.modification_date = 2021-07-05
+action.escu.creation_date = 2022-07-15
+action.escu.modification_date = 2022-07-15
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Powershell Disable Security Monitoring - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware", "Revil Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = 
@@ -23127,7 +23173,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process="*set-mppreference*" AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*") by Processes.dest Processes.user Processes.parent_process Processes.original_file_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_disable_security_monitoring_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process="*set-mppreference*" AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*","*DisableBehaviorMonitoring*","*drtm *","*dioavp *","*dscrptsc *","*dbaf *","*dbm *") by Processes.dest Processes.user Processes.parent_process Processes.original_file_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_disable_security_monitoring_filter`
 
 [ESCU - PowerShell Domain Enumeration - Rule]
 action.escu = 0
@@ -23142,17 +23188,17 @@ This analytic identifies specific PowerShell modules typically used to enumerate
 During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = It is possible there will be false positives, filter as needed.
-action.escu.creation_date = 2021-06-10
-action.escu.modification_date = 2021-06-10
+action.escu.creation_date = 2022-02-25
+action.escu.modification_date = 2022-02-25
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - PowerShell Domain Enumeration - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_message = A suspicious powershell script contains domain enumeration command in $Message$ with EventCode $EventCode$ in host $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 42}]
+action.risk.param._risk_message = A suspicious powershell script contains domain enumeration command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 42}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -23160,7 +23206,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - PowerShell Domain Enumeration - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 60, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 60, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "UserID", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -23179,7 +23225,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message IN (*get-netdomaintrust*, *get-netforesttrust*, *get-addomain*, *get-adgroupmember*, *get-domainuser*) | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_domain_enumeration_filter`
+search = `powershell` EventCode=4104 ScriptBlockText IN (*get-netdomaintrust*, *get-netforesttrust*, *get-addomain*, *get-adgroupmember*, *get-domainuser*) | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_domain_enumeration_filter`
 
 [ESCU - Powershell Enable SMB1Protocol Feature - Rule]
 action.escu = 0
@@ -23190,13 +23236,13 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the compromise network system.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
 action.escu.known_false_positives = network operator may enable or disable this windows feature.
-action.escu.creation_date = 2021-06-22
-action.escu.modification_date = 2021-06-22
+action.escu.creation_date = 2022-02-25
+action.escu.modification_date = 2022-02-25
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Powershell Enable SMB1Protocol Feature - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell", "Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = Powershell Enable SMB1Protocol Feature
@@ -23225,13 +23271,13 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message = "*Enable-WindowsOptionalFeature*" Message = "*SMB1Protocol*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_enable_smb1protocol_feature_filter`
+search = `powershell` EventCode=4104 ScriptBlockText = "*Enable-WindowsOptionalFeature*" ScriptBlockText = "*SMB1Protocol*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_enable_smb1protocol_feature_filter`
 
 [ESCU - Powershell Execute COM Object - Rule]
 action.escu = 0
 action.escu.enabled = 1
 description = This search is to detect a COM CLSID execution through powershell. This technique was seen in several adversaries and malware like ransomware conti where it has a feature to execute command using COM Object. This technique may use by network operator at some cases but a good indicator if some application want to gain privilege escalation or bypass uac.
-action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.015", "T1546"]}
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.015", "T1546", "T1059.001"]}
 action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This search is to detect a COM CLSID execution through powershell. This technique was seen in several adversaries and malware like ransomware conti where it has a feature to execute command using COM Object. This technique may use by network operator at some cases but a good indicator if some application want to gain privilege escalation or bypass uac.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
@@ -23242,11 +23288,11 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Powershell Execute COM Object - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell", "Ransomware"]
 action.risk = 1
-action.risk.param._risk_message = A suspicious powershell script contains COM CLSID command in $Message$ with EventCode $EventCode$ in host $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 5}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 5}]
+action.risk.param._risk_message = A suspicious powershell script contains COM CLSID command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 5}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 5}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -23254,7 +23300,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Powershell Execute COM Object - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell", "Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 10, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.015", "T1546"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell", "Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 10, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.015", "T1546", "T1059.001"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -23288,17 +23334,17 @@ In use, `$var_gpa = $var_unsafe_native_methods.GetMethod(GetProcAddress` and lat
 During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = Limited false positives. Filter as needed.
-action.escu.creation_date = 2021-06-08
-action.escu.modification_date = 2021-06-08
+action.escu.creation_date = 2022-02-25
+action.escu.modification_date = 2022-02-25
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_message = A suspicious powershell script contains GetProcAddress API in $Message$ with EventCode $EventCode$ in host $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 48}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 48}]
+action.risk.param._risk_message = A suspicious powershell script contains GetProcAddress API in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 48}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 48}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -23306,7 +23352,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1055", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1055", "T1059.001"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -23326,7 +23372,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message=*getprocaddress* | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_process_injection_via_getprocaddress_filter`
+search = `powershell` EventCode=4104 ScriptBlockText=*getprocaddress* | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_process_injection_via_getprocaddress_filter`
 
 [ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule]
 action.escu = 0
@@ -23343,13 +23389,13 @@ Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String(38uqIy
 During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = False positives should be limited. Filter as needed.
-action.escu.creation_date = 2021-06-08
-action.escu.modification_date = 2021-06-08
+action.escu.creation_date = 2022-04-26
+action.escu.modification_date = 2022-04-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell"]
 action.risk = 1
 action.risk.param._risk_message = A suspicious powershell script contains base64 command in $Message$ with EventCode $EventCode$ in host $ComputerName$
@@ -23381,7 +23427,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message=*frombase64string* | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter`
+search = `powershell` EventCode=4104 ScriptBlockText=*frombase64string* | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter`
 
 [ESCU - PowerShell Get LocalGroup Discovery - Rule]
 action.escu = 0
@@ -23398,7 +23444,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - PowerShell Get LocalGroup Discovery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Local group discovery on $dest$ by $user$.
@@ -23436,13 +23482,13 @@ This analytic identifies PowerShell cmdlet - `get-localgroup` being ran. Typical
 During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = False positives may be present. Tune as needed.
-action.escu.creation_date = 2021-09-14
-action.escu.modification_date = 2021-09-14
+action.escu.creation_date = 2022-04-26
+action.escu.modification_date = 2022-04-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Powershell Get LocalGroup Discovery with Script Block Logging - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Local group discovery on $dest$ by $user$.
@@ -23465,7 +23511,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message = "*get-localgroup*" | stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_with_script_block_logging_filter`
+search = `powershell` EventCode=4104 ScriptBlockText = "*get-localgroup*" | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_with_script_block_logging_filter`
 
 [ESCU - PowerShell Loading DotNET into Memory via Reflection - Rule]
 action.escu = 0
@@ -23480,17 +23526,17 @@ This analytic identifies the use of PowerShell loading .net assembly via reflect
 During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = False positives should be limited as day to day scripts do not use this method.
-action.escu.creation_date = 2021-06-10
-action.escu.modification_date = 2021-06-10
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - PowerShell Loading DotNET into Memory via Reflection - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_message = A suspicious powershell script contains reflective class assembly  command in $Message$ to load .net code in memory with EventCode $EventCode$ in host $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 56}]
+action.risk.param._risk_message = A suspicious powershell script contains reflective class assembly command in $ScriptBlockText$ to load .net code in memory with EventCode $EventCode$ in host $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 56}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -23498,7 +23544,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - PowerShell Loading DotNET into Memory via Reflection - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "UserID", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -23517,7 +23563,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*") | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_reflection_filter`
+search = `powershell` EventCode=4104 ScriptBlockText IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*", "*reflection.assembly*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_reflection_filter`
 
 [ESCU - Powershell Processing Stream Of Data - Rule]
 action.escu = 0
@@ -23528,17 +23574,17 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is processing compressed stream data. This is typically found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files that are stream flattened and will be deflated durnig execution. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = powershell may used this function to process compressed data.
-action.escu.creation_date = 2021-06-10
-action.escu.modification_date = 2021-06-10
+action.escu.creation_date = 2022-02-25
+action.escu.modification_date = 2022-02-25
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Powershell Processing Stream Of Data - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_message = A suspicious powershell script contains stream command in $Message$ commonly for processing compressed or to decompressed binary file with EventCode $EventCode$ in host $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 40}]
+action.risk.param._risk_message = A suspicious powershell script contains stream command in $ScriptBlockText$ commonly for processing compressed or to decompressed binary file with EventCode $EventCode$ in host $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 40}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -23546,7 +23592,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Powershell Processing Stream Of Data - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "UserID", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -23563,7 +23609,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*" OR Message = "*]::Decompress*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`
+search = `powershell` EventCode=4104 ScriptBlockText = "*IO.Compression.*" OR ScriptBlockText = "*IO.StreamReader*" OR ScriptBlockText = "*]::Decompress*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`
 
 [ESCU - Powershell Remote Thread To Known Windows Process - Rule]
 action.escu = 0
@@ -23580,7 +23626,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Powershell Remote Thread To Known Windows Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Trickbot"]
 action.risk = 1
 action.risk.param._risk_message = A suspicious powershell process $process_name$ that tries to create a remote thread on target process $TargetImage$ with eventcode $EventCode$ in host $Computer$
@@ -23620,17 +23666,17 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This analytic will identify a suspicious PowerShell command used to delete the Windows Defender folder. This technique was seen used by the WhisperGate malware campaign where it used Nirsofts advancedrun.exe to gain administrative privileges to then execute a PowerShell command to delete the Windows Defender folder. This is a good indicator the offending process is trying corrupt a Windows Defender installation.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = unknown
-action.escu.creation_date = 2022-01-18
-action.escu.modification_date = 2022-01-18
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Powershell Remove Windows Defender Directory - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["WhisperGate"]
 action.risk = 1
-action.risk.param._risk_message = suspicious powershell script $Message$ was executed on the $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 90}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 90}]
+action.risk.param._risk_message = suspicious powershell script $ScriptBlockText$ was executed on the $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 90}, {"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 90}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -23638,7 +23684,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Powershell Remove Windows Defender Directory - Rule
-action.correlationsearch.annotations = {"analytic_story": ["WhisperGate"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["WhisperGate"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "UserID", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -23655,7 +23701,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message = "*rmdir *" AND Message = "*\\Microsoft\\Windows Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remove_windows_defender_directory_filter` 
+search = `powershell` EventCode=4104 ScriptBlockText = "*rmdir *" AND ScriptBlockText = "*\\Microsoft\\Windows Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_remove_windows_defender_directory_filter` 
 
 [ESCU - PowerShell Start-BitsTransfer - Rule]
 action.escu = 0
@@ -23672,7 +23718,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - PowerShell Start-BitsTransfer - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["BITS Jobs"]
 action.risk = 1
 action.risk.param._risk_message = A suspicious process $process_name$ with commandline $process$ that are related to bittransfer functionality in host $dest$
@@ -23718,11 +23764,11 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Powershell Using memory As Backing Store - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_message = A suspicious powershell script contains memorystream command in $Message$ as new object backstore with EventCode $EventCode$ in host $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 40}]
+action.risk.param._risk_message = A suspicious powershell script contains memorystream command in $ScriptBlockText$ as new object backstore with EventCode $EventCode$ in host $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 40}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -23730,7 +23776,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Powershell Using memory As Backing Store - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001", "T1059"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001", "T1059"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "UserID", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -23764,7 +23810,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Powershell Windows Defender Exclusion Commands - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Remcos", "Windows Defense Evasion Tactics", "WhisperGate"]
 action.risk = 1
 action.risk.param._risk_message = exclusion command $Message$ executed on $ComputerName$
@@ -23810,7 +23856,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = A suspicious process $process_name$ with process id $process_id$ contains commandline $process$ to ignore all bcdedit execution failure in host $dest$
@@ -23860,7 +23906,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Print Spooler Adding A Printer Driver - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious print driver was loaded on endpoint $ComputerName$.
@@ -23914,7 +23960,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Print Spooler Failed to Load a Plug-in - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious printer spooler errors have occured on endpoint $ComputerName$ with EventCode $EventCode$.
@@ -23963,7 +24009,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Process Creating LNK file in Suspicious Location - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
 action.risk.param._risk_message = A process $process_name$ that launching .lnk file in $file_path$ in host $dest$
@@ -24009,7 +24055,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Process Deleting Its Process File Path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Clop Ransomware", "Remcos", "WhisperGate"]
 action.risk = 1
 action.risk.param._risk_message = A process $Image$ tries to delete its process path in commandline $cmdline$ as part of defense evasion in host $Computer$
@@ -24055,7 +24101,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Process Execution via WMI - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious WMI Use"]
 action.risk = 1
 action.risk.param._risk_message = A remote instance execution of wmic.exe that will spawn $parent_process_name$ in host $dest$
@@ -24101,7 +24147,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Process Kill Base On File Path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
 action.risk.param._risk_message = A process $process_name$ attempt to kill process by its file path using commandline $process$ in host $dest$
@@ -24147,7 +24193,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Process Writing DynamicWrapperX - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Remcos"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $process_name$ was identified on endpoint $dest$ downloading the DynamicWrapperX dll.
@@ -24187,8 +24233,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Processes launching netsh - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Netsh Abuse", "Disabling Security Tools", "DHS Report TA18-074A"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Netsh Abuse", "Disabling Security Tools", "DHS Report TA18-074A", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = A process $process_name$ that tries to execute netsh commandline $process$ in host $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}]
@@ -24199,7 +24245,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Processes launching netsh - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Netsh Abuse", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004", "T1562"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Netsh Abuse", "Disabling Security Tools", "DHS Report TA18-074A", "Azorult"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004", "T1562"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -24233,7 +24279,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Ransomware Notes bulk creation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Clop Ransomware", "DarkSide Ransomware", "BlackMatter Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = A high frequency file creation of $file_name$ in different file path in host $Computer$
@@ -24273,11 +24319,11 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Recon AVProduct Through Pwh or WMI - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Hermetic Wiper", "Ransomware", "Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_message = A suspicious powershell script contains AV recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 56}]
+action.risk.param._risk_message = A suspicious powershell script contains AV recon command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 56}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -24285,7 +24331,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Recon AVProduct Through Pwh or WMI - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Ransomware", "Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 70, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Ransomware", "Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 70, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -24308,22 +24354,22 @@ search = `powershell` EventCode=4104 (ScriptBlockText = "*SELECT*" OR ScriptBloc
 action.escu = 0
 action.escu.enabled = 1
 description = The following analytic identifies suspicious PowerShell via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found where the adversary will identify services and system information on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
-action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]}
+action.escu.mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592", "T1059.001"]}
 action.escu.data_models = []
 action.escu.eli5 = The following analytic identifies suspicious PowerShell via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found where the adversary will identify services and system information on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = network administrator may used this command for checking purposes
-action.escu.creation_date = 2021-06-10
-action.escu.modification_date = 2021-06-10
+action.escu.creation_date = 2022-02-25
+action.escu.modification_date = 2022-02-25
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Recon Using WMI Class - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell", "Industroyer2"]
 action.risk = 1
-action.risk.param._risk_message = A suspicious powershell script contains host recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 60}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 60}]
+action.risk.param._risk_message = A suspicious powershell script contains host recon command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 60}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 60}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -24331,7 +24377,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Recon Using WMI Class - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell", "Industroyer2"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 75, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell", "Industroyer2"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 75, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592", "T1059.001"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -24348,7 +24394,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiObject*") AND (Message= "*Win32_Bios*" OR Message= "*Win32_OperatingSystem*" OR Message= "*Win32_Processor*" OR Message= "*Win32_ComputerSystem*" OR Message= "*Win32_ComputerSystemProduct*" OR Message= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recon_using_wmi_class_filter`
+search = `powershell` EventCode=4104 (ScriptBlockText= "*SELECT*" OR ScriptBlockText= "*Get-WmiObject*") AND (ScriptBlockText= "*Win32_Bios*" OR ScriptBlockText= "*Win32_OperatingSystem*" OR ScriptBlockText= "*Win32_Processor*" OR ScriptBlockText= "*Win32_ComputerSystem*" OR ScriptBlockText= "*Win32_ComputerSystemProduct*" OR ScriptBlockText= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recon_using_wmi_class_filter`
 
 [ESCU - Recursive Delete of Directory In Batch CMD - Rule]
 action.escu = 0
@@ -24365,7 +24411,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Recursive Delete of Directory In Batch CMD - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = Recursive Delete of Directory In Batch CMD
@@ -24411,7 +24457,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Service Abuse", "Windows Persistence Techniques", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = A reg.exe process $process_name$ with commandline $process$ in host $dest$
@@ -24457,7 +24503,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Registry Keys for Creating SHIM Databases - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows Persistence Techniques", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = A registry activity in $registry_path$ related to shim modication in host $dest$
@@ -24503,8 +24549,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Registry Keys Used For Persistence - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Suspicious MSHTA Activity", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Windows Persistence Techniques", "Emotet Malware  DHS Report TA18-201A ", "IcedID", "Remcos", "Windows Registry Abuse"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Suspicious MSHTA Activity", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Windows Persistence Techniques", "Emotet Malware  DHS Report TA18-201A ", "IcedID", "Remcos", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = A registry activity in $registry_path$ related to persistence in host $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 76}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 76}]
@@ -24515,7 +24561,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Registry Keys Used For Persistence - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Suspicious MSHTA Activity", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Windows Persistence Techniques", "Emotet Malware  DHS Report TA18-201A ", "IcedID", "Remcos", "Windows Registry Abuse"], "cis20": ["CIS 8"], "confidence": 95, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.001", "T1547"], "nist": ["PR.PT", "DE.CM", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Suspicious MSHTA Activity", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Windows Persistence Techniques", "Emotet Malware  DHS Report TA18-201A ", "IcedID", "Remcos", "Windows Registry Abuse", "Azorult"], "cis20": ["CIS 8"], "confidence": 95, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.001", "T1547"], "nist": ["PR.PT", "DE.CM", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -24549,7 +24595,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Registry Keys Used For Privilege Escalation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Privilege Escalation", "Suspicious Windows Registry Activities", "Cloud Federated Credential Abuse", "Windows Registry Abuse", "Hermetic Wiper"]
 action.risk = 1
 action.risk.param._risk_message = A registry activity in $registry_path$ related to privilege escalation in host $dest$
@@ -24595,7 +24641,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Data Destruction", "Suspicious Regsvr32 Activity", "Remcos", "Hermetic Wiper", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a DLL using the silent and dllinstall parameter.
@@ -24635,7 +24681,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["IcedID", "Suspicious Regsvr32 Activity", "Remcos", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a DLL using the silent parameter.
@@ -24675,7 +24721,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remcos client registry install entry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Remcos", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = A registry entry $registry_path$ with registry keyname $registry_key_name$ related to Remcos RAT in host $dest$
@@ -24721,7 +24767,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remcos RAT File Creation in Remcos Folder - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Remcos"]
 action.risk = 1
 action.risk.param._risk_message = file $file_name$ created in $file_path$ of $dest$
@@ -24767,7 +24813,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote Process Instantiation via DCOM and PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = A process was started on a remote endpoint from $dest by abusing DCOM using PowerShell.exe
@@ -24813,7 +24859,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote Process Instantiation via DCOM and PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = A process was started on a remote endpoint from $ComputerName by abusing WMI using PowerShell.exe
@@ -24859,7 +24905,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote Process Instantiation via WinRM and PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = A process was started on a remote endpoint from $dest by abusing WinRM using PowerShell.exe
@@ -24905,11 +24951,11 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote Process Instantiation via WinRM and PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Lateral Movement"]
 action.risk = 1
-action.risk.param._risk_message = A process was started on a remote endpoint from $ComputerName by abusing WinRM using PowerShell.exe
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 45}]
+action.risk.param._risk_message = A process was started on a remote endpoint from $Computer$ by abusing WinRM using PowerShell.exe
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 45}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -24917,7 +24963,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Remote Process Instantiation via WinRM and PowerShell Script Block - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.006"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.006"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -24951,7 +24997,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote Process Instantiation via WinRM and Winrs - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = A process was started on a remote endpoint from $dest
@@ -24997,7 +25043,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote Process Instantiation via WMI - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware", "Suspicious WMI Use", "Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = A wmic.exe process $process$ contain process spawn commandline $process$ in host $dest$
@@ -25043,7 +25089,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote Process Instantiation via WMI and PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = A process was started on a remote endpoint from $dest by abusing WMI using PowerShell.exe
@@ -25089,7 +25135,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote Process Instantiation via WMI and PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = A process was started on a remote endpoint from $ComputerName by abusing WMI using PowerShell.exe
@@ -25129,17 +25175,17 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain computers for situational awareness and Active Directory Discovery.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = Administrators or power users may use Adsisearcher for troubleshooting.
-action.escu.creation_date = 2021-09-01
-action.escu.modification_date = 2021-09-01
+action.escu.creation_date = 2022-06-29
+action.escu.modification_date = 2022-06-29
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote System Discovery with Adsisearcher - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
-action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
+action.risk.param._risk_message = Remote system discovery enumeration on $Computer$ by $user$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 15}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -25147,7 +25193,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Remote System Discovery with Adsisearcher - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1018"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -25164,7 +25210,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 (Message = "*[adsisearcher]*" AND Message = "*objectclass=computer*" AND Message = "*findAll()*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `remote_system_discovery_with_adsisearcher_filter`
+search = `powershell` EventCode=4104 ScriptBlockText = "*adsisearcher*" AND ScriptBlockText = "*objectcategory=computer*" AND ScriptBlockText IN ("*findAll()*","*findOne()*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `remote_system_discovery_with_adsisearcher_filter`
 
 [ESCU - Remote System Discovery with Dsquery - Rule]
 action.escu = 0
@@ -25181,7 +25227,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote System Discovery with Dsquery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$
@@ -25221,7 +25267,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote System Discovery with Net - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$
@@ -25261,7 +25307,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote System Discovery with Wmic - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Remote system discovery enumeration on $dest$ by $user$
@@ -25307,7 +25353,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote WMI Command Attempt - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious WMI Use", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = A wmic.exe process $process$ contain node commandline $process$ in host $dest$
@@ -25353,7 +25399,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Resize ShadowStorage volume - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Clop Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = A process $parent_process_name$ attempt to resize shadow copy with commandline $process$ in host $dest$
@@ -25399,7 +25445,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Revil Common Exec Parameter - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware", "Revil Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = A process $process_name$ with commandline $process$ related to revil ransomware in host $dest$
@@ -25445,7 +25491,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Revil Registry Entry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware", "Revil Ransomware", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = A registry entry $registry_path$ with registry value $registry_value_name$ and $registry_value_name$ related to revil ransomware in host $dest$
@@ -25491,7 +25537,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Rubeus Command Line Parameters - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = Rubeus command line parameters were used on $dest$
@@ -25537,7 +25583,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Rubeus Kerberos Ticket Exports Through Winlogon Access - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = Winlogon.exe was accessed by $SourceImage$ on $dest$
@@ -25583,7 +25629,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Runas Execution in CommandLine - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Privilege Escalation", "Hermetic Wiper"]
 action.risk = 1
 action.risk.param._risk_message = elevated process using runas on $dest$ by $user$
@@ -25623,7 +25669,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Rundll32 Control RunDLL Hunt - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
@@ -25663,7 +25709,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Rundll32 Control RunDLL World Writable Directory - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk.
@@ -25709,7 +25755,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Rundll32 Create Remote Thread To A Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["IcedID", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = rundl32 process $SourceImage$ create a remote thread to process $TargetImage$ in host $Computer$
@@ -25755,7 +25801,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Rundll32 CreateRemoteThread In Browser - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["IcedID", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = rundl32 process $SourceImage$ create a remote thread to browser process $TargetImage$ in host $Computer$
@@ -25801,7 +25847,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Rundll32 DNSQuery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["IcedID", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = rundll32 process $process_name$ having a dns query to $QueryName$ in host $Computer$
@@ -25847,7 +25893,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Rundll32 LockWorkStation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = process $process_name$ with cmdline $process$ in host $dest$
@@ -25887,7 +25933,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Rundll32 Process Creating Exe Dll Files - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["IcedID", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = rundll32 process $process_name$ drops a file $TargetFilename$ in host $dest$
@@ -25933,7 +25979,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Rundll32 Shimcache Flush - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Unusual Processes", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = rundll32 process execute $process$ to clear shim cache in $dest$
@@ -25979,7 +26025,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Rundll32 with no Command Line Arguments with Network - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"]
 action.risk = 1
 action.risk.param._risk_message = A rundll32 process $process_name$ with no commandline argument like this process commandline $process$ in host $dest$
@@ -26025,7 +26071,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - RunDLL Loading DLL By Ordinal - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Unusual Processes", "Suspicious Rundll32 Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ on host $dest$.
@@ -26071,7 +26117,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Ryuk Test Files Detected - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ryuk Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = A creation of ryuk test file $file_path$ in host $dest$
@@ -26117,7 +26163,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Ryuk Wake on LAN Command - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ryuk Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = A process $process_name$ with wake on LAN commandline $process$ in host $dest$
@@ -26163,7 +26209,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - SAM Database File Access Attempt - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
 action.risk.param._risk_message = The following process $process_name$ accessed the object $Object_Name$ attempting to gain access to credentials on $dest$ by user $user$.
@@ -26203,7 +26249,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Samsam Test File Write - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["SamSam Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = A samsam ransomware test file creation in $file_path$ in host $dest$
@@ -26249,8 +26295,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Sc exe Manipulating Windows Services - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "NOBELIUM Group"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "NOBELIUM Group", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = A sc process $process_name$ with commandline $process$ to create of configure services in host $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}]
@@ -26261,7 +26307,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Sc exe Manipulating Windows Services - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "NOBELIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003", "T1543"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "NOBELIUM Group", "Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003", "T1543"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -26295,7 +26341,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - SchCache Change By App Connect And Create ADSI Object - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["blackMatter ransomware"]
 action.risk = 1
 action.risk.param._risk_message = process $Image$ create a file $TargetFilename$ in host $Computer$
@@ -26335,7 +26381,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Schedule Task with HTTP Command Arguments - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Windows Persistence Techniques", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = A schedule task process commandline arguments $Arguments$ with http string on it in host $dest$
@@ -26381,7 +26427,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Schedule Task with Rundll32 Command Trigger - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Windows Persistence Techniques", "Trickbot", "IcedID", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = A schedule task process commandline rundll32 arguments $Arguments$ in host $dest$
@@ -26427,7 +26473,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Lateral Movement", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = A Windows Scheduled Task was created on a remote endpoint from $dest
@@ -26473,8 +26519,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Scheduled Task Deleted Or Created via CMD - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["DHS Report TA18-074A", "NOBELIUM Group", "Windows Persistence Techniques", "Living Off The Land"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["DHS Report TA18-074A", "NOBELIUM Group", "Windows Persistence Techniques", "Living Off The Land", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = A schedule task process $process_name$ with create or delete commandline $process$ in host $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}]
@@ -26485,7 +26531,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Scheduled Task Deleted Or Created via CMD - Rule
-action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "NOBELIUM Group", "Windows Persistence Techniques", "Living Off The Land"], "cis20": ["CIS 3"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "NOBELIUM Group", "Windows Persistence Techniques", "Living Off The Land", "Azorult"], "cis20": ["CIS 3"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -26519,7 +26565,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Scheduled Task Initiation on Remote Endpoint - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Lateral Movement", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = A Windows Scheduled Task was ran on a remote endpoint from $dest
@@ -26565,7 +26611,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Schtasks Run Task On Demand - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["XMRig", "Industroyer2"]
 action.risk = 1
 action.risk.param._risk_message = A "on demand" execution of schedule task process $process_name$  using commandline $process$ in host $dest$
@@ -26611,7 +26657,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Schtasks scheduling job on remote system - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Lateral Movement", "NOBELIUM Group", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = A schedule task process $process_name$ with remote job command-line $process$ in host $dest$ by $user$.
@@ -26657,7 +26703,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Schtasks used for forcing a reboot - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = A schedule task process $process_name$ with force reboot commandline $process$ in host $dest$
@@ -26703,7 +26749,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Screensaver Event Trigger Execution - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Registry Abuse", "Hermetic Wiper"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$
@@ -26749,7 +26795,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Script Execution via WMI - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious WMI Use"]
 action.risk = 1
 action.risk.param._risk_message = A wmic.exe process $process_name$ taht execute script in host $dest$
@@ -26795,7 +26841,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Sdclt UAC Bypass - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
@@ -26841,7 +26887,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Sdelete Application Execution - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Masquerading - Rename System Utilities"]
 action.risk = 1
 action.risk.param._risk_message = sdelete process $process_name$ executed in $dest$
@@ -26887,7 +26933,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - SearchProtocolHost with no Command Line with Network - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Cobalt Strike"]
 action.risk = 1
 action.risk.param._risk_message = A searchprotocolhost.exe process $process_name$ with no commandline in host $dest$
@@ -26933,7 +26979,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - SecretDumps Offline NTDS Dumping Tool - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
 action.risk.param._risk_message = A secretdump process $process_name$ with secretdump commandline $process$ to dump credentials in host $dest$
@@ -26981,17 +27027,17 @@ The following analytic identifies the use of KerberosRequestorSecurityToken clas
 During triage, review parallel processes for further suspicious activity.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = False positives should be limited, however filter as needed.
-action.escu.creation_date = 2021-10-14
-action.escu.modification_date = 2021-10-14
+action.escu.creation_date = 2022-02-26
+action.escu.modification_date = 2022-02-26
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - ServicePrincipalNames Discovery with PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Active Directory Discovery", "Active Directory Kerberos Attacks"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Active Directory Discovery", "Active Directory Kerberos Attacks", "Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to identify service principle names.
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $Computer$ by user $UserID$ attempting to identify service principle names.
+action.risk.param._risk = [{"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -26999,7 +27045,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - ServicePrincipalNames Discovery with PowerShell - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery", "Active Directory Kerberos Attacks"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery", "Active Directory Kerberos Attacks", "Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1558.003"], "observable": [{"name": "UserID", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -27020,7 +27066,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message="*KerberosRequestorSecurityToken*" | stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `serviceprincipalnames_discovery_with_powershell_filter`
+search = `powershell` EventCode=4104 ScriptBlockText="*KerberosRequestorSecurityToken*" | stats count min(_time) as firstTime max(_time) as lastTime by ScriptBlockText Opcode Computer UserID EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `serviceprincipalnames_discovery_with_powershell_filter`
 
 [ESCU - ServicePrincipalNames Discovery with SetSPN - Rule]
 action.escu = 0
@@ -27051,7 +27097,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - ServicePrincipalNames Discovery with SetSPN - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery", "Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to identify service principle names.
@@ -27104,7 +27150,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Services Escalate Exe - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Cobalt Strike"]
 action.risk = 1
 action.risk.param._risk_message = A service process $parent_process_name$ with process path $process_path$ in host $dest$
@@ -27150,7 +27196,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Services LOLBAS Execution Process Spawn - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Lateral Movement", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = Services.exe spawned a LOLBAS process on $dest
@@ -27196,7 +27242,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell", "Credential Dumping", "HAFNIUM Group"]
 action.risk = 1
 action.risk.param._risk_message = A registry modification in $registry_path$ with reg key $registry_key_name$ and reg value $registry_value_name$ in host $dest$
@@ -27242,7 +27288,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Shim Database File Creation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A process that possibly write shim database in $file_path$ in host $dest$
@@ -27288,7 +27334,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Shim Database Installation With Suspicious Parameters - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A process $process_name$ that possible create a shim db silently in host $dest$
@@ -27334,7 +27380,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Short Lived Scheduled Task - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = A windows scheduled task was created and deleted in 30 seconds on $ComputerName$
@@ -27380,7 +27426,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Short Lived Windows Accounts - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Account Monitoring and Controls"]
 action.risk = 1
 action.risk.param._risk_message = A user account created or delete shortly in host $dest$
@@ -27426,7 +27472,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - SilentCleanup UAC Bypass - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
@@ -27472,7 +27518,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Single Letter Process On Endpoint - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["DHS Report TA18-074A"]
 action.risk = 1
 action.risk.param._risk_message = A suspicious process $process_name$ with single letter in host $dest$
@@ -27518,7 +27564,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - SLUI RunAs Elevated - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["DarkSide Ransomware", "Windows Defense Evasion Tactics"]
 action.risk = 1
 action.risk.param._risk_message = A slui process $process_name$ with elevated commandline $process$ in host $dest$
@@ -27564,7 +27610,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - SLUI Spawning a Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["DarkSide Ransomware", "Windows Defense Evasion Tactics"]
 action.risk = 1
 action.risk.param._risk_message = A slui process $parent_process_name$ spawning child process $process_name$ in host $dest$
@@ -27610,7 +27656,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Spoolsv Spawning Rundll32 - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"]
 action.risk = 1
 action.risk.param._risk_message = $parent_process$ has spawned $process_name$ on endpoint $ComputerName$. This behavior is suspicious and related to PrintNightmare.
@@ -27656,7 +27702,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Spoolsv Suspicious Loaded Modules - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"]
 action.risk = 1
 action.risk.param._risk_message = $Image$ with process id $process_id$ has loaded a driver from $ImageLoaded$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare.
@@ -27702,7 +27748,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Spoolsv Suspicious Process Access - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"]
 action.risk = 1
 action.risk.param._risk_message = $SourceImage$ was GrantedAccess open access to $TargetImage$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare.
@@ -27748,7 +27794,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Spoolsv Writing a DLL - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"]
 action.risk = 1
 action.risk.param._risk_message = $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare.
@@ -27794,7 +27840,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Spoolsv Writing a DLL - Sysmon - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"]
 action.risk = 1
 action.risk.param._risk_message = $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare.
@@ -27840,7 +27886,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Sqlite Module In Temp Folder - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["IcedID"]
 action.risk = 1
 action.risk.param._risk_message = process $SourceImage$ create a file $TargetImage$ in host $Computer$
@@ -27886,7 +27932,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Computer Account Name Change - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["sAMAccountName Spoofing and Domain Controller Impersonation"]
 action.risk = 1
 action.risk.param._risk_message = A computer account $Old_Account_Name$ was renamed with a suspicious computer name
@@ -27932,7 +27978,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Copy on System32 - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Unusual Processes"]
 action.risk = 1
 action.risk.param._risk_message = execution of copy exe to copy file from $process$ in $dest$
@@ -27978,7 +28024,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious DLLHost no Command Line Arguments - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Cobalt Strike"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious dllhost.exe process with no command line arguments executed on $dest$ by $user$
@@ -28024,7 +28070,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Driver Loaded Path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious driver $ImageLoaded$ on $Computer$
@@ -28070,7 +28116,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Event Log Service Behavior - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = The Windows Event Log Service shutdown on $ComputerName$
@@ -28116,7 +28162,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious GPUpdate no Command Line Arguments - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Cobalt Strike"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious gpupdate.exe process with no command line arguments executed on $dest$ by $user$
@@ -28162,7 +28208,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious IcedID Rundll32 Cmdline - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["IcedID", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = rundll32 process $process_name$ with commandline $process$ in host $dest$
@@ -28202,13 +28248,13 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This search is to detect a suspicious creation of image in appdata folder made by process that also has a file reference in appdata folder. This technique was seen in remcos rat that capture screenshot of the compromised machine and place it in the appdata and will be send to its C2 server. This TTP is really a good indicator to check that process because it is in suspicious folder path and image files are not commonly created by user in this folder path.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = unknown
-action.escu.creation_date = 2021-09-21
-action.escu.modification_date = 2021-09-21
+action.escu.creation_date = 2022-07-07
+action.escu.modification_date = 2022-07-07
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Image Creation In Appdata Folder - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Remcos"]
 action.risk = 1
 action.risk.param._risk_message = process $process_name$ creating image file $file_path$ in $dest$
@@ -28237,7 +28283,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path = "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process] | `suspicious_image_creation_in_appdata_folder_filter`
+search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path= "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields _time dest file_create_time file_name file_path process_name process_path process proc_guid] | `suspicious_image_creation_in_appdata_folder_filter`
 
 [ESCU - Suspicious Kerberos Service Ticket Request - Rule]
 action.escu = 0
@@ -28254,7 +28300,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Kerberos Service Ticket Request - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["sAMAccountName Spoofing and Domain Controller Impersonation", "Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = A suspicious Kerberos Service Ticket was requested by $Account_Name$
@@ -28302,7 +28348,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Linux Discovery Commands - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Linux Post-Exploitation"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious Linux Discovery Commands detected on $dest$
@@ -28349,7 +28395,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious microsoft workflow compiler rename - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious renamed microsoft.workflow.compiler.exe binary ran on $dest$ by $user$
@@ -28389,7 +28435,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious microsoft workflow compiler usage - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious microsoft.workflow.compiler.exe process ran on $dest$ by $user$
@@ -28435,7 +28481,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious msbuild path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$
@@ -28481,7 +28527,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious MSBuild Rename - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious renamed msbuild.exe binary ran on $dest$ by $user$
@@ -28521,7 +28567,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious MSBuild Spawn - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious msbuild.exe process executed on $dest$ by $user$
@@ -28567,7 +28613,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious mshta child process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious MSHTA Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = suspicious mshta child process detected on host $dest$ by user $user$.
@@ -28613,7 +28659,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious mshta spawn - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious MSHTA Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = mshta.exe spawned by wmiprvse.exe on $dest$
@@ -28659,7 +28705,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Process DNS Query Known Abuse Web Services - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Remcos", "WhisperGate"]
 action.risk = 1
 action.risk.param._risk_message = suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$
@@ -28705,7 +28751,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Process File Path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Data Destruction", "Double Zero Destructor", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper", "Industroyer2"]
 action.risk = 1
 action.risk.param._risk_message = Suspicioues process $Processes.process_path.file_path$ running from suspicious location
@@ -28751,7 +28797,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Process With Discord DNS Query - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["WhisperGate"]
 action.risk = 1
 action.risk.param._risk_message = suspicious process $process_name$ has a dns query in $QueryName$ on $Computer$
@@ -28791,7 +28837,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Reg exe Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Disabling Security Tools", "DHS Report TA18-074A"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious $Processes.process_path.file_path$ process running with an uncommon parent process $Processes.parent_process_name$
@@ -28837,7 +28883,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Iceid", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious $Processes.process_path.file_path$ process potentially loading malicious code
@@ -28883,7 +28929,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Rundll32 dllregisterserver - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = $Processes.process_path.file_path$ process potentially loading malicious code
@@ -28929,7 +28975,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Rundll32 PluginInit - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["IcedID"]
 action.risk = 1
 action.risk.param._risk_message = rundll32 process $process_name$ with commandline $process$ in host $dest$
@@ -28975,7 +29021,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Rundll32 StartW - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "Trickbot"]
 action.risk = 1
 action.risk.param._risk_message = rundll32.exe running with suspicious parameters on $dest$
@@ -29021,7 +29067,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Rundll32 no Command Line Arguments - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user$
@@ -29067,8 +29113,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Scheduled Task from Public Directory - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques", "Living Off The Land"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques", "Living Off The Land", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious scheduled task registered on $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 35}]
@@ -29079,7 +29125,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Suspicious Scheduled Task from Public Directory - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques", "Living Off The Land"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques", "Living Off The Land", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -29107,7 +29153,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Cobalt Strike"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user$
@@ -29153,7 +29199,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Ticket Granting Ticket Request - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["sAMAccountName Spoofing and Domain Controller Impersonation", "Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = A suspicious TGT was requested was requested
@@ -29187,13 +29233,13 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This analytic is to detect a suspicious creation of .wav file in appdata folder. This behavior was seen in Remcos RAT malware where it put the audio recording in the appdata\audio folde as part of data collection. this recording can be send to its C2 server as part of its exfiltration to the compromised machine. creation of wav files in this folder path is not a ussual disk place used by user to save audio format file.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, file_name, file_path and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = unknown
-action.escu.creation_date = 2021-09-21
-action.escu.modification_date = 2021-09-21
+action.escu.creation_date = 2022-07-07
+action.escu.modification_date = 2022-07-07
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious WAV file in Appdata Folder - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Remcos"]
 action.risk = 1
 action.risk.param._risk_message = process $process_name$ creating image file $file_path$ in $dest$
@@ -29222,7 +29268,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields file_name file_path process_name process_path process dest file_create_time _time ] | `suspicious_wav_file_in_appdata_folder_filter`
+search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields file_name file_path process_name process_path process dest file_create_time _time proc_guid] | `suspicious_wav_file_in_appdata_folder_filter`
 
 [ESCU - Suspicious wevtutil Usage - Rule]
 action.escu = 0
@@ -29239,7 +29285,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious wevtutil Usage - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = Wevtutil.exe being used to clear Event Logs on $dest$ by $user$
@@ -29285,7 +29331,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious writes to windows Recycle Bin - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Collection and Staging"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious writes to windows Recycle Bin process $Processes.process_name$
@@ -29331,7 +29377,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Svchost LOLBAS Execution Process Spawn - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Lateral Movement", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = Svchost.exe spawned a LOLBAS process on $dest
@@ -29377,7 +29423,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - System Info Gathering Using Dxdiag Application - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Remcos"]
 action.risk = 1
 action.risk.param._risk_message = dxdiag.exe process with commandline $process$ on $dest$
@@ -29417,7 +29463,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - System Information Discovery Detection - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Discovery Techniques"]
 action.risk = 1
 action.risk.param._risk_message = Potential system information discovery behavior on $dest$ by $User$
@@ -29467,7 +29513,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - System Processes Run From Unexpected Locations - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Command-Line Executions", "Unusual Processes", "Ransomware", "Masquerading - Rename System Utilities"]
 action.risk = 1
 action.risk.param._risk_message = System process running from unexpected location on $dest$
@@ -29515,7 +29561,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - System User Discovery With Query - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = System user discovery on $dest$
@@ -29555,7 +29601,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - System User Discovery With Whoami - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = System user discovery on $dest$
@@ -29595,7 +29641,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Time Provider Persistence Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Registry Abuse", "Hermetic Wiper"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$
@@ -29641,7 +29687,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Trickbot Named Pipe - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Trickbot"]
 action.risk = 1
 action.risk.param._risk_message = Possible Trickbot namedpipe created on $Computer$ by $Image$
@@ -29676,7 +29722,7 @@ search = `sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe" | stats
 action.escu = 0
 action.escu.enabled = 1
 description = This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry that will trigger the mmc.exe to load the dll path
-action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"]}
+action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548", "T1218.014"]}
 action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry that will trigger the mmc.exe to load the dll path
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
@@ -29687,7 +29733,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - UAC Bypass MMC Load Unsigned Dll - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious unsigned $ImageLoaded$ loaded by $Image$ on endpoint $Computer$ with EventCode $EventCode$
@@ -29699,7 +29745,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - UAC Bypass MMC Load Unsigned Dll - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Inbound"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Inbound"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002", "T1548", "T1218.014"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -29733,7 +29779,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - UAC Bypass With Colorui COM Object - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$.
@@ -29779,7 +29825,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Unified Messaging Service Spawning a Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["HAFNIUM Group"]
 action.risk = 1
 action.risk.param._risk_message = Possible CVE-2021-26857 exploitation on $dest$
@@ -29825,7 +29871,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Uninstall App Using MsiExec - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = process $process_name$ with a cmdline $process$ in host $dest$
@@ -29871,7 +29917,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Unknown Process Using The Kerberos Protocol - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = 
@@ -29917,7 +29963,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Unload Sysmon Filter Driver - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Disabling Security Tools"]
 action.risk = 1
 action.risk.param._risk_message = Possible Sysmon filter driver unloading on $dest$
@@ -29967,11 +30013,11 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Unloading AMSI via Reflection - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_message = Possible AMSI Unloading via Reflection using PowerShell on $ComputerName$
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_message = Possible AMSI Unloading via Reflection using PowerShell on $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 49}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -29979,7 +30025,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Unloading AMSI via Reflection - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562", "T1059.001", "T1059"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562", "T1059.001", "T1059"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -30017,7 +30063,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Unusual Number of Kerberos Service Tickets Requested - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -30057,7 +30103,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - User Discovery With Env Vars PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = System user discovery on $dest$
@@ -30097,7 +30143,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - User Discovery With Env Vars PowerShell Script Block - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = System user discovery on $dest$
@@ -30137,7 +30183,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - USN Journal Deletion - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = Possible USN journal deletion on $dest$
@@ -30183,7 +30229,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Vbscript Execution Using Wscript App - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["FIN7", "Remcos"]
 action.risk = 1
 action.risk.param._risk_message = Process name $process_name$ with commandline $process$ to execute vbsscript
@@ -30229,7 +30275,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Verclsid CLSID Execution - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Unusual Processes"]
 action.risk = 1
 action.risk.param._risk_message = process $process_name$ to execute possible clsid commandline $process$ in $dest$
@@ -30269,7 +30315,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - W3WP Spawning Shell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Hermetic Wiper", "HAFNIUM Group", "ProxyShell"]
 action.risk = 1
 action.risk.param._risk_message = Possible Web Shell execution on $dest$
@@ -30315,7 +30361,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - WBAdmin Delete System Backups - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ryuk Ransomware", "Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = System backups deletion on $dest$
@@ -30361,7 +30407,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Wbemprox COM Object Execution - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware", "Revil Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious COM Object Execution on $Computer$
@@ -30407,7 +30453,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Wermgr Process Connecting To IP Check Web Services - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Trickbot"]
 action.risk = 1
 action.risk.param._risk_message = Wermgr.exe process connecting IP location web services on $ComputerName$
@@ -30453,7 +30499,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Wermgr Process Create Executable File - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Trickbot"]
 action.risk = 1
 action.risk.param._risk_message = Wermgr.exe writing executable files on $dest$
@@ -30499,7 +30545,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Trickbot"]
 action.risk = 1
 action.risk.param._risk_message = Wermgr.exe spawning suspicious processes on $dest$
@@ -30545,7 +30591,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Wget Download and Bash Execution - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ingress Tool Transfer", "Log4Shell CVE-2021-44228"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $process_name$ was identified on endpoint $dest$ attempting to download a remote file and run it with bash.
@@ -30591,7 +30637,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows AdFind Exe - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["NOBELIUM Group", "Domain Trust Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Windows AdFind Exe
@@ -30622,6 +30668,98 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="* -f *" OR Processes.process="* -b *") AND (Processes.process=*objectcategory* OR Processes.process="* -gcb *" OR Processes.process="* -sc *") by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_adfind_exe_filter`
 
+[ESCU - Windows Application Layer Protocol RMS Radmin Tool Namedpipe - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the use of default or publicly known named pipes used by RMX remote admin tool. A named pipe is a named, one-way or duplex pipe for communication between the pipe server and one or more pipe clients. RMX Tool uses named pipes in many way as part of its communication for its server and client component. This tool was abuse by several adversaries and malware like Azorult to collect data to the targeted host. This TTP is a good indicator that this tool was install in production premise and need to check if the user has a valid reason why it need to install this legitimate application.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1071"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies the use of default or publicly known named pipes used by RMX remote admin tool. A named pipe is a named, one-way or duplex pipe for communication between the pipe server and one or more pipe clients. RMX Tool uses named pipes in many way as part of its communication for its server and client component. This tool was abuse by several adversaries and malware like Azorult to collect data to the targeted host. This TTP is a good indicator that this tool was install in production premise and need to check if the user has a valid reason why it need to install this legitimate application.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+action.escu.known_false_positives = False positives may be present. Filter based on pipe name or process.
+action.escu.creation_date = 2022-06-24
+action.escu.modification_date = 2022-06-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Application Layer Protocol RMS Radmin Tool Namedpipe - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = possible RMS admin tool named pipe was created in $dest$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 81}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Application Layer Protocol RMS Radmin Tool Namedpipe - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Command And Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1071"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the use of default or publicly known named pipes used by RMX remote admin tool. A named pipe is a named, one-way or duplex pipe for communication between the pipe server and one or more pipe clients. RMX Tool uses named pipes in many way as part of its communication for its server and client component. This tool was abuse by several adversaries and malware like Azorult to collect data to the targeted host. This TTP is a good indicator that this tool was install in production premise and need to check if the user has a valid reason why it need to install this legitimate application.
+action.notable.param.rule_title = Windows Application Layer Protocol RMS Radmin Tool Namedpipe
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `sysmon` EventCode IN (17, 18) EventType IN ( "CreatePipe", "ConnectPipe") PipeName IN ("\\RManFUSServerNotify32", "\\RManFUSCallbackNotify32", "\\RMSPrint*") | stats  min(_time) as firstTime max(_time) as lastTime count by Image EventType ProcessId PipeName Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_application_layer_protocol_rms_radmin_tool_namedpipe_filter`
+
+[ESCU - Windows Binary Proxy Execution Mavinject DLL Injection - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution (ex. C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL). In addition to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import descriptor injection via its /HMODULE command-line parameter (ex. mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an import table entry consisting of the specified DLL into the module at the given base address. During triage, review file modifcations and parallel processes.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.013", "T1218"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution (ex. C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL). In addition to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import descriptor injection via its /HMODULE command-line parameter (ex. mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an import table entry consisting of the specified DLL into the module at the given base address. During triage, review file modifcations and parallel processes.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives may be present, filter on DLL name or parent process.
+action.escu.creation_date = 2022-07-07
+action.escu.modification_date = 2022-07-07
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Binary Proxy Execution Mavinject DLL Injection - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Living Off The Land"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting load a DLL.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Binary Proxy Execution Mavinject DLL Injection - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.013", "T1218"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process Name"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution (ex. C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL). In addition to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import descriptor injection via its /HMODULE command-line parameter (ex. mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an import table entry consisting of the specified DLL into the module at the given base address. During triage, review file modifcations and parallel processes.
+action.notable.param.rule_title = Windows Binary Proxy Execution Mavinject DLL Injection
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mavinject.exe Processes.process IN ("*injectrunning*", "*hmodule=0x*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_binary_proxy_execution_mavinject_dll_injection_filter`
+
 [ESCU - Windows Command and Scripting Interpreter Hunting Path Traversal - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -30637,7 +30775,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Command and Scripting Interpreter Hunting Path Traversal - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"]
 action.risk = 1
 action.risk.param._risk_message = A parent process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ in $dest$
@@ -30677,7 +30815,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Command and Scripting Interpreter Path Traversal Exec - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"]
 action.risk = 1
 action.risk.param._risk_message = A parent process $parent_process_name$ has spawned a child $process_name$ with path traversal commandline $process$ in $dest$
@@ -30723,7 +30861,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Computer Account Created by Computer Account - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks", "Local Privilege Escalation With KrbRelayUp"]
 action.risk = 1
 action.risk.param._risk_message = A Computer Account created a Computer Account on $dest$, possibly indicative of Kerberos relay attack.
@@ -30769,7 +30907,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Computer Account Requesting Kerberos Ticket - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks", "Local Privilege Escalation With KrbRelayUp"]
 action.risk = 1
 action.risk.param._risk_message = A Computer Account requested a Kerberos ticket on $dest$, possibly indicative of Kerberos relay attack.
@@ -30815,7 +30953,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Computer Account With SPN - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks", "Local Privilege Escalation With KrbRelayUp"]
 action.risk = 1
 action.risk.param._risk_message = A Computer Account was created with SPNs related to Kerberos on $dest$, possibly indicative of Kerberos relay attack.
@@ -30865,7 +31003,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Curl Download to Suspicious Path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["IceID", "Ingress Tool Transfer"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ to download a file to a suspicious directory.
@@ -30921,7 +31059,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Curl Upload to Remote Destination - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ingress Tool Transfer"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ uploading a file to a remote destination.
@@ -30971,8 +31109,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Defender Exclusion Registry Entry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Remcos", "Windows Defense Evasion Tactics"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Remcos", "Windows Defense Evasion Tactics", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = exclusion registry $registry_path$  modified or added on $dest$
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}]
@@ -30983,7 +31121,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Windows Defender Exclusion Registry Entry - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Remcos", "Windows Defense Evasion Tactics"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Remcos", "Windows Defense Evasion Tactics", "Azorult"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -31017,7 +31155,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Deleted Registry By A Non Critical Process File Path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Double Zero Destructor"]
 action.risk = 1
 action.risk.param._risk_message = registry was deleted by a suspicious $process_name$ with proces path $process_path in $dest$
@@ -31057,7 +31195,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Disable Change Password Through Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware", "Windows Defense Evasion Tactics"]
 action.risk = 1
 action.risk.param._risk_message = Registry modification in "DisableChangePassword" on $dest$
@@ -31097,7 +31235,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware", "Windows Defense Evasion Tactics", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = Registry modification in "DisableLockWorkstation" on $dest$
@@ -31137,7 +31275,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Disable LogOff Button Through Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = Registry modification in "NoLogOff" on $dest$
@@ -31177,7 +31315,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Disable Memory Crash Dump - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Data Destruction", "Ransomware", "Hermetic Wiper", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = A process $process_name$ was identified attempting to disable memory crash dumps on $dest$.
@@ -31223,7 +31361,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Disable Notification Center - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = The Windows notification center was disabled on $dest$ by $user$.
@@ -31263,7 +31401,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Disable Shutdown Button Through Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = Registry modification in "shutdownwithoutlogon" on $dest$
@@ -31303,7 +31441,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware", "Windows Defense Evasion Tactics", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = Registry modification to disable windows features on $dest$
@@ -31343,8 +31481,8 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows DisableAntiSpyware Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Ryuk Ransomware", "Windows Defense Evasion Tactics", "Windows Registry Abuse"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Ryuk Ransomware", "Windows Defense Evasion Tactics", "Windows Registry Abuse", "Azorult"]
 action.risk = 1
 action.risk.param._risk_message = Windows DisableAntiSpyware registry key set to 'disabled' on $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}]
@@ -31355,7 +31493,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Windows DisableAntiSpyware Registry - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Windows Defense Evasion Tactics", "Windows Registry Abuse"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Windows Defense Evasion Tactics", "Windows Registry Abuse", "Azorult"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -31395,7 +31533,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Disabled Users Failing To Authenticate Kerberos - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Password Spraying", "Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$
@@ -31435,7 +31573,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows DiskCryptor Usage - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to encrypt disks.
@@ -31475,7 +31613,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Diskshadow Proxy Execution - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = Possible Signed Binary Proxy Execution on $dest$
@@ -31521,7 +31659,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows DISM Remove Defender - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to disable Windows Defender.
@@ -31567,7 +31705,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows DotNet Binary in Non Standard Path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Masquerading - Rename System Utilities", "Unusual Processes", "Ransomware", "Signed Binary Proxy Execution InstallUtil", "WhisperGate"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$.
@@ -31613,7 +31751,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Driver Load Non-Standard Path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Drivers"]
 action.risk = 1
 action.risk.param._risk_message = A kernel mode driver was loaded from a non-standard path on $ComputerName$.
@@ -31659,7 +31797,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Drivers Loaded by Signature - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Drivers"]
 action.risk = 1
 action.risk.param._risk_message = A driver has loaded on $Computer$.
@@ -31699,7 +31837,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Event For Service Disabled - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
 action.risk.param._risk_message = Service was disabled on $Computer$
@@ -31739,7 +31877,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Event Log Cleared - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = Windows event logs cleared on $dest$ via EventCode $EventCode$
@@ -31785,7 +31923,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Excessive Disabled Services Event - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
 action.risk.param._risk_message = Service was disabled in $Computer$
@@ -31825,13 +31963,13 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 action.escu.known_false_positives = False positives may be present, filter as needed. Added .xml to potentially capture any answer file usage. Remove as needed.
-action.escu.creation_date = 2022-05-30
-action.escu.modification_date = 2022-05-30
+action.escu.creation_date = 2022-06-29
+action.escu.modification_date = 2022-06-29
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Execute Arbitrary Commands with MSDT - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"]
 action.risk = 1
 action.risk.param._risk_message = A parent process $parent_process_name$ has spawned a child process $process_name$ on host $dest$ possibly indicative of indirect command execution.
@@ -31860,7 +31998,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe Processes.process IN ("*ms-msdt:/id*","*ms-msdt:-id*","*/id*") AND (Processes.process="*IT_BrowseForFile=*" OR Processes.process="*IT_RebrowseForFile=*" OR Processes.process="*.xml*") AND Processes.process="*PCWDiagnostic*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_execute_arbitrary_commands_with_msdt_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe Processes.process IN ("*msdt*","*ms-msdt:*","*ms-msdt:/id*","*ms-msdt:-id*","*/id*") AND (Processes.process="*IT_BrowseForFile=*" OR Processes.process="*IT_RebrowseForFile=*" OR Processes.process="*.xml*") AND Processes.process="*PCWDiagnostic*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_execute_arbitrary_commands_with_msdt_filter`
 
 [ESCU - Windows File Without Extension In Critical Folder - Rule]
 action.escu = 0
@@ -31877,7 +32015,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows File Without Extension In Critical Folder - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Data Destruction", "Hermetic Wiper"]
 action.risk = 1
 action.risk.param._risk_message = Driver file with out file extension drop in $file_path$ in $dest$
@@ -31908,6 +32046,46 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\System32\\drivers\\*", "*\\syswow64\\drivers\\*") by _time span=5m Filesystem.dest Filesystem.user Filesystem.file_name Filesystem.file_path Filesystem.process_guid Filesystem.file_create_time | `drop_dm_object_name(Filesystem)` | rex field="file_name" "\.(?<extension>[^\.]*$)" | where isnull(extension) | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=5m Processes.process_name Processes.dest Processes.process_guid Processes.user | `drop_dm_object_name(Processes)`] | stats count min(_time) as firstTime max(_time) as lastTime by dest process_name process_guid file_name file_path file_create_time user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_without_extension_in_critical_folder_filter`
 
+[ESCU - Windows Gather Victim Network Info Through Ip Check Web Services - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies process that attempts to connect to a known IP web services. This technique is commonly used by trickbot and other malware to perform reconnaissance against the infected machine and look for its IP address.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1590.005", "T1590"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies process that attempts to connect to a known IP web services. This technique is commonly used by trickbot and other malware to perform reconnaissance against the infected machine and look for its IP address.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA.
+action.escu.known_false_positives = Filter internet browser application to minimize the false positive of this detection.
+action.escu.creation_date = 2022-06-21
+action.escu.modification_date = 2022-06-21
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Gather Victim Network Info Through Ip Check Web Services - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = process connecting IP location web services on $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 25}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Gather Victim Network Info Through Ip Check Web Services - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1590.005", "T1590"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `sysmon` EventCode=22  QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org", "*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net", "*iplogger.org*", "*ip-api.com*") |  stats  min(_time) as firstTime max(_time) as lastTime count by  Image ProcessId QueryName QueryStatus QueryResults Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_gather_victim_network_info_through_ip_check_web_services_filter`
+
 [ESCU - Windows Get-AdComputer Unconstrained Delegation Discovery - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -31923,7 +32101,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Get-AdComputer Unconstrained Delegation Discovery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious PowerShell Get-ADComputer was identified on endpoint $ComputerName$
@@ -31969,7 +32147,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Hidden Schedule Task Settings - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Industroyer2", "Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = A schedule task with hidden setting enable in host $dest$
@@ -32015,7 +32193,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Hide Notification Features Through Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware", "Windows Defense Evasion Tactics", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = Registry modification to hide windows notification on $dest$
@@ -32055,7 +32233,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows High File Deletion Frequency - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Clop Ransomware", "WhisperGate"]
 action.risk = 1
 action.risk.param._risk_message = High frequency file deletion activity detected on host $Computer$
@@ -32095,7 +32273,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Hunting System Account Targeting Lsass - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
 action.risk.param._risk_message = A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related to credential dumping on $dest$. Review for further details.
@@ -32120,6 +32298,86 @@ realtime_schedule = 0
 is_visible = false
 search = `sysmon` EventCode=10 TargetImage=*lsass.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hunting_system_account_targeting_lsass_filter`
 
+[ESCU - Windows Identify Protocol Handlers - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings). To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL in the property to limit the scope of this query to similar handlers as ms-msdt.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings). To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL in the property to limit the scope of this query to similar handlers as ms-msdt.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives will be found. https and http is a URL Protocol handler that will trigger this analytic. Tune based on process or command-line.
+action.escu.creation_date = 2022-07-11
+action.escu.modification_date = 2022-07-11
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Identify Protocol Handlers - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Living Off The Land"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing a protocol handler.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 6}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 6}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Identify Protocol Handlers - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 20, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process Name"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes  by Processes.dest Processes.user Processes.process_name Processes.process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | lookup windows_protocol_handlers handler AS process OUTPUT handler ishandler | where ishandler="TRUE" | `windows_identify_protocol_handlers_filter`
+
+[ESCU - Windows Impair Defense Add Xml Applocker Rules - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic is to identify a process that imports applocker xml policy using PowerShell commandlet. This technique was seen in Azorult malware where it drop an xml Applocker policy that will deny several AV products and further executed the PowerShell Applocker commandlet.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic is to identify a process that imports applocker xml policy using PowerShell commandlet. This technique was seen in Azorult malware where it drop an xml Applocker policy that will deny several AV products and further executed the PowerShell Applocker commandlet.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = Administrators may execute this command that may cause some false positive.
+action.escu.creation_date = 2022-06-24
+action.escu.modification_date = 2022-06-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Impair Defense Add Xml Applocker Rules - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = Applocker importing xml policy command was executed in $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Impair Defense Add Xml Applocker Rules - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` AND Processes.process="*Import-Module Applocker*" AND Processes.process="*Set-AppLockerPolicy *"  AND Processes.process="* -XMLPolicy *" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_add_xml_applocker_rules_filter`
+
 [ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -32135,7 +32393,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Impair Defense Delete Win Defender Context Menu - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = Windows Defender context menu registry key deleted on $dest$.
@@ -32175,7 +32433,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Impair Defense Delete Win Defender Profile Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = Windows Defender Logger registry key set to 'disabled' on $dest$.
@@ -32200,6 +32458,52 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender" Registry.action = deleted by  Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.action  Registry.user Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_delete_win_defender_profile_registry_filter`
 
+[ESCU - Windows Impair Defense Deny Security Software With Applocker - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies a modification in the Windows registry by the Applocker utility that contains details or registry data values related to denying the execution of several security products. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV products and then loaded by using PowerShell Applocker commandlet.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies a modification in the Windows registry by the Applocker utility that contains details or registry data values related to denying the execution of several security products. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV products and then loaded by using PowerShell Applocker commandlet.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = False positives may be present based on organization use of Applocker. Filter as needed.
+action.escu.creation_date = 2022-06-24
+action.escu.modification_date = 2022-06-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Impair Defense Deny Security Software With Applocker - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = Applocker registry modification to deny the action of several AV products on $dest$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 100}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Impair Defense Deny Security Software With Applocker - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies a modification in the Windows registry by the Applocker utility that contains details or registry data values related to denying the execution of several security products. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV products and then loaded by using PowerShell Applocker commandlet.
+action.notable.param.rule_title = Windows Impair Defense Deny Security Software With Applocker
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy Objects\\*" AND Registry.registry_path= "*}Machine\\Software\\Policies\\Microsoft\\Windows\\SrpV2*") OR Registry.registry_path="*\\Software\\Policies\\Microsoft\\Windows\\SrpV2*" AND Registry.registry_value_data = "*Action\=\"Deny\"*" AND Registry.registry_value_data IN("*O=SYMANTEC*","*O=MCAFEE*","*O=KASPERSKY*","*O=BLEEPING COMPUTER*", "*O=PANDA SECURITY*","*O=SYSTWEAK SOFTWARE*", "*O=TREND MICRO*", "*O=AVAST*", "*O=GRIDINSOFT*", "*O=MICROSOFT*", "*O=NANO SECURITY*", "*O=SUPERANTISPYWARE.COM*", "*O=DOCTOR WEB*", "*O=MALWAREBYTES*", "*O=ESET*", "*O=AVIRA*", "*O=WEBROOT*") by  Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.registry_key_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_impair_defense_deny_security_software_with_applocker_filter`
+
 [ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -32215,7 +32519,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Impair Defenses Disable Win Defender Auto Logging - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = Windows Defender Logger registry key set to 'disabled' on $dest$.
@@ -32255,7 +32559,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Indirect Command Execution Via forfiles - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = The Program Compatability Assistant (pcalua.exe) launched the process $process_name$
@@ -32301,7 +32605,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Indirect Command Execution Via pcalua - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = The Program Compatability Assistant (pcalua.exe) launched the process $process_name$
@@ -32353,7 +32657,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows InstallUtil Credential Theft - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Signed Binary Proxy Execution InstallUtil"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ loading samlib.dll and vaultcli.dll to potentially capture credentials in memory.
@@ -32402,7 +32706,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows InstallUtil in Non Standard Path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Masquerading - Rename System Utilities", "Unusual Processes", "Ransomware", "Signed Binary Proxy Execution InstallUtil", "WhisperGate", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$.
@@ -32454,7 +32758,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows InstallUtil Remote Network Connection - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ generating a remote download.
@@ -32511,7 +32815,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows InstallUtil Uninstall Option - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall.
@@ -32569,7 +32873,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows InstallUtil Uninstall Option with Network - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall.
@@ -32625,7 +32929,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows InstallUtil URL in Command Line - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ passing a URL on the command-line.
@@ -32680,7 +32984,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Invalid Users Failed Authentication via Kerberos - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Password Spraying", "Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$
@@ -32720,7 +33024,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows ISO LNK File Creation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
 action.risk.param._risk_message = An ISO file was mounted on $dest$ and should be reviewed and filtered as needed.
@@ -32760,7 +33064,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Kerberos Local Successful Logon - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks", "Local Privilege Escalation With KrbRelayUp"]
 action.risk = 1
 action.risk.param._risk_message = A successful localhost Kerberos authentication event occurred on $dest$, possibly indicative of Kerberos relay attack.
@@ -32806,7 +33110,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows KrbRelayUp Service Creation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Local Privilege Escalation With KrbRelayUp"]
 action.risk = 1
 action.risk.param._risk_message = A service was created on $dest$, related to KrbRelayUp.
@@ -32852,7 +33156,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Linked Policies In ADSI Discovery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Industroyer2", "Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = powershell process having commandline $Message$ for user enumeration
@@ -32877,6 +33181,298 @@ realtime_schedule = 0
 is_visible = false
 search = `powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=organizationalunit*" ScriptBlockText = "*findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_linked_policies_in_adsi_discovery_filter`
 
+[ESCU - Windows Modify Registry Disable Toast Notifications - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic is to identify a modification in the Windows registry to disable toast notifications. This Windows Operating System feature is responsible for alerting or notifying user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion and execution.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic is to identify a modification in the Windows registry to disable toast notifications. This Windows Operating System feature is responsible for alerting or notifying user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion and execution.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+action.escu.creation_date = 2022-06-22
+action.escu.modification_date = 2022-06-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Modify Registry Disable Toast Notifications - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = the registry for DisallowRun settings was modified to enable in $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Modify Registry Disable Toast Notifications - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*" Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_toast_notifications_filter`
+
+[ESCU - Windows Modify Registry Disable Win Defender Raw Write Notif - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies a modification in the Windows registry to disable Windows Defender raw write notification feature. This policy controls whether raw volume write notifications are sent to behavior monitoring or not. This registry was recently identified in Azorult malware to bypass Windows Defender detections or behavior monitoring in terms of volume write.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies a modification in the Windows registry to disable Windows Defender raw write notification feature. This policy controls whether raw volume write notifications are sent to behavior monitoring or not. This registry was recently identified in Azorult malware to bypass Windows Defender detections or behavior monitoring in terms of volume write.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = Administrators may enable or disable this feature that may cause some false positive. Filter as needed.
+action.escu.creation_date = 2022-06-23
+action.escu.modification_date = 2022-06-23
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Modify Registry Disable Win Defender Raw Write Notif - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = The registry for raw write notification settings was modified to disable in $dest$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Modify Registry Disable Win Defender Raw Write Notif - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Real-Time Protection\\DisableRawWriteNotification*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_win_defender_raw_write_notif_filter`
+
+[ESCU - Windows Modify Registry Disable Windows Security Center Notif - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic is to identify a modification in the Windows registry to disable windows center notifications. This Windows Operating System feature is responsible for alerting or notifying user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion and execution.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic is to identify a modification in the Windows registry to disable windows center notifications. This Windows Operating System feature is responsible for alerting or notifying user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion and execution.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+action.escu.creation_date = 2022-06-22
+action.escu.modification_date = 2022-06-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Modify Registry Disable Windows Security Center Notif - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = the registry for security center notification settings was modified to disable mode in $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Modify Registry Disable Windows Security Center Notif - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*" Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disable_windows_security_center_notif_filter`
+
+[ESCU - Windows Modify Registry Disabling WER Settings - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies a modification in the Windows registry to disable Windows error reporting settings. This Windows feature allows the user to report bugs, errors, failure or problems encountered in specific application or processes. Adversaries use this technique to hide any error or failure that some of its malicious components trigger.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies a modification in the Windows registry to disable Windows error reporting settings. This Windows feature allows the user to report bugs, errors, failure or problems encountered in specific application or processes. Adversaries use this technique to hide any error or failure that some of its malicious components trigger.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed.
+action.escu.creation_date = 2022-06-22
+action.escu.modification_date = 2022-06-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Modify Registry Disabling WER Settings - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = the registry for WER settings was modified to be disabled on $dest$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Modify Registry Disabling WER Settings - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies a modification in the Windows registry to disable Windows error reporting settings. This Windows feature allows the user to report bugs, errors, failure or problems encountered in specific application or processes. Adversaries use this technique to hide any error or failure that some of its malicious components trigger.
+action.notable.param.rule_title = Windows Modify Registry Disabling WER Settings
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\disable*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disabling_wer_settings_filter`
+
+[ESCU - Windows Modify Registry DisAllow Windows App - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies modification in the Windows registry to prevent user running specific computer programs that could aid them in manually removing malware or detecting it using security products. This technique was recently identified in Azorult malware where it uses this registry value to prevent several AV products to execute on the compromised host machine.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies modification in the Windows registry to prevent user running specific computer programs that could aid them in manually removing malware or detecting it using security products. This technique was recently identified in Azorult malware where it uses this registry value to prevent several AV products to execute on the compromised host machine.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = Administrators may enable or disable this feature that may cause some false positive. Filter as needed.
+action.escu.creation_date = 2022-06-22
+action.escu.modification_date = 2022-06-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Modify Registry DisAllow Windows App - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = The registry for DisallowRun settings was modified to enable in $dest$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Modify Registry DisAllow Windows App - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies modification in the Windows registry to prevent user running specific computer programs that could aid them in manually removing malware or detecting it using security products. This technique was recently identified in Azorult malware where it uses this registry value to prevent several AV products to execute on the compromised host machine.
+action.notable.param.rule_title = Windows Modify Registry DisAllow Windows App
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_disallow_windows_app_filter`
+
+[ESCU - Windows Modify Registry Regedit Silent Reg Import - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies modification of Windows registry using regedit.exe application with silent mode parameter. regedit.exe windows application is commonly used as GUI app to check or modify registry. This application is also has undocumented command-line parameter and one of those are silent mode parameter that performs action without stopping for confirmation with dialog box. Importing registry from .reg files need to monitor in a production environment since it can be used adversaries to import RMS registry in compromised host.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies modification of Windows registry using regedit.exe application with silent mode parameter. regedit.exe windows application is commonly used as GUI app to check or modify registry. This application is also has undocumented command-line parameter and one of those are silent mode parameter that performs action without stopping for confirmation with dialog box. Importing registry from .reg files need to monitor in a production environment since it can be used adversaries to import RMS registry in compromised host.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = Administrators may execute this command that may cause some false positive. Filter as needed.
+action.escu.creation_date = 2022-06-24
+action.escu.modification_date = 2022-06-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Modify Registry Regedit Silent Reg Import - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = The regedit app was executed with silet mode parameter to import .reg file on $dest$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Modify Registry Regedit Silent Reg Import - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="regedit.exe" OR Processes.original_file_name="regedit.exe") AND Processes.process="* /s *" AND Processes.process="*.reg*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_regedit_silent_reg_import_filter`
+
+[ESCU - Windows Modify Registry Suppress Win Defender Notif - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic is to identify a modification in the Windows registry to suppress windows defender notification. This technique was abuse by adversaries and threat actor to bypassed windows defender on the targeted host. Azorult malware is one of the malware use this technique that also disable toast notification and other windows features as part of its malicious behavior.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic is to identify a modification in the Windows registry to suppress windows defender notification. This technique was abuse by adversaries and threat actor to bypassed windows defender on the targeted host. Azorult malware is one of the malware use this technique that also disable toast notification and other windows features as part of its malicious behavior.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+action.escu.creation_date = 2022-06-22
+action.escu.modification_date = 2022-06-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Modify Registry Suppress Win Defender Notif - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = the registry for suppresing windows fdefender notification settings was modified to disabled in $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Modify Registry Suppress Win Defender Notif - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\UX Configuration\\Notification_Suppress*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_suppress_win_defender_notif_filter`
+
 [ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -32892,7 +33488,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Data Destruction", "Windows Defense Evasion Tactics", "Hermetic Wiper", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = Registry modification in "ShowCompColor" and "ShowInfoTips" on $dest$
@@ -32923,6 +33519,52 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*" AND Registry.registry_value_name  IN("ShowCompColor", "ShowInfoTip") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `windows_modify_show_compress_color_and_info_tip_registry_filter`
 
+[ESCU - Windows MOF Event Triggered Execution via WMI - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following anaytic identifies MOFComp.exe loading a MOF file. The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Typically, MOFComp.exe does not reach out to the public internet or load a MOF file from User Profile paths. A filter and consumer is typically registered in WMI. Review parallel processes and query WMI subscriptions to gather artifacts. The default path of mofcomp.exe is C:\Windows\System32\wbem.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following anaytic identifies MOFComp.exe loading a MOF file. The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Typically, MOFComp.exe does not reach out to the public internet or load a MOF file from User Profile paths. A filter and consumer is typically registered in WMI. Review parallel processes and query WMI subscriptions to gather artifacts. The default path of mofcomp.exe is C:\Windows\System32\wbem.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives may be present from automation based applications (SCCM), filtering may be required. In addition, break the query out based on volume of usage. Filter process names or f
+action.escu.creation_date = 2022-07-15
+action.escu.modification_date = 2022-07-15
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows MOF Event Triggered Execution via WMI - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Living Off The Land"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ loading a MOF file.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows MOF Event Triggered Execution via WMI - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following anaytic identifies MOFComp.exe loading a MOF file. The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Typically, MOFComp.exe does not reach out to the public internet or load a MOF file from User Profile paths. A filter and consumer is typically registered in WMI. Review parallel processes and query WMI subscriptions to gather artifacts. The default path of mofcomp.exe is C:\Windows\System32\wbem.
+action.notable.param.rule_title = Windows MOF Event Triggered Execution via WMI
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name IN ("cmd.exe", "powershell.exe") Processes.process_name=mofcomp.exe) OR (Processes.process_name=mofcomp.exe Processes.process IN ("*\\AppData\\Local\\*","*\\Users\\Public\\*", "*\\WINDOWS\\Temp\\*")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_mof_event_triggered_execution_via_wmi_filter`
+
 [ESCU - Windows MSIExec DLLRegisterServer - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -32938,7 +33580,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows MSIExec DLLRegisterServer - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows System Binary Proxy Execution MSIExec"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to register a file.
@@ -32984,7 +33626,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows MSIExec Remote Download - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows System Binary Proxy Execution MSIExec"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a remote file.
@@ -33030,7 +33672,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows MSIExec Spawn Discovery Command - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows System Binary Proxy Execution MSIExec"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running different discovery commands.
@@ -33076,7 +33718,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows MSIExec Unregister DLLRegisterServer - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows System Binary Proxy Execution MSIExec"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to unregister a file.
@@ -33122,7 +33764,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows MSIExec With Network Connections - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows System Binary Proxy Execution MSIExec"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $process_name$ was identified on endpoint $dest$ contacting a remote destination.
@@ -33168,7 +33810,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows NirSoft AdvancedRun - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Unusual Processes", "Ransomware", "WhisperGate"]
 action.risk = 1
 action.risk.param._risk_message = An instance of advancedrun.exe, $process_name$, was spawned by $parent_process_name$ on $dest$ by $user$.
@@ -33214,7 +33856,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows NirSoft Utilities - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["WhisperGate"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ related to NiRSoft software usage.
@@ -33254,7 +33896,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Non-System Account Targeting Lsass - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Credential Dumping"]
 action.risk = 1
 action.risk.param._risk_message = A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related to credential dumping on $dest$. Review for further details.
@@ -33285,6 +33927,138 @@ realtime_schedule = 0
 is_visible = false
 search = `sysmon` EventCode=10 TargetImage=*lsass.exe SourceUser!="NT AUTHORITY\\*" | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_non_system_account_targeting_lsass_filter`
 
+[ESCU - Windows Odbcconf Hunting - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies Odbcconf.exe running in the environment to assist with identifying tuning higher fidelity analytics related to Odbcconf.exe.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.008"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies Odbcconf.exe running in the environment to assist with identifying tuning higher fidelity analytics related to Odbcconf.exe.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives will be present as this is meant to assist with filtering and tuning.
+action.escu.creation_date = 2022-06-30
+action.escu.modification_date = 2022-06-30
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Odbcconf Hunting - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Living Off The Land"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 6}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 6}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Odbcconf Hunting - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 20, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.008"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process Name"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_hunting_filter`
+
+[ESCU - Windows Odbcconf Load DLL - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies odbcconf.exe, Windows Open Database Connectivity utility, utilizing the action function of regsvr to load a DLL. An example will look like - odbcconf.exe /A { REGSVR T1218-2.dll }. During triage, review parent process, parallel procesess and file modifications.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.008"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies odbcconf.exe, Windows Open Database Connectivity utility, utilizing the action function of regsvr to load a DLL. An example will look like - odbcconf.exe /A { REGSVR T1218-2.dll }. During triage, review parent process, parallel procesess and file modifications.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed.
+action.escu.creation_date = 2022-06-28
+action.escu.modification_date = 2022-06-28
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Odbcconf Load DLL - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Living Off The Land"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Odbcconf Load DLL - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.008"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process Name"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies odbcconf.exe, Windows Open Database Connectivity utility, utilizing the action function of regsvr to load a DLL. An example will look like - odbcconf.exe /A { REGSVR T1218-2.dll }. During triage, review parent process, parallel procesess and file modifications.
+action.notable.param.rule_title = Windows Odbcconf Load DLL
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe Processes.process IN ("*/a *",  "*-a*") Processes.process="*regsvr*"  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_load_dll_filter`
+
+[ESCU - Windows Odbcconf Load Response File - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the odbcconf.exe, Windows Open Database Connectivity utility, loading up a resource file. The file extension is arbitrary and may be named anything. The resource file itself may have different commands supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. During triage, review file modifications and parallel processes.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.008"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies the odbcconf.exe, Windows Open Database Connectivity utility, loading up a resource file. The file extension is arbitrary and may be named anything. The resource file itself may have different commands supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. During triage, review file modifications and parallel processes.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed.
+action.escu.creation_date = 2022-06-30
+action.escu.modification_date = 2022-06-30
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Odbcconf Load Response File - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Living Off The Land"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Odbcconf Load Response File - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.008"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process Name"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the odbcconf.exe, Windows Open Database Connectivity utility, loading up a resource file. The file extension is arbitrary and may be named anything. The resource file itself may have different commands supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. During triage, review file modifications and parallel processes.
+action.notable.param.rule_title = Windows Odbcconf Load Response File
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe Processes.process IN ("*-f *","*/f *") Processes.process="*.rsp*"  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_odbcconf_load_response_file_filter`
+
 [ESCU - Windows Office Product Spawning MSDT - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -33300,7 +34074,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Office Product Spawning MSDT - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments", "Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190"]
 action.risk = 1
 action.risk.param._risk_message = Office parent process $parent_process_name$ has spawned a child process $process_name$ on host $dest$.
@@ -33354,7 +34128,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Possible Credential Dumping - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack", "DarkSide Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related to credential dumping on $dest$. Review for further details.
@@ -33389,6 +34163,52 @@ realtime_schedule = 0
 is_visible = false
 search = `sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess IN ("0x01000", "0x1010", "0x1038", "0x40", "0x1400", "0x1fffff", "0x1410", "0x143a", "0x1438", "0x1000") CallTrace IN ("*dbgcore.dll*", "*dbghelp.dll*", "*ntdll.dll*") | stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage, GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_possible_credential_dumping_filter`
 
+[ESCU - Windows Powershell Import Applocker Policy - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic is to identify the imports of Windows PowerShell Applocker commandlets. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV product and then loaded using PowerShell Applocker commandlet.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic is to identify the imports of Windows PowerShell Applocker commandlets. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV product and then loaded using PowerShell Applocker commandlet.
+action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+action.escu.known_false_positives = administrators may execute this command that may cause some false positive.
+action.escu.creation_date = 2022-06-30
+action.escu.modification_date = 2022-06-30
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Powershell Import Applocker Policy - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = A PowerShell script contains Import Applocker Policy command $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Powershell Import Applocker Policy - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic is to identify the imports of Windows PowerShell Applocker commandlets. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV product and then loaded using PowerShell Applocker commandlet.
+action.notable.param.rule_title = Windows Powershell Import Applocker Policy
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `powershell` EventCode=4104 ScriptBlockText="*Import-Module Applocker*" ScriptBlockText="*Set-AppLockerPolicy *" ScriptBlockText="* -XMLPolicy *" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powershell_import_applocker_policy_filter`
+
 [ESCU - Windows PowerView Constrained Delegation Discovery - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -33404,7 +34224,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows PowerView Constrained Delegation Discovery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious PowerShell Get-DomainComputer was identified on endpoint $ComputerName$
@@ -33450,10 +34270,10 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows PowerView Kerberos Service Ticket Request - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
 action.risk = 1
-action.risk.param._risk_message = PowerView commandlets used for requesting SPN service ticket executed on $Computer_Name$
+action.risk.param._risk_message = PowerView commandlets used for requesting SPN service ticket executed on $Computer$
 action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 27}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
@@ -33479,7 +34299,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message=*Get-DomainSPNTicket* | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powerview_kerberos_service_ticket_request_filter`
+search = `powershell` EventCode=4104 ScriptBlockText=*Get-DomainSPNTicket* | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powerview_kerberos_service_ticket_request_filter`
 
 [ESCU - Windows PowerView SPN Discovery - Rule]
 action.escu = 0
@@ -33496,10 +34316,10 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows PowerView SPN Discovery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
 action.risk = 1
-action.risk.param._risk_message = PowerView commandlets used for SPN discovery executed on $Computer_Name$
+action.risk.param._risk_message = PowerView commandlets used for SPN discovery executed on $Computer$
 action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 27}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
@@ -33542,7 +34362,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows PowerView Unconstrained Delegation Discovery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious PowerShell Get-DomainComputer was identified on endpoint $ComputerName$
@@ -33588,7 +34408,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Process With NamedPipe CommandLine - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
 action.risk.param._risk_message = Process with named pipe in $process$ on $dest$
@@ -33628,7 +34448,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Processes Killed By Industroyer2 Malware - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Industroyer2"]
 action.risk = 1
 action.risk.param._risk_message = process was terminated $process_name$ in $dest$
@@ -33668,7 +34488,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Raccine Scheduled Task Deletion - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user user$ attempting to disable Raccines scheduled task.
@@ -33714,7 +34534,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Rasautou DLL Execution - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to load a DLL in a suspicious manner.
@@ -33760,7 +34580,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Raw Access To Disk Volume Partition - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Caddy Wiper", "Data Destruction", "Hermetic Wiper"]
 action.risk = 1
 action.risk.param._risk_message = Process accessing disk partition $device$ in $dest$
@@ -33800,7 +34620,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Raw Access To Master Boot Record Drive - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Data Destruction", "Caddy Wiper", "WhisperGate", "Hermetic Wiper"]
 action.risk = 1
 action.risk.param._risk_message = process accessing MBR $device$ in $dest$
@@ -33846,7 +34666,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Registry Certificate Added - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Drivers", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = A root certificate was added on $dest$.
@@ -33892,7 +34712,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Registry Delete Task SD - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Registry Abuse", "Windows Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = A scheduled task security descriptor was deleted from the registry on $dest$.
@@ -33938,7 +34758,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Registry Modification for Safe Mode Persistence - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ransomware", "Windows Registry Abuse", "Windows Drivers"]
 action.risk = 1
 action.risk.param._risk_message = Safeboot registry $registry_path$ was added or modified with a new value $registry_value_name$ on $dest$
@@ -33969,6 +34789,52 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path IN ("*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\*","*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\*") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | join process_guid _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)`] | table _time dest user process_name process process_guid registry_path registry_value_name registry_value_data registry_key_name | `windows_registry_modification_for_safe_mode_persistence_filter`
 
+[ESCU - Windows Remote Access Software RMS Registry - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic is to identify a modification or creation of Windows registry related to the Remote Manipulator System (RMS) Remote Admin tool. RMS is a legitimate tool developed by russian organization TektonIT and has been observed being abused by adversaries to gain remote access to the targeted host. Azorult malware utilized RMS to gain remote access.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1219"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic is to identify a modification or creation of Windows registry related to the Remote Manipulator System (RMS) Remote Admin tool. RMS is a legitimate tool developed by russian organization TektonIT and has been observed being abused by adversaries to gain remote access to the targeted host. Azorult malware utilized RMS to gain remote access.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+action.escu.creation_date = 2022-06-22
+action.escu.modification_date = 2022-06-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Remote Access Software RMS Registry - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = the registry related to RMS tool is created in $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Remote Access Software RMS Registry - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1219"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic is to identify a modification or creation of Windows registry related to the Remote Manipulator System (RMS) Remote Admin tool. RMS is a legitimate tool developed by russian organization TektonIT and has been observed being abused by adversaries to gain remote access to the targeted host. Azorult malware utilized RMS to gain remote access.
+action.notable.param.rule_title = Windows Remote Access Software RMS Registry
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SYSTEM\\Remote Manipulator System*" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_access_software_rms_registry_filter`
+
 [ESCU - Windows Remote Assistance Spawning Process - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -33984,7 +34850,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Remote Assistance Spawning Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Unusual Processes"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, generating behavior not common with msra.exe.
@@ -34015,6 +34881,178 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msra.exe `windows_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_assistance_spawning_process_filter`
 
+[ESCU - Windows Remote Service Rdpwinst Tool Execution - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies RDPWInst.exe tool, which is a RDP wrapper library tool designed to enable remote desktop host support and concurrent RDP session on reduced functionality system. Unfortunately, this open project was abused by adversaries to enable RDP connection to the targeted host for remote access and potentially be for lateral movement.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies RDPWInst.exe tool, which is a RDP wrapper library tool designed to enable remote desktop host support and concurrent RDP session on reduced functionality system. Unfortunately, this open project was abused by adversaries to enable RDP connection to the targeted host for remote access and potentially be for lateral movement.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = This tool was designed for home usage and not commonly seen in production environment. Filter as needed.
+action.escu.creation_date = 2022-06-24
+action.escu.modification_date = 2022-06-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Remote Service Rdpwinst Tool Execution - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = Rdpwinst.exe executed on $dest$.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Remote Service Rdpwinst Tool Execution - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies RDPWInst.exe tool, which is a RDP wrapper library tool designed to enable remote desktop host support and concurrent RDP session on reduced functionality system. Unfortunately, this open project was abused by adversaries to enable RDP connection to the targeted host for remote access and potentially be for lateral movement.
+action.notable.param.rule_title = Windows Remote Service Rdpwinst Tool Execution
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="RDPWInst.exe" OR Processes.original_file_name="RDPWInst.exe") AND Processes.process IN ("* -i*", "* -s*", "* -o*", "* -w*", "* -r*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_service_rdpwinst_tool_execution_filter`
+
+[ESCU - Windows Remote Services Allow Rdp In Firewall - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic is to identify a modification in the Windows firewall to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer to remotely access the compromised or targeted host by allowing this protocol in firewall. Even this protocol might be allowed in some production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through firewall which is also common traits of attack to start lateral movement.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic is to identify a modification in the Windows firewall to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer to remotely access the compromised or targeted host by allowing this protocol in firewall. Even this protocol might be allowed in some production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through firewall which is also common traits of attack to start lateral movement.
+action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+action.escu.known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+action.escu.creation_date = 2022-06-21
+action.escu.modification_date = 2022-06-21
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Remote Services Allow Rdp In Firewall - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = new firewall rules was added to allow rdp connection to $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Remote Services Allow Rdp In Firewall - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "netsh.exe" OR Processes.original_file_name= "netsh.exe") AND Processes.process = "*firewall*" AND Processes.process = "*add*" AND Processes.process = "*protocol=TCP*" AND Processes.process = "*localport=3389*" AND Processes.process = "*action=allow*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_services_allow_rdp_in_firewall_filter`
+
+[ESCU - Windows Remote Services Allow Remote Assistance - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic is to identify a modification in the Windows registry to enable remote desktop assistance on a targeted machine. This technique was seen in several adversaries, malware or red teamer like azorult to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This Anomaly behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common. And as per stated in microsoft documentation the default value of this registry is false that makes this a good indicator of suspicious behavior.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic is to identify a modification in the Windows registry to enable remote desktop assistance on a targeted machine. This technique was seen in several adversaries, malware or red teamer like azorult to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This Anomaly behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common. And as per stated in microsoft documentation the default value of this registry is false that makes this a good indicator of suspicious behavior.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+action.escu.creation_date = 2022-06-21
+action.escu.modification_date = 2022-06-21
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Remote Services Allow Remote Assistance - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = the registry for rdp protocol was modified to enable in $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Remote Services Allow Remote Assistance - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal Server\\fAllowToGetHelp*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_services_allow_remote_assistance_filter`
+
+[ESCU - Windows Remote Services Rdp Enable - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic is to identify a modification in the Windows registry to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic is to identify a modification in the Windows registry to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = administrators may enable or disable this feature that may cause some false positive.
+action.escu.creation_date = 2022-06-21
+action.escu.modification_date = 2022-06-21
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Remote Services Rdp Enable - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = the registry for rdp protocol was modified to enable in $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Remote Services Rdp Enable - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021.001", "T1021"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic is to identify a modification in the Windows registry to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common.
+action.notable.param.rule_title = Windows Remote Services Rdp Enable
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_services_rdp_enable_filter`
+
 [ESCU - Windows Root Domain linked policies Discovery - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -34030,7 +35068,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Root Domain linked policies Discovery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Industroyer2", "Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = powershell process having commandline $Message$ for user enumeration
@@ -34070,7 +35108,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Schtasks Create Run As System - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Persistence Techniques"]
 action.risk = 1
 action.risk.param._risk_message = An $process_name$ was created on endpoint $dest$ attempting to spawn as SYSTEM.
@@ -34116,7 +35154,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Security Account Manager Stopped - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Ryuk Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = The Windows Security Account Manager (SAM) was stopped via cli by $user$ on $dest$ by this command: $processs$
@@ -34162,7 +35200,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Service Create Kernel Mode Driver - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Drivers"]
 action.risk = 1
 action.risk.param._risk_message = Service control, $process_name$, loaded a new kernel mode driver on $dest$ by $user$.
@@ -34208,7 +35246,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Service Created With Suspicious Service Path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Clop Ransomware", "Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = A service $Service_File_Name$ was created from a non-standard path using $Service_Name$
@@ -34254,7 +35292,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Service Created Within Public Path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = A Windows Service $Service_File_Name$ with a public path was created on $ComputerName
@@ -34300,7 +35338,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Service Creation on Remote Endpoint - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = A Windows Service was created on a remote endpoint from $dest
@@ -34346,7 +35384,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Service Creation Using Registry Entry - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Lateral Movement", "Suspicious Windows Registry Activities", "Windows Persistence Techniques", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = A Windows Service was created on a endpoint from $dest$
@@ -34392,7 +35430,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Service Initiation on Remote Endpoint - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = A Windows Service was started on a remote endpoint from $dest
@@ -34423,6 +35461,52 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe OR Processes.original_file_name=sc.exe) (Processes.process=*\\\\* AND Processes.process=*start*) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_initiation_on_remote_endpoint_filter`
 
+[ESCU - Windows Service Stop By Deletion - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue there objective and evade detections.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue there objective and evade detections.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+action.escu.known_false_positives = It is possible administrative scripts may start/stop/delete services. Filter as needed.
+action.escu.creation_date = 2022-06-21
+action.escu.modification_date = 2022-06-21
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Service Stop By Deletion - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to delete a service.
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Service Stop By Deletion - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "nist": ["DE.CM"], "observable": [{"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue there objective and evade detections.
+action.notable.param.rule_title = Windows Service Stop By Deletion
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = sc.exe OR Processes.original_file_name = sc.exe) Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_stop_by_deletion_filter`
+
 [ESCU - Windows System File on Disk - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -34438,7 +35522,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows System File on Disk - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Drivers"]
 action.risk = 1
 action.risk.param._risk_message = A new driver is present on $dest$.
@@ -34478,7 +35562,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Terminating Lsass Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Double Zero Destructor"]
 action.risk = 1
 action.risk.param._risk_message = a process $SourceImage$ terminates Lsass process in $dest$
@@ -34524,7 +35608,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Users Authenticate Using Explicit Credentials - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Password Spraying", "Insider Threat"]
 action.risk = 1
 action.risk.param._risk_message = Potential password spraying attack from $ComputerName$
@@ -34549,6 +35633,52 @@ realtime_schedule = 0
 is_visible = false
 search =  `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1) | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `windows_users_authenticate_using_explicit_credentials_filter` 
 
+[ESCU - Windows Valid Account With Never Expires Password - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies net.exe updating user account policies for password requirement with non-expiring password. This technique was seen in several adversaries and malware like Azorult to maintain the foothold (persistence), gaining privilege escalation, defense evasion and possible for lateral movement for specific users or created user account on the targeted host. This TTP detections is a good pivot to see further what other events that users executes on the machines.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies net.exe updating user account policies for password requirement with non-expiring password. This technique was seen in several adversaries and malware like Azorult to maintain the foothold (persistence), gaining privilege escalation, defense evasion and possible for lateral movement for specific users or created user account on the targeted host. This TTP detections is a good pivot to see further what other events that users executes on the machines.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+action.escu.known_false_positives = This behavior is not commonly seen in production environment and not advisable, filter as needed.
+action.escu.creation_date = 2022-06-23
+action.escu.modification_date = 2022-06-23
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Valid Account With Never Expires Password - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Azorult"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to make non-expiring password on host user accounts.
+action.risk.param._risk = [{"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Valid Account With Never Expires Password - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azorult"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Persistence"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "nist": ["DE.CM"], "observable": [{"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies net.exe updating user account policies for password requirement with non-expiring password. This technique was seen in several adversaries and malware like Azorult to maintain the foothold (persistence), gaining privilege escalation, defense evasion and possible for lateral movement for specific users or created user account on the targeted host. This TTP detections is a good pivot to see further what other events that users executes on the machines.
+action.notable.param.rule_title = Windows Valid Account With Never Expires Password
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="* accounts *" AND Processes.process="* /maxpwage:unlimited" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_valid_account_with_never_expires_password_filter`
+
 [ESCU - Windows WMI Process Call Create - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -34564,7 +35694,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows WMI Process Call Create - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious WMI Use"]
 action.risk = 1
 action.risk.param._risk_message = process with $process$ commandline executed in $dest$
@@ -34612,7 +35742,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$
@@ -34670,7 +35800,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - WinEvent Scheduled Task Created Within Public Path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware", "IcedID", "Active Directory Lateral Movement", "Industroyer2"]
 action.risk = 1
 action.risk.param._risk_message = A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$
@@ -34720,7 +35850,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["IcedID", "Windows Persistence Techniques", "Industroyer2"]
 action.risk = 1
 action.risk.param._risk_message = A Scheduled Task was scheduled and ran on $dest$.
@@ -34760,7 +35890,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Winhlp32 Spawning a Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Remcos"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$, and is not typical activity for this process.
@@ -34806,7 +35936,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Winword Spawning Cmd - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
 action.risk.param._risk_message = $parent_process_name$ on $dest$ by $user$ launched command: $process_name$ which is very common in spearphishing attacks.
@@ -34852,7 +35982,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Winword Spawning PowerShell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
 action.risk.param._risk_message = $parent_process_name$ on $dest$ by $user$ launched the following powershell process: $process_name$ which is very common in spearphishing attacks
@@ -34898,7 +36028,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Winword Spawning Windows Script Host - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ on $dest$ spawned Windows Script Host from Winword.exe
@@ -34954,7 +36084,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - WMI Permanent Event Subscription - Sysmon - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious WMI Use"]
 action.risk = 1
 action.risk.param._risk_message = User $user$ on $host$ executed the following suspicious WMI query: $Query$.  Filter: $filter$. Consumer: $Consumer$.  EventCode: $EventCode$
@@ -34999,17 +36129,17 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found in malware and APT events where the adversary will map all running security applications or services on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = network administrator may used this command for checking purposes
-action.escu.creation_date = 2021-06-14
-action.escu.modification_date = 2021-06-14
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - WMI Recon Running Process Or Services - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Hermetic Wiper", "Malicious PowerShell"]
 action.risk = 1
-action.risk.param._risk_message = Suspicious powerShell script execution by $user$ on $ComputerName$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 30}]
+action.risk.param._risk_message = Suspicious powerShell script execution by $user$ on $Computer$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 30}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -35017,7 +36147,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - WMI Recon Running Process Or Services - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -35034,7 +36164,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message= "*SELECT*" AND (Message="*Win32_Process*" OR Message="*Win32_Service*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmi_recon_running_process_or_services_filter`
+search = `powershell` EventCode=4104 ScriptBlockText= "*SELECT*" AND (ScriptBlockText="*Win32_Process*" OR ScriptBlockText="*Win32_Service*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmi_recon_running_process_or_services_filter`
 
 [ESCU - Wmic Group Discovery - Rule]
 action.escu = 0
@@ -35055,7 +36185,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Wmic Group Discovery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = Local group discovery on $dest$ by $user$.
@@ -35083,22 +36213,22 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
 [ESCU - Wmic NonInteractive App Uninstallation - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This analytic is to detect a suspicious wmic commandlined that uninstall application non interactively. This technique was seen in IceID to uninstall av products to the compromised host to bypassed and evade detections. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
+description = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This analytic is to detect a suspicious wmic commandlined that uninstall application non interactively. This technique was seen in IceID to uninstall av products to the compromised host to bypassed and evade detections. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
-action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-action.escu.known_false_positives = third party application may use this approach to uninstall there application
-action.escu.creation_date = 2021-10-20
-action.escu.modification_date = 2021-10-20
+action.escu.eli5 = This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = Third party application may use this approach to uninstall applications.
+action.escu.creation_date = 2022-07-19
+action.escu.modification_date = 2022-07-19
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Wmic NonInteractive App Uninstallation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["IceID"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["IceID", "Azorult"]
 action.risk = 1
-action.risk.param._risk_message = wmic $process$ with commandline $process$ in $dest$
+action.risk.param._risk_message = Wmic $process_name$ with command-line $process$ on $dest$ attempting to uninstall software.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
@@ -35107,7 +36237,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Wmic NonInteractive App Uninstallation - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IceID"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IceID", "Azorult"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -35135,7 +36265,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - WMIC XSL Execution via URL - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious WMI Use"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to download a remote XSL script.
@@ -35181,7 +36311,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Wmiprsve LOLBAS Execution Process Spawn - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = Wmiprsve.exe spawned a LOLBAS process on $dest$.
@@ -35227,7 +36357,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Wscript Or Cscript Suspicious Child Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["FIN7", "Remcos", "Unusual Processes", "WhisperGate"]
 action.risk = 1
 action.risk.param._risk_message = wscript or cscript parent process spawned $process_name$ in $dest$
@@ -35273,7 +36403,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Wsmprovhost LOLBAS Execution Process Spawn - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = Wsmprovhost.exe spawned a LOLBAS process on $dest$.
@@ -35319,7 +36449,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - WSReset UAC Bypass - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Living Off The Land", "Windows Registry Abuse"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
@@ -35365,7 +36495,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - XMRIG Driver Loaded - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["XMRig"]
 action.risk = 1
 action.risk.param._risk_message = A driver $ImageLoaded$ related to xmrig crytominer loaded in host $Computer$
@@ -35411,7 +36541,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - XSL Script Execution With WMIC - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["FIN7", "Suspicious WMI Use"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to load a XSL script.
@@ -35457,7 +36587,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect New Login Attempts to Routers - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Router and Infrastructure Security"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -35505,7 +36635,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Email Attachments With Lots Of Spaces - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Hermetic Wiper", "Emotet Malware  DHS Report TA18-201A ", "Suspicious Emails"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -35545,7 +36675,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Email files written outside of the Outlook directory - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Collection and Staging"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -35591,7 +36721,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Email servers sending high volume traffic to hosts - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Collection and Staging", "HAFNIUM Group"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -35631,7 +36761,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Monitor Email For Brand Abuse - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Brand Monitoring", "Suspicious Emails"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -35677,7 +36807,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Okta Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -35723,7 +36853,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - No Windows Updates in a time frame - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Monitor for Updates"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -35763,7 +36893,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Okta Account Lockout Events - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Okta Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -35803,7 +36933,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Okta Failed SSO Attempts - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Okta Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -35843,7 +36973,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Okta User Logins From Multiple Cities - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Okta Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -35885,7 +37015,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Email Attachment Extensions - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Hermetic Wiper", "Emotet Malware  DHS Report TA18-201A ", "Suspicious Emails"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -35925,7 +37055,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Java Classes - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Apache Struts Vulnerability"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -35965,7 +37095,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Web Servers Executing Suspicious Processes - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Apache Struts Vulnerability"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36011,7 +37141,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Cloud Instance Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36051,7 +37181,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Abnormally High Number Of Cloud Instances Launched - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36091,7 +37221,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Amazon EKS Kubernetes cluster scan detection - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Scanning Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36131,7 +37261,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Amazon EKS Kubernetes Pod scan detection - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Scanning Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36171,7 +37301,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - aws detect attach to role policy - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["AWS Cross Account Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36211,7 +37341,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - aws detect permanent key creation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["AWS Cross Account Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36251,7 +37381,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - aws detect role creation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["AWS Cross Account Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36291,7 +37421,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - aws detect sts assume role abuse - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["AWS Cross Account Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36331,7 +37461,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - aws detect sts get session token abuse - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["AWS Cross Account Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36371,7 +37501,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect GCP Storage access from a new IP - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious GCP Storage Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36411,7 +37541,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect New Open GCP Storage Buckets - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious GCP Storage Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36457,7 +37587,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect S3 access from a new IP - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36497,7 +37627,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["AWS Security Hub Alerts"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36537,7 +37667,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["AWS Network ACL Activity", "Suspicious AWS Traffic", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36577,7 +37707,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Spike in S3 Bucket deletion - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Amazon Web Services - Cloudtrail"]
 action.escu.analytic_story = ["Suspicious AWS S3 Activities"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36617,7 +37747,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GCP Detect gcploit framework - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["GCP Cross Account Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36663,7 +37793,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - GCP Kubernetes cluster pod scan detection - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Scanning Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36703,7 +37833,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Gdrive suspicious file sharing - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Spearphishing Attachments", "Data Exfiltration"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36743,7 +37873,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Gsuite suspicious calendar invite - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36783,7 +37913,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - High Number of Login Failures from a single source - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Office 365 Detections"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36823,7 +37953,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36848,46 +37978,6 @@ realtime_schedule = 0
 is_visible = false
 search = `aws_cloudwatchlogs_eks` userAgent=kubectl* sourceIPs{}!=127.0.0.1 sourceIPs{}!=::1 src_user=system:anonymous  | table  src_ip src_user verb userAgent requestURI  | stats  count by src_ip src_user verb userAgent requestURI |`kubernetes_aws_detect_suspicious_kubectl_calls_filter`
 
-[ESCU - New container uploaded to AWS ECR - Rule]
-action.escu = 0
-action.escu.enabled = 1
-description = This searches show information on uploaded containers including source user, image id, source IP user type, http user agent, region, first time, last time of operation (PutImage). These searches are based on Cloud Infrastructure Data Model.
-action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1525"]}
-action.escu.data_models = []
-action.escu.eli5 = This searches show information on uploaded containers including source user, image id, source IP user type, http user agent, region, first time, last time of operation (PutImage). These searches are based on Cloud Infrastructure Data Model.
-action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs. You must also install Cloud Infrastructure data model. Please also customize the `container_implant_aws_detection_filter` macro to filter out the false positives.
-action.escu.known_false_positives = Uploading container is a normal behavior from developers or users with access to container registry.
-action.escu.creation_date = 2020-02-20
-action.escu.modification_date = 2020-02-20
-action.escu.confidence = high
-action.escu.full_search_name = ESCU - New container uploaded to AWS ECR - Rule
-action.escu.search_type = detection
-action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
-action.escu.analytic_story = ["Container Implantation Monitoring and Investigation"]
-action.risk = 1
-action.risk.param._risk_message = tbd
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}]
-action.risk.param._risk_score = 0
-action.risk.param.verbose = 0
-cron_schedule = 0 * * * *
-dispatch.earliest_time = -70m@m
-dispatch.latest_time = -10m@m
-action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - New container uploaded to AWS ECR - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Container Implantation Monitoring and Investigation"], "confidence": 50, "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1525"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
-schedule_window = auto
-alert.digest_mode = 1
-disabled = true
-enableSched = 1
-allow_skew = 100%
-counttype = number of events
-relation = greater than
-quantity = 0
-realtime_schedule = 0
-is_visible = false
-search = | tstats count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Cloud_Infrastructure.Compute where Compute.user_type!="AssumeRole" AND Compute.http_user_agent="AWS Internal" AND Compute.event_name="PutImage" by Compute.image_id Compute.src_user Compute.src Compute.region Compute.msg Compute.user_type | `drop_dm_object_name("Compute")` | `new_container_uploaded_to_aws_ecr_filter` 
-
 [ESCU - Child Processes of Spoolsv exe - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -36903,7 +37993,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Child Processes of Spoolsv exe - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Privilege Escalation", "Hermetic Wiper"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36949,7 +38039,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Baron Samedit CVE-2021-3156 - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Baron Samedit CVE-2021-3156"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -36995,7 +38085,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Baron Samedit CVE-2021-3156"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -37041,7 +38131,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Baron Samedit CVE-2021-3156"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -37087,7 +38177,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Computer Changed with Anonymous Account - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Detect Zerologon Attack"]
 action.risk = 1
 action.risk.param._risk_message = The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the an account or group being changed by an anonymous account.
@@ -37127,7 +38217,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Outlook exe writing a zip file - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Spearphishing Attachments"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -37173,7 +38263,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Rare Executables - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Emotet Malware  DHS Report TA18-201A ", "Unusual Processes", "Cloud Federated Credential Abuse"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -37213,7 +38303,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detection of tools built by NirSoft - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Emotet Malware  DHS Report TA18-201A "]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -37267,7 +38357,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Exchange PowerShell Abuse via SSRF - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["ProxyShell"]
 action.risk = 1
 action.risk.param._risk_message = Activity related to ProxyShell has been identified on $dest$. Review events and take action accordingly.
@@ -37317,13 +38407,13 @@ Module - New-MailboxExportRequest will begin the process of exporting contents o
 Module - New-managementroleassignment can assign a management role to a management role group, management role assignment policy, user, or universal security group (USG).
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = Administrators or power users may use this PowerShell commandlet for troubleshooting.
-action.escu.creation_date = 2021-08-27
-action.escu.modification_date = 2021-08-27
+action.escu.creation_date = 2022-05-02
+action.escu.modification_date = 2022-05-02
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Exchange PowerShell Module Usage - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["ProxyShell"]
 action.risk = 1
 action.risk.param._risk_message = Local user discovery enumeration using PowerShell on $dest$ by $user$
@@ -37355,7 +38445,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*") | stats count min(_time) as firstTime max(_time) as lastTime by Path Message OpCode ComputerName User EventCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `exchange_powershell_module_usage_filter`
+search = `powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*") | stats count min(_time) as firstTime max(_time) as lastTime by lastTime by Opcode Computer UserID EventCode ScriptBlockText| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `exchange_powershell_module_usage_filter`
 
 [ESCU - First Time Seen Child Process of Zoom - Rule]
 action.escu = 0
@@ -37372,7 +38462,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - First Time Seen Child Process of Zoom - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Suspicious Zoom Child Processes"]
 action.risk = 1
 action.risk.param._risk_message = Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us which has not been previously on host $dest$
@@ -37412,7 +38502,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - First Time Seen Running Windows Service - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Windows Service Abuse", "Orangeworm Attack Group", "NOBELIUM Group"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -37452,7 +38542,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Stdout Redirection To Dev Null File - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["CyclopsBLink", "Industroyer2"]
 action.risk = 1
 action.risk.param._risk_message = a commandline $process$ that redirect stdout to dev/null in $dest$
@@ -37492,7 +38582,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - MacOS - Re-opened Applications - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["ColdRoot MacOS RAT"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -37538,7 +38628,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["ProxyShell", "Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = A file - $file_name$ was written to disk that is related to IIS exploitation related to ProxyShell. Review further file modifications on endpoint $dest$ by user $user$.
@@ -37584,7 +38674,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Print Processor Registry Autostart - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Persistence Techniques", "Windows Privilege Escalation", "Hermetic Wiper"]
 action.risk = 1
 action.risk.param._risk_message = modified/added/deleted registry entry $Registry.registry_path$ in $dest$
@@ -37630,7 +38720,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Processes Tapping Keyboard Events - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["ColdRoot MacOS RAT"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -37676,7 +38766,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Randomly Generated Scheduled Task Name - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = A windows scheduled task with a suspicious task name was created on $dest$
@@ -37716,7 +38806,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Randomly Generated Windows Service Name - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = A Windows Service with a suspicious service name was installed on $ComputerName$
@@ -37756,7 +38846,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote Desktop Process Running On System - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Hidden Cobra Malware", "Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -37796,7 +38886,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Spike in File Writes - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -37836,7 +38926,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Sunburst Correlation DLL and Network Event - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["NOBELIUM Group"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -37882,7 +38972,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious Curl Network Connection - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Silver Sparrow", "Ingress Tool Transfer"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -37942,7 +39032,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious PlistBuddy Usage - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Silver Sparrow"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -38009,7 +39099,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious PlistBuddy Usage via OSquery - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Silver Sparrow"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -38062,7 +39152,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Suspicious SQLite3 LSQuarantine Behavior - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Silver Sparrow"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -38110,7 +39200,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Unusual Number of Computer Service Tickets Requested - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Lateral Movement", "Active Directory Kerberos Attacks"]
 action.risk = 1
 action.risk.param._risk_message = 
@@ -38152,7 +39242,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = 
@@ -38192,7 +39282,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Unusually Long Command Line - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = Unusually long command line $Processes.process_name$ on $dest$
@@ -38232,7 +39322,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Unusually Long Command Line - MLTK - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -38272,7 +39362,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Java Spawning Shells - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Log4Shell CVE-2021-44228"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ spawning a Windows shell, potentially indicative of exploitation.
@@ -38318,7 +39408,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - WinRM Spawning a Process - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Unusual Processes"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -38364,7 +39454,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - WMI Permanent Event Subscription - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious WMI Use"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -38410,7 +39500,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - WMI Temporary Event Subscription - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious WMI Use"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -38456,7 +39546,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect ARP Poisoning - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Router and Infrastructure Security"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -38502,7 +39592,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect IPv6 Network Infrastructure Threats - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Router and Infrastructure Security"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -38548,7 +39638,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Large Outbound ICMP Packets - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -38594,7 +39684,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Outbound SMB Traffic - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Hidden Cobra Malware", "DHS Report TA18-074A", "NOBELIUM Group"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -38640,7 +39730,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Port Security Violation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Router and Infrastructure Security"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -38686,7 +39776,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Rogue DHCP Server - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Router and Infrastructure Security"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -38732,7 +39822,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect SNICat SNI Exfiltration - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Data Exfiltration"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -38778,7 +39868,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Software Download To Network Device - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Router and Infrastructure Security"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -38824,7 +39914,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Traffic Mirroring - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Router and Infrastructure Security"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -38870,7 +39960,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Unauthorized Assets by MAC address - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Asset Tracking"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -38916,7 +40006,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Windows DNS SIGRed CVE-2020-1350"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -38962,7 +40052,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Windows DNS SIGRed via Zeek - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Windows DNS SIGRed CVE-2020-1350"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39008,7 +40098,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Zerologon via Zeek - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Detect Zerologon Attack"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39060,7 +40150,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - DNS Query Length Outliers - MLTK - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39100,7 +40190,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Excessive DNS Failures - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Suspicious DNS Traffic", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39140,7 +40230,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Hosts receiving high volume of network traffic from email server - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Collection and Staging"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39180,7 +40270,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Large Volume of DNS ANY Queries - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["DNS Amplification Attacks"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39220,7 +40310,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Prohibited Network Traffic Allowed - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39266,7 +40356,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Protocol or Port Mismatch - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39306,7 +40396,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Protocols passing authentication in cleartext - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Use of Cleartext Protocols"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39352,7 +40442,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote Desktop Network Bruteforce - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39398,7 +40488,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote Desktop Network Traffic - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Hidden Cobra Malware", "Active Directory Lateral Movement"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39438,7 +40528,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - SMB Traffic Spike - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39481,7 +40571,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - SMB Traffic Spike - MLTK - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Emotet Malware  DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39521,7 +40611,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - TOR Traffic - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "NOBELIUM Group", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39567,7 +40657,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Unusually Long Content-Type Length - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Apache Struts Vulnerability"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39607,7 +40697,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["JBoss Vulnerability", "SamSam Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39653,7 +40743,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["F5 TMUI RCE CVE-2020-5902"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39699,7 +40789,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect malicious requests to exploit JBoss servers - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["JBoss Vulnerability", "SamSam Ransomware"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39745,7 +40835,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Monitor Web Traffic For Brand Abuse - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Brand Monitoring"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39791,7 +40881,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - SQL Injection with Long URLs - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["SQL Injection"]
 action.risk = 1
 action.risk.param._risk_message = SQL injection attempt with url $url$ detected on $dest$
@@ -39837,7 +40927,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Supernova Webshell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["NOBELIUM Group"]
 action.risk = 1
 action.risk.param._risk_message = tbd
@@ -39889,7 +40979,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect hosts connecting to dynamic domain providers - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Data Protection", "Prohibited Traffic Allowed or Protocol Mismatch", "DNS Hijacking", "Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = A dns query $query$ from your infra connecting to suspicious domain in host  $host$
@@ -39935,7 +41025,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Detect Outbound LDAP Traffic - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Log4Shell CVE-2021-44228"]
 action.risk = 1
 action.risk.param._risk_message = An outbound LDAP connection from $src_ip$ in your infrastructure connecting to dest ip $dest_ip$
@@ -39975,7 +41065,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - DNS Query Length With High Standard Deviation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = A dns query $query$ with 2 time standard deviation of name len of the dns query in host  $host$
@@ -40015,7 +41105,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - F5 BIG-IP iControl REST Vulnerability CVE-2022-1388 - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["F5 BIG-IP Vulnerability CVE-2022-1388"]
 action.risk = 1
 action.risk.param._risk_message = An attempt to exploit CVE-2022-1388 against an F5 appliance $dest$ has occurred.
@@ -40061,7 +41151,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Multiple Archive Files Http Post Traffic - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Data Exfiltration", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = A http post $http_method$ sending packet with possible archive bytes header 4form_data$ in uri path $uri_path$
@@ -40107,7 +41197,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Plain HTTP POST Exfiltrated Data - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Data Exfiltration", "Command and Control"]
 action.risk = 1
 action.risk.param._risk_message = A http post $http_method$ sending packet with plain text of information $form_data$ in uri path $uri_path$
@@ -40153,7 +41243,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Splunk Identified SSL TLS Certificates - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Splunk Vulnerabilities"]
 action.risk = 1
 action.risk.param._risk_message = The following $dest$ is using the self signed Splunk certificate.
@@ -40193,7 +41283,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Confluence Unauthenticated Remote Code Execution CVE-2022-26134 - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Atlassian Confluence Server and Data Center CVE-2022-26134"]
 action.risk = 1
 action.risk.param._risk_message = A URL was requested related to CVE-2022-26134, a unauthenticated remote code execution vulnerability,  on $dest$ by $src$.
@@ -40239,7 +41329,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Log4Shell JNDI Payload Injection Attempt - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Log4Shell CVE-2021-44228"]
 action.risk = 1
 action.risk.param._risk_message = CVE-2021-44228 Log4Shell triggered for host $dest$
@@ -40279,7 +41369,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Log4Shell JNDI Payload Injection with Outbound Connection - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Log4Shell CVE-2021-44228"]
 action.risk = 1
 action.risk.param._risk_message = CVE-2021-44228 Log4Shell triggered for host $dest$
@@ -40313,13 +41403,13 @@ action.escu.data_models = ["Web"]
 action.escu.eli5 = The following analytic is static indicators related to CVE-2022-22963, Spring4Shell. The 3 indicators provide an amount of fidelity that source IP is attemping to exploit a web shell on the destination. The filename and cmd are arbitrary in this exploitation. Java will write a JSP to disk and a process will spawn from Java based on the cmd passed. This is indicative of typical web shell activity.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel.
 action.escu.known_false_positives = The jsp file names are static names used in current proof of concept code. =
-action.escu.creation_date = 2022-04-05
-action.escu.modification_date = 2022-04-05
+action.escu.creation_date = 2022-07-12
+action.escu.modification_date = 2022-07-12
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Spring4Shell Payload URL Request - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Spring4Shell CVE-2022-22965"]
 action.risk = 1
 action.risk.param._risk_message = A URL was requested related to Spring4Shell POC code on $dest$ by $src$.
@@ -40365,7 +41455,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - VMware Server Side Template Injection Hunt - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["VMware Server Side Injection and Privilege Escalation"]
 action.risk = 1
 action.risk.param._risk_message = An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred.
@@ -40405,7 +41495,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - VMware Workspace ONE Freemarker Server-side Template Injection - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["VMware Server Side Injection and Privilege Escalation"]
 action.risk = 1
 action.risk.param._risk_message = An attempt to exploit a VMware Server Side Injection CVE-2022-22954 on $dest$ has occurred.
@@ -40445,7 +41535,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Web JSP Request via URL - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Spring4Shell CVE-2022-22965"]
 action.risk = 1
 action.risk.param._risk_message = A suspicious URL has been requested against $dest$ by $src$, related to web shell activity.
@@ -40491,7 +41581,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Web Spring4Shell HTTP Request Class Module - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Spring4Shell CVE-2022-22965"]
 action.risk = 1
 action.risk.param._risk_message = A http body request related to Spring4Shell has been sent to $dest$ by $src$.
@@ -40537,7 +41627,7 @@ action.escu.confidence = high
 action.escu.full_search_name = ESCU - Web Spring Cloud Function FunctionRouter - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
-action.escu.providing_technologies = []
+action.escu.providing_technologies = null
 action.escu.analytic_story = ["Spring4Shell CVE-2022-22965"]
 action.risk = 1
 action.risk.param._risk_message = A suspicious URL has been requested against $dest$ by $src$, related to a vulnerability in Spring Cloud.
diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf
index b305e7d87f..59d49d5004 100644
--- a/dist/escu/default/transforms.conf
+++ b/dist/escu/default/transforms.conf
@@ -1,10 +1,17 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-06-29T20:42:24 UTC
+# On Date: 2022-07-19T21:28:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
 
+[__mlspl_risky_spl_pre_trained_model]
+filename = __mlspl_risky_spl_pre_trained_model.mlmodel
+default_match = false
+case_sensitive_match = false
+# description = Detect Risky SPL using Pretrained ML Model
+min_matches = 1
+
 [__mlspl_unusual_commandline_detection]
 filename = __mlspl_unusual_commandline_detection.mlmodel
 default_match = false
@@ -306,6 +313,14 @@ default_match = false
 match_type = WILDCARD(file)
 min_matches = 1
 
+[windows_protocol_handlers]
+filename = windows_protocol_handlers.csv
+default_match = false
+case_sensitive_match = false
+# description = A list of Windows Protocol Handlers
+match_type = WILDCARD(handler)
+min_matches = 1
+
 [zoom_first_time_child_process]
 collection = zoom_first_time_child_process
 external_type = kvstore
diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf
index 3dc6dac2a9..256e1a8073 100644
--- a/dist/escu/default/workflow_actions.conf
+++ b/dist/escu/default/workflow_actions.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-06-29T20:42:24 UTC
+# On Date: 2022-07-19T21:28:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/lookups/__mlspl_risky_spl_pre_trained_model.mlmodel b/dist/escu/lookups/__mlspl_risky_spl_pre_trained_model.mlmodel
new file mode 100644
index 0000000000..5aa2f7fd9c
--- /dev/null
+++ b/dist/escu/lookups/__mlspl_risky_spl_pre_trained_model.mlmodel
@@ -0,0 +1,2 @@
+algo,model,options
+DetectRiskySPL,"{""__mlspl_type"": [""algos.DetectRiskySPL"", ""DetectRiskySPL""], ""dict"": {""classes"": null, ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""columns"": [""spl_text""], ""estimator"": {""__mlspl_type"": [""sklearn.pipeline"", ""Pipeline""], ""dict"": {""steps"": [[""features"", {""__mlspl_type"": [""sklearn.feature_extraction.text"", ""CountVectorizer""], ""dict"": {""input"": ""content"", ""encoding"": ""utf-8"", ""decode_error"": ""strict"", ""strip_accents"": null, ""preprocessor"": null, ""tokenizer"": null, ""analyzer"": ""word"", ""lowercase"": true, ""token_pattern"": "" collect | delete | fit | outputcsv | outputlookup |adhoc| sendalert | sendemail |splunk\\-system\\-user| tscollect | run | script | runshellscript "", ""stop_words"": null, ""max_df"": 1.0, ""min_df"": 1, ""max_features"": null, ""ngram_range"": [1, 1], ""vocabulary"": null, ""binary"": false, ""dtype"": {""__mlspl_type"": [""builtins"", ""type""], ""type"": [""numpy"", ""int64""]}, ""fixed_vocabulary_"": false, ""_stop_words_id"": 94300723879360, ""stop_words_"": {""__mlspl_type"": [""builtins"", ""set""], ""set"": []}, ""vocabulary_"": {""splunk-system-user"": 12, "" delete "": 1, ""adhoc"": 11, "" outputlookup "": 4, "" script "": 7, "" run "": 5, "" collect "": 0, "" sendemail "": 9, "" sendalert "": 8, "" outputcsv "": 3, "" fit "": 2, "" runshellscript "": 6, "" tscollect "": 10}}}], [""predictor"", {""__mlspl_type"": [""sklearn.linear_model._logistic"", ""LogisticRegression""], ""dict"": {""penalty"": ""l2"", ""dual"": false, ""tol"": 0.0001, ""C"": 1.0, ""fit_intercept"": true, ""intercept_scaling"": 1, ""class_weight"": {""0"": 1, ""1"": 10}, ""random_state"": null, ""solver"": ""liblinear"", ""max_iter"": 100, ""multi_class"": ""auto"", ""verbose"": 0, ""warm_start"": false, ""n_jobs"": null, ""l1_ratio"": null, ""n_features_in_"": 13, ""classes_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDIsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoAAAAAAAAAAAEAAAAAAAAA""}, ""coef_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsIDEzKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAqulbT8VG8TQJU6VfC9QuY/kCCmapJVFUDQl14TS2ApPw5vYc32jBxAxVuQ3Sv35D8Y+azG/kDmP9vpUE0rTwlALsMVcoUGE0ASjjFaKyMaQA2zZ/yMQRZAQLZHc97OHEAfrzTDBGwSwA==""}, ""intercept_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGY4JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAqBnhyKtBckwA==""}, ""n_iter_"": {""__mlspl_type"": [""numpy"", ""ndarray""], ""npy"": ""k05VTVBZAQB2AHsnZGVzY3InOiAnPGk0JywgJ2ZvcnRyYW5fb3JkZXInOiBGYWxzZSwgJ3NoYXBlJzogKDEsKSwgfSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAoLAAAA""}}}]], ""memory"": null, ""verbose"": false}}}}","{""args"": [""risk_score"", ""spl_text""], ""target_variable"": [""risk_score""], ""feature_variables"": [""spl_text""], ""model_name"": ""risky_spl_pre_trained_model"", ""algo_name"": ""LogisticRegression"", ""mlspl_limits"": {""handle_new_cat"": ""default"", ""max_distinct_cat_values"": ""100"", ""max_distinct_cat_values_for_classifiers"": ""100"", ""max_distinct_cat_values_for_scoring"": ""100"", ""max_fit_time"": ""600"", ""max_inputs"": ""100000"", ""max_memory_usage_mb"": ""1024"", ""max_model_size_mb"": ""15"", ""max_score_time"": ""600"", ""streaming_apply"": ""false"", ""use_sampling"": ""true""}, ""kfold_cv"": null}"
diff --git a/dist/escu/lookups/security_services.csv b/dist/escu/lookups/security_services.csv
index bfbac66fb0..b8982c6109 100644
--- a/dist/escu/lookups/security_services.csv
+++ b/dist/escu/lookups/security_services.csv
@@ -1,5 +1,5 @@
 service,description,category
 *mpssvc*,Windows Firewall Service,security
-*wscsvc*,Windows Security Center Service,securty
+*wscsvc*,Windows Security Center Service,security
 *windefend*,Windows Defender Service,security
 *sysmon*,Sysmon Driver,security
diff --git a/dist/escu/lookups/windows_protocol_handlers.csv b/dist/escu/lookups/windows_protocol_handlers.csv
new file mode 100644
index 0000000000..4f809b8b61
--- /dev/null
+++ b/dist/escu/lookups/windows_protocol_handlers.csv
@@ -0,0 +1,205 @@
+handler,ishandler
+"*bingmaps:*",TRUE
+"*calculator:*",TRUE
+"*callto:*",TRUE
+"*conf:*",TRUE
+"*DLNA-PLAYSINGLE:*",TRUE
+"*Explorer.AssocActionId.BurnSelection:*",TRUE
+"*Explorer.AssocActionId.EraseDisc:*",TRUE
+"*Explorer.AssocActionId.ZipSelection:*",TRUE
+"*Explorer.AssocProtocol.search-ms:*",TRUE
+"*Explorer.BurnSelection:*",TRUE
+"*Explorer.EraseDisc:*",TRUE
+"*Explorer.ZipSelection:*",TRUE
+"*feed:*",TRUE
+"*feeds:*",TRUE
+"*file:*",TRUE
+"*FirefoxURL-308046B0AF4A39CB:*",TRUE
+"*ftp:*",TRUE
+"*grvopen:*",TRUE
+"*http:*",TRUE
+"*https:*",TRUE
+"*iehistory:*",TRUE
+"*ierss:*",TRUE
+"*im:*",TRUE
+"*LDAP:*",TRUE
+"*Lync15:*",TRUE
+"*Lync15classic:*",TRUE
+"*ma-chan:*",TRUE
+"*ma-filelink:*",TRUE
+"*mailto:*",TRUE
+"*mapi:*",TRUE
+"*mapi15:*",TRUE
+"*mapi16:*",TRUE
+"*mk:*",TRUE
+"*MMS:*",TRUE
+"*ms-access:*",TRUE
+"*ms-actioncenter:*",TRUE
+"*ms-apprep:*",TRUE
+"*ms-availablenetworks:*",TRUE
+"*ms-cortana:*",TRUE
+"*ms-cxh:*",TRUE
+"*ms-device-enrollment:*",TRUE
+"*ms-excel:*",TRUE
+"*ms-msdt:*",TRUE
+"*ms-penworkspace:*",TRUE
+"*ms-powerpoint:*",TRUE
+"*ms-publisher:*",TRUE
+"*ms-settings:*",TRUE
+"*ms-settings-airplanemode:*",TRUE
+"*ms-settings-bluetooth:*",TRUE
+"*ms-settings-cellular:*",TRUE
+"*ms-settings-connectabledevices:*",TRUE
+"*ms-settings-displays-topology:*",TRUE
+"*ms-settings-emailandaccounts:*",TRUE
+"*ms-settings-language:*",TRUE
+"*ms-settings-location:*",TRUE
+"*ms-settings-lock:*",TRUE
+"*ms-settings-mobilehotspot:*",TRUE
+"*ms-settings-notifications:*",TRUE
+"*ms-settings-power:*",TRUE
+"*ms-settings-privacy:*",TRUE
+"*ms-settings-proximity:*",TRUE
+"*ms-settings-screenrotation:*",TRUE
+"*ms-settings-wifi:*",TRUE
+"*ms-settings-workplace:*",TRUE
+"*ms-teams:*",TRUE
+"*ms-windows-search:*",TRUE
+"*ms-word:*",TRUE
+"*mssharepointclient:*",TRUE
+"*msteams:*",TRUE
+"*mswindowsmusic:*",TRUE
+"*mswindowsvideo:*",TRUE
+"*odopen:*",TRUE
+"*OneIndex16:*",TRUE
+"*OneNote:*",TRUE
+"*OneNote.URL.16:*",TRUE
+"*OneNoteDesktop:*",TRUE
+"*OneNoteDesktop.URL.16:*",TRUE
+"*Outlook.URL.feed.15:*",TRUE
+"*Outlook.URL.mailto.15:*",TRUE
+"*Outlook.URL.stssync.15:*",TRUE
+"*Outlook.URL.webcal.15:*",TRUE
+"*res:*",TRUE
+"*rlogin:*",TRUE
+"*search:*",TRUE
+"*search-ms:*",TRUE
+"*sip:*",TRUE
+"*sips:*",TRUE
+"*skypecast15:*",TRUE
+"*stssync:*",TRUE
+"*tbauth:*",TRUE
+"*tel:*",TRUE
+"*telnet:*",TRUE
+"*tn3270:*",TRUE
+"*webcal:*",TRUE
+"*webcals:*",TRUE
+"*windows.tbauth:*",TRUE
+"*WMP11.AssocProtocol.DLNA-PLAYSINGLE:*",TRUE
+"*WMP11.AssocProtocol.MMS:*",TRUE
+"*Word:*",TRUE
+"*xbox-tcui:*",TRUE
+"*appinstaller.oauth2:*",TRUE
+"*bingnews:*",TRUE
+"*bingweather:*",TRUE
+"*feedback-hub:*",TRUE
+"*git-client:*",TRUE
+"*IE.HTTP:*",TRUE
+"*insiderhub:*",TRUE
+"*microsoft-edge:*",TRUE
+"*microsoft-edge-holographic:*",TRUE
+"*microsoft.windows.camera:*",TRUE
+"*microsoft.windows.camera.multipicker:*",TRUE
+"*microsoft.windows.camera.picker:*",TRUE
+"*microsoft.windows.photos.crop:*",TRUE
+"*microsoft.windows.photos.picker:*",TRUE
+"*microsoft.windows.photos.videoedit:*",TRUE
+"*Microsoft.Workfolders:*",TRUE
+"*microsoftvideo:*",TRUE
+"*ms-aad-brokerplugin:*",TRUE
+"*ms-appinstaller:*",TRUE
+"*ms-calculator:*",TRUE
+"*ms-clock:*",TRUE
+"*ms-contact-support:*",TRUE
+"*ms-cortana2:*",TRUE
+"*ms-cxh-full:*",TRUE
+"*ms-default-location:*",TRUE
+"*ms-device-enrollment2:*",TRUE
+"*ms-drive-to:*",TRUE
+"*ms-edu-secureassessment:*",TRUE
+"*ms-eyecontrolspeech:*",TRUE
+"*ms-gamebar:*",TRUE
+"*ms-gamebarservices:*",TRUE
+"*ms-gamingoverlay:*",TRUE
+"*ms-get-started:*",TRUE
+"*ms-getoffice:*",TRUE
+"*ms-inputapp:*",TRUE
+"*ms-insights:*",TRUE
+"*ms-meetnow:*",TRUE
+"*ms-meetnowflyout:*",TRUE
+"*ms-mmsys:*",TRUE
+"*ms-msime-imepad:*",TRUE
+"*ms-msime-imjpdct:*",TRUE
+"*ms-officeapp:*",TRUE
+"*ms-officecmd:*",TRUE
+"*ms-oobenetwork:*",TRUE
+"*ms-people:*",TRUE
+"*ms-perception-simulation:*",TRUE
+"*ms-phone:*",TRUE
+"*ms-photos:*",TRUE
+"*ms-powerautomate:*",TRUE
+"*ms-print-addprinter:*",TRUE
+"*ms-print-printjobs:*",TRUE
+"*ms-quick-assist:*",TRUE
+"*ms-rdx-document:*",TRUE
+"*ms-retaildemo-launchbioenrollment:*",TRUE
+"*ms-retaildemo-launchstart:*",TRUE
+"*ms-screenclip:*",TRUE
+"*ms-screensketch:*",TRUE
+"*ms-search:*",TRUE
+"*ms-sttoverlay:*",TRUE
+"*ms-taskswitcher:*",TRUE
+"*ms-to-do:*",TRUE
+"*ms-todo:*",TRUE
+"*ms-unistore-email:*",TRUE
+"*ms-virtualtouchpad:*",TRUE
+"*ms-walk-to:*",TRUE
+"*ms-wcrv:*",TRUE
+"*ms-windows-store:*",TRUE
+"*ms-windows-store-deskext:*",TRUE
+"*ms-windows-store2:*",TRUE
+"*ms-wpc:*",TRUE
+"*ms-wpdrmv:*",TRUE
+"*ms-wxh:*",TRUE
+"*ms-xbet-survey:*",TRUE
+"*ms-xbl-3d8b930f:*",TRUE
+"*ms-xgpueject:*",TRUE
+"*msgamepass:*",TRUE
+"*msgamingapp:*",TRUE
+"*msnews:*",TRUE
+"*msnnews:*",TRUE
+"*msnweather:*",TRUE
+"*msxbox:*",TRUE
+"*outlookaccounts:*",TRUE
+"*outlookcal:*",TRUE
+"*outlookmail:*",TRUE
+"*read:*",TRUE
+"*vscode:*",TRUE
+"*vsls:*",TRUE
+"*vstfs:*",TRUE
+"*vsweb:*",TRUE
+"*windows-feedback:*",TRUE
+"*windowsdefender:*",TRUE
+"*xboxliveapp-1297287741:*",TRUE
+"*zune:*",TRUE
+"*SecureBrowser.security.getDeviceInfo:*",TRUE
+"*SecureBrowser.security.getMACAddress:*",TRUE
+"*SecureBrowser.security.examineProcessList:*",TRUE
+"*SecureBrowser.security.isRemoteSession:*",TRUE
+"*SecureBrowser.security.isVMSession:*",TRUE
+"*JavaScript:*",TRUE
+"*vbscript:*",TRUE
+"*about:*",TRUE
+"*ms-its:*",TRUE
+"*its:*",TRUE
+"*mk:@MSITStore:*",TRUE
\ No newline at end of file
diff --git a/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml
new file mode 100644
index 0000000000..a4455e1b05
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml
@@ -0,0 +1,57 @@
+name: Windows Defender Tools in Non Standard Path
+id: c205bd2e-cd5b-4224-8510-578a2a1f83d7
+version: 1
+description: The following analytic identifies usage of the MPCmdRun utility that
+  can be abused by adversaries by moving it to a new directory.
+search: ' from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
+  "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
+  "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
+  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
+  null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)),
+  process_path=lower(ucast(map_get(input_event, "process_path"), "string", null)),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name
+  IS NOT NULL AND process_name="mpcmdrun.exe" | where process_path IS NOT NULL AND
+  match_regex(process_path, /(?i)\\microsoft\\windows defender\\platform/)=false AND
+  match_regex(process_path, /(?i)\\windows defender/)=false | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
+  event_id, "process_path", process_path, "process_name", process_name, "cmd_line",
+  cmd_line]) | into write_ssa_detected_events(); '
+how_to_implement: Collect endpoint data such as sysmon or 4688 events.
+known_false_positives: False positives may be present and filtering may be required.
+references:
+- https://attack.mitre.org/techniques/T1036/003/
+- https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/
+tags:
+  analytic_story:
+  - Living Off The Land
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1036
+  - T1036.003
+  nist:
+  - DE.CM
+  required_fields:
+  - dest_device_id
+  - process_name
+  - _time
+  - dest_user_id
+  - process_path
+  - cmd_line
+  risk_score: 56
+  security_domain: endpoint
+  risk_severity: medium
+test:
+  name: Windows Defender Tools in Non Standard Path Unit Test
+  tests:
+  - name: Windows Defender Tools in Non Standard Path
+    file: endpoint/ssa___windows_defender_tools_in_non_standard_path.yml
+    pass_condition: '| stats count | where count > 0'
+    attack_data:
+    - file_name: windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/mpcmdrun/windows-security.log
+      source: XmlWinEventLog
diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
index 6c73973dd8..c722f05199 100644
--- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
+++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
@@ -1,6 +1,6 @@
 name: Windows LOLBin Binary in Non Standard Path
 id: 25689101-012a-324a-94d3-08301e6c065a
-version: 2
+version: 3
 description: The following analytic identifies native living off the land binaries
   within the Windows operating system that may be abused by adversaries by moving
   it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io
@@ -27,29 +27,28 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="imewdbld.exe"
   OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe"
   OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe"
-  OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="mpcmdrun.exe"
-  OR process_name="msconfig.exe" OR process_name="msdt.exe" OR process_name="mshta.exe"
-  OR process_name="msiexec.exe" OR process_name="netsh.exe" OR process_name="odbcconf.exe"
-  OR process_name="offlinescannershell.exe" OR process_name="onedrivestandaloneupdater.exe"
-  OR process_name="pcalua.exe" OR process_name="pcwrun.exe" OR process_name="pktmon.exe"
-  OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="print.exe"
-  OR process_name="printbrm.exe" OR process_name="psr.exe" OR process_name="rasautou.exe"
-  OR process_name="reg.exe" OR process_name="regini.exe" OR process_name="register-cimprovider.exe"
-  OR process_name="regsvr32.exe" OR process_name="replace.exe" OR process_name="rpcping.exe"
-  OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="runscripthelper.exe"
-  OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="scriptrunner.exe"
-  OR process_name="settingsynchost.exe" OR process_name="syncappvpublishingserver.exe"
-  OR process_name="ttdinject.exe" OR process_name="tttracer.exe" OR process_name="vbc.exe"
-  OR process_name="verclsid.exe" OR process_name="wab.exe" OR process_name="wlrmdr.exe"
-  OR process_name="wmic.exe" OR process_name="workfolders.exe" OR process_name="wscript.exe"
-  OR process_name="wsreset.exe" OR process_name="wuauclt.exe" OR process_name="xwizard.exe";
+  OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="msconfig.exe"
+  OR process_name="msdt.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe"
+  OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe"
+  OR process_name="onedrivestandaloneupdater.exe" OR process_name="pcalua.exe" OR
+  process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe"
+  OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe"
+  OR process_name="psr.exe" OR process_name="rasautou.exe" OR process_name="reg.exe"
+  OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe"
+  OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe"
+  OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe"
+  OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR process_name="settingsynchost.exe"
+  OR process_name="syncappvpublishingserver.exe" OR process_name="ttdinject.exe" OR
+  process_name="tttracer.exe" OR process_name="vbc.exe" OR process_name="verclsid.exe"
+  OR process_name="wab.exe" OR process_name="wlrmdr.exe" OR process_name="wmic.exe"
+  OR process_name="workfolders.exe" OR process_name="wscript.exe" OR process_name="wsreset.exe"
+  OR process_name="wuauclt.exe" OR process_name="xwizard.exe";
 
   | from $cond_1 | where match_regex(process_path, /(?i)\\windows\\system32/)=false
   AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false AND match_regex(process_path,
   /(?i)\\windows\\adws/)=false AND match_regex(process_path, /(?i)\\windows\\networkcontroller/)=false
   AND match_regex(process_path, /(?i)\\windows\\systemapps/)=false AND match_regex(process_path,
   /(?i)\\winsxs/)=false AND match_regex(process_path, /(?i)\\microsoft.net/)=false
-  AND match_regex(process_path, /(?i)\\microsoft\\windows defender\\platform/)=false
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(device, user),
   body=create_map(["event_id", event_id, "process_path", process_path, "process_name",
   process_name]) | into write_ssa_detected_events();'
diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md
index 6e6dce5266..34d700ec51 100644
--- a/docs/_pages/detections.md
+++ b/docs/_pages/detections.md
@@ -166,7 +166,7 @@ sidebar:
 | [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Detect Mimikatz Using Loaded Images](/endpoint/detect_mimikatz_using_loaded_images/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Detect Mimikatz Via PowerShell And EventCode 4703](/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703/) | [LSASS Memory](/tags/#lsass-memory) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [Detect Mimikatz With PowerShell Script Block Logging](/endpoint/detect_mimikatz_with_powershell_script_block_logging/) | [OS Credential Dumping](/tags/#os-credential-dumping) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Detect Mimikatz With PowerShell Script Block Logging](/endpoint/detect_mimikatz_with_powershell_script_block_logging/) | [OS Credential Dumping](/tags/#os-credential-dumping), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Detect New Local Admin account](/endpoint/detect_new_local_admin_account/) | [Local Account](/tags/#local-account), [Create Account](/tags/#create-account) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Detect New Login Attempts to Routers](/application/detect_new_login_attempts_to_routers/) | None | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Detect New Open GCP Storage Buckets](/cloud/detect_new_open_gcp_storage_buckets/) | [Data from Cloud Storage Object](/tags/#data-from-cloud-storage-object) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -192,6 +192,7 @@ sidebar:
 | [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Detect Renamed RClone](/endpoint/detect_renamed_rclone/) | [Automated Exfiltration](/tags/#automated-exfiltration) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Detect Renamed WinRAR](/endpoint/detect_renamed_winrar/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Detect Risky SPL using Pretrained ML Model](/application/detect_risky_spl_using_pretrained_ml_model/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -324,7 +325,6 @@ sidebar:
 | [GCP Detect accounts with high risk roles by project](/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project/) | [Valid Accounts](/tags/#valid-accounts) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GCP Detect gcploit framework](/cloud/gcp_detect_gcploit_framework/) | [Valid Accounts](/tags/#valid-accounts) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GCP Detect high risk permissions by resource and account](/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account/) | [Valid Accounts](/tags/#valid-accounts) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [GCP GCR container uploaded](/deprecated/gcp_gcr_container_uploaded/) | [Implant Internal Image](/tags/#implant-internal-image) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GCP Kubernetes cluster pod scan detection](/cloud/gcp_kubernetes_cluster_pod_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GCP Kubernetes cluster scan detection](/deprecated/gcp_kubernetes_cluster_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GPUpdate with no Command Line Arguments with Network](/endpoint/gpupdate_with_no_command_line_arguments_with_network/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -345,7 +345,7 @@ sidebar:
 | [Get-DomainTrust with PowerShell](/endpoint/get-domaintrust_with_powershell/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Get-DomainTrust with PowerShell Script Block](/endpoint/get-domaintrust_with_powershell_script_block/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Get-ForestTrust with PowerShell](/endpoint/get-foresttrust_with_powershell/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [Get-ForestTrust with PowerShell Script Block](/endpoint/get-foresttrust_with_powershell_script_block/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Get-ForestTrust with PowerShell Script Block](/endpoint/get-foresttrust_with_powershell_script_block/) | [Domain Trust Discovery](/tags/#domain-trust-discovery), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GetAdComputer with PowerShell](/endpoint/getadcomputer_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GetAdComputer with PowerShell Script Block](/endpoint/getadcomputer_with_powershell_script_block/) | [Remote System Discovery](/tags/#remote-system-discovery) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GetAdGroup with PowerShell](/endpoint/getadgroup_with_powershell/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -359,7 +359,7 @@ sidebar:
 | [GetDomainGroup with PowerShell](/endpoint/getdomaingroup_with_powershell/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GetDomainGroup with PowerShell Script Block](/endpoint/getdomaingroup_with_powershell_script_block/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GetLocalUser with PowerShell](/endpoint/getlocaluser_with_powershell/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [GetLocalUser with PowerShell Script Block](/endpoint/getlocaluser_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [GetLocalUser with PowerShell Script Block](/endpoint/getlocaluser_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account), [PowerShell](/tags/#powershell) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GetNetTcpconnection with PowerShell](/endpoint/getnettcpconnection_with_powershell/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GetNetTcpconnection with PowerShell Script Block](/endpoint/getnettcpconnection_with_powershell_script_block/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GetWmiObject DS User with PowerShell](/endpoint/getwmiobject_ds_user_with_powershell/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -369,7 +369,7 @@ sidebar:
 | [GetWmiObject Ds Group with PowerShell](/endpoint/getwmiobject_ds_group_with_powershell/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GetWmiObject Ds Group with PowerShell Script Block](/endpoint/getwmiobject_ds_group_with_powershell_script_block/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GetWmiObject User Account with PowerShell](/endpoint/getwmiobject_user_account_with_powershell/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [GetWmiObject User Account with PowerShell Script Block](/endpoint/getwmiobject_user_account_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [GetWmiObject User Account with PowerShell Script Block](/endpoint/getwmiobject_user_account_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account), [PowerShell](/tags/#powershell) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GitHub Actions Disable Security Workflow](/cloud/github_actions_disable_security_workflow/) | [Compromise Software Supply Chain](/tags/#compromise-software-supply-chain), [Supply Chain Compromise](/tags/#supply-chain-compromise) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GitHub Dependabot Alert](/cloud/github_dependabot_alert/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Supply Chain Compromise](/tags/#supply-chain-compromise) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [GitHub Pull Request from Unknown User](/cloud/github_pull_request_from_unknown_user/) | [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Supply Chain Compromise](/tags/#supply-chain-compromise) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -478,6 +478,7 @@ sidebar:
 | [Linux System Network Discovery](/endpoint/linux_system_network_discovery/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Linux Visudo Utility Execution](/endpoint/linux_visudo_utility_execution/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Linux pkexec Privilege Escalation](/endpoint/linux_pkexec_privilege_escalation/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Living Off The Land](/endpoint/living_off_the_land/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Correlation](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Loading Of Dynwrapx Module](/endpoint/loading_of_dynwrapx_module/) | [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Local Account Discovery With Wmic](/endpoint/local_account_discovery_with_wmic/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Local Account Discovery with Net](/endpoint/local_account_discovery_with_net/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -501,7 +502,7 @@ sidebar:
 | [Malicious PowerShell Process With Obfuscation Techniques](/endpoint/malicious_powershell_process_with_obfuscation_techniques/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Malicious Powershell Executed As A Service](/endpoint/malicious_powershell_executed_as_a_service/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Mimikatz PassTheTicket CommandLine Parameters](/endpoint/mimikatz_passtheticket_commandline_parameters/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Ticket](/tags/#pass-the-ticket) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [MMC](/tags/#mmc) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Modification Of Wallpaper](/endpoint/modification_of_wallpaper/) | [Defacement](/tags/#defacement) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Modify ACL permission To Files Or Folder](/endpoint/modify_acl_permission_to_files_or_folder/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Monitor DNS For Brand Abuse](/deprecated/monitor_dns_for_brand_abuse/) | None | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -524,7 +525,6 @@ sidebar:
 | [Network Connection Discovery With Net](/endpoint/network_connection_discovery_with_net/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Network Connection Discovery With Netstat](/endpoint/network_connection_discovery_with_netstat/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Network Discovery Using Route Windows App](/endpoint/network_discovery_using_route_windows_app/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Internet Connection Discovery](/tags/#internet-connection-discovery) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [New container uploaded to AWS ECR](/cloud/new_container_uploaded_to_aws_ecr/) | [Implant Internal Image](/tags/#implant-internal-image) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Nishang PowershellTCPOneLine](/endpoint/nishang_powershelltcponeline/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [No Windows Updates in a time frame](/application/no_windows_updates_in_a_time_frame/) | None | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Non Chrome Process Accessing Chrome Default Dir](/endpoint/non_chrome_process_accessing_chrome_default_dir/) | [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -570,7 +570,7 @@ sidebar:
 | [Ping Sleep Batch Command](/endpoint/ping_sleep_batch_command/) | [Virtualization/Sandbox Evasion](/tags/#virtualization/sandbox-evasion), [Time Based Evasion](/tags/#time-based-evasion) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Plain HTTP POST Exfiltrated Data](/network/plain_http_post_exfiltrated_data/) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Possible Browser Pass View Parameter](/endpoint/possible_browser_pass_view_parameter/) | [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Credentials from Password Stores](/tags/#credentials-from-password-stores) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell), [MMC](/tags/#mmc) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Potential password in username](/endpoint/potential_password_in_username/) | [Local Accounts](/tags/#local-accounts), [Credentials In Files](/tags/#credentials-in-files) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Potentially malicious code on commandline](/endpoint/potentially_malicious_code_on_commandline/) | [Windows Command Shell](/tags/#windows-command-shell) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [PowerShell - Connect To Internet With Hidden Window](/endpoint/powershell_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -579,10 +579,10 @@ sidebar:
 | [PowerShell Get LocalGroup Discovery](/endpoint/powershell_get_localgroup_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [PowerShell Loading DotNET into Memory via Reflection](/endpoint/powershell_loading_dotnet_into_memory_via_reflection/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [PowerShell Start-BitsTransfer](/endpoint/powershell_start-bitstransfer/) | [BITS Jobs](/tags/#bits-jobs) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [Powershell Creating Thread Mutex](/endpoint/powershell_creating_thread_mutex/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Powershell Creating Thread Mutex](/endpoint/powershell_creating_thread_mutex/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Powershell Disable Security Monitoring](/endpoint/powershell_disable_security_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Powershell Enable SMB1Protocol Feature](/endpoint/powershell_enable_smb1protocol_feature/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Powershell Fileless Process Injection via GetProcAddress](/endpoint/powershell_fileless_process_injection_via_getprocaddress/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Powershell Fileless Script Contains Base64 Encoded Content](/endpoint/powershell_fileless_script_contains_base64_encoded_content/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Powershell Get LocalGroup Discovery with Script Block Logging](/endpoint/powershell_get_localgroup_discovery_with_script_block_logging/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -611,7 +611,7 @@ sidebar:
 | [Randomly Generated Windows Service Name](/endpoint/randomly_generated_windows_service_name/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Ransomware Notes bulk creation](/endpoint/ransomware_notes_bulk_creation/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Recon AVProduct Through Pwh or WMI](/endpoint/recon_avproduct_through_pwh_or_wmi/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information), [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Recursive Delete of Directory In Batch CMD](/endpoint/recursive_delete_of_directory_in_batch_cmd/) | [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Reg exe Manipulating Windows Services Registry Keys](/endpoint/reg_exe_manipulating_windows_services_registry_keys/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Reg exe used to hide files directories via registry keys](/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys/) | [Hidden Files and Directories](/tags/#hidden-files-and-directories) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -770,7 +770,7 @@ sidebar:
 | [TOR Traffic](/network/tor_traffic/) | [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Time Provider Persistence Registry](/endpoint/time_provider_persistence_registry/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Trickbot Named Pipe](/endpoint/trickbot_named_pipe/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
-| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [MMC](/tags/#mmc) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [UAC Bypass With Colorui COM Object](/endpoint/uac_bypass_with_colorui_com_object/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [USN Journal Deletion](/endpoint/usn_journal_deletion/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Uncommon Processes On Endpoint](/deprecated/uncommon_processes_on_endpoint/) | [Malicious File](/tags/#malicious-file) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -818,6 +818,8 @@ sidebar:
 | [WinEvent Windows Task Scheduler Event Action Started](/endpoint/winevent_windows_task_scheduler_event_action_started/) | [Scheduled Task](/tags/#scheduled-task) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [WinRM Spawning a Process](/endpoint/winrm_spawning_a_process/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows AdFind Exe](/endpoint/windows_adfind_exe/) | [Remote System Discovery](/tags/#remote-system-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Application Layer Protocol RMS Radmin Tool Namedpipe](/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe/) | [Application Layer Protocol](/tags/#application-layer-protocol) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Binary Proxy Execution Mavinject DLL Injection](/endpoint/windows_binary_proxy_execution_mavinject_dll_injection/) | [Mavinject](/tags/#mavinject), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Command and Scripting Interpreter Hunting Path Traversal](/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Command and Scripting Interpreter Path Traversal Exec](/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Computer Account Created by Computer Account](/endpoint/windows_computer_account_created_by_computer_account/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -847,14 +849,18 @@ sidebar:
 | [Windows Excessive Disabled Services Event](/endpoint/windows_excessive_disabled_services_event/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Execute Arbitrary Commands with MSDT](/endpoint/windows_execute_arbitrary_commands_with_msdt/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows File Without Extension In Critical Folder](/endpoint/windows_file_without_extension_in_critical_folder/) | [Data Destruction](/tags/#data-destruction) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Gather Victim Network Info Through Ip Check Web Services](/endpoint/windows_gather_victim_network_info_through_ip_check_web_services/) | [IP Addresses](/tags/#ip-addresses), [Gather Victim Network Information](/tags/#gather-victim-network-information) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Get-AdComputer Unconstrained Delegation Discovery](/endpoint/windows_get-adcomputer_unconstrained_delegation_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Hidden Schedule Task Settings](/endpoint/windows_hidden_schedule_task_settings/) | [Scheduled Task/Job](/tags/#scheduled-task/job) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Hide Notification Features Through Registry](/endpoint/windows_hide_notification_features_through_registry/) | [Modify Registry](/tags/#modify-registry) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows High File Deletion Frequency](/endpoint/windows_high_file_deletion_frequency/) | [Data Destruction](/tags/#data-destruction) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Hunting System Account Targeting Lsass](/endpoint/windows_hunting_system_account_targeting_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows ISO LNK File Creation](/endpoint/windows_iso_lnk_file_creation/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Malicious Link](/tags/#malicious-link), [User Execution](/tags/#user-execution) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Identify Protocol Handlers](/endpoint/windows_identify_protocol_handlers/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Impair Defense Add Xml Applocker Rules](/endpoint/windows_impair_defense_add_xml_applocker_rules/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Impair Defense Delete Win Defender Context Menu](/endpoint/windows_impair_defense_delete_win_defender_context_menu/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Impair Defense Delete Win Defender Profile Registry](/endpoint/windows_impair_defense_delete_win_defender_profile_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Impair Defense Deny Security Software With Applocker](/endpoint/windows_impair_defense_deny_security_software_with_applocker/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Impair Defenses Disable Win Defender Auto Logging](/endpoint/windows_impair_defenses_disable_win_defender_auto_logging/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Indirect Command Execution Via forfiles](/endpoint/windows_indirect_command_execution_via_forfiles/) | [Indirect Command Execution](/tags/#indirect-command-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Indirect Command Execution Via pcalua](/endpoint/windows_indirect_command_execution_via_pcalua/) | [Indirect Command Execution](/tags/#indirect-command-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -869,21 +875,33 @@ sidebar:
 | [Windows Kerberos Local Successful Logon](/endpoint/windows_kerberos_local_successful_logon/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows KrbRelayUp Service Creation](/endpoint/windows_krbrelayup_service_creation/) | [Windows Service](/tags/#windows-service) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Linked Policies In ADSI Discovery](/endpoint/windows_linked_policies_in_adsi_discovery/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows MOF Event Triggered Execution via WMI](/endpoint/windows_mof_event_triggered_execution_via_wmi/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows MSIExec DLLRegisterServer](/endpoint/windows_msiexec_dllregisterserver/) | [Msiexec](/tags/#msiexec) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows MSIExec Remote Download](/endpoint/windows_msiexec_remote_download/) | [Msiexec](/tags/#msiexec) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows MSIExec Spawn Discovery Command](/endpoint/windows_msiexec_spawn_discovery_command/) | [Msiexec](/tags/#msiexec) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows MSIExec Unregister DLLRegisterServer](/endpoint/windows_msiexec_unregister_dllregisterserver/) | [Msiexec](/tags/#msiexec) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows MSIExec With Network Connections](/endpoint/windows_msiexec_with_network_connections/) | [Msiexec](/tags/#msiexec) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Modify Registry DisAllow Windows App](/endpoint/windows_modify_registry_disallow_windows_app/) | [Modify Registry](/tags/#modify-registry) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Modify Registry Disable Toast Notifications](/endpoint/windows_modify_registry_disable_toast_notifications/) | [Modify Registry](/tags/#modify-registry) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Modify Registry Disable Win Defender Raw Write Notif](/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif/) | [Modify Registry](/tags/#modify-registry) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Modify Registry Disable Windows Security Center Notif](/endpoint/windows_modify_registry_disable_windows_security_center_notif/) | [Modify Registry](/tags/#modify-registry) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Modify Registry Disabling WER Settings](/endpoint/windows_modify_registry_disabling_wer_settings/) | [Modify Registry](/tags/#modify-registry) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Modify Registry Regedit Silent Reg Import](/endpoint/windows_modify_registry_regedit_silent_reg_import/) | [Modify Registry](/tags/#modify-registry) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Modify Registry Suppress Win Defender Notif](/endpoint/windows_modify_registry_suppress_win_defender_notif/) | [Modify Registry](/tags/#modify-registry) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Modify Show Compress Color And Info Tip Registry](/endpoint/windows_modify_show_compress_color_and_info_tip_registry/) | [Modify Registry](/tags/#modify-registry) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows NirSoft AdvancedRun](/endpoint/windows_nirsoft_advancedrun/) | [Tool](/tags/#tool) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows NirSoft Utilities](/endpoint/windows_nirsoft_utilities/) | [Tool](/tags/#tool) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Non-System Account Targeting Lsass](/endpoint/windows_non-system_account_targeting_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Odbcconf Hunting](/endpoint/windows_odbcconf_hunting/) | [Odbcconf](/tags/#odbcconf) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Odbcconf Load DLL](/endpoint/windows_odbcconf_load_dll/) | [Odbcconf](/tags/#odbcconf) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Odbcconf Load Response File](/endpoint/windows_odbcconf_load_response_file/) | [Odbcconf](/tags/#odbcconf) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Office Product Spawning MSDT](/endpoint/windows_office_product_spawning_msdt/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Possible Credential Dumping](/endpoint/windows_possible_credential_dumping/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows PowerView Constrained Delegation Discovery](/endpoint/windows_powerview_constrained_delegation_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows PowerView Kerberos Service Ticket Request](/endpoint/windows_powerview_kerberos_service_ticket_request/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows PowerView SPN Discovery](/endpoint/windows_powerview_spn_discovery/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows PowerView Unconstrained Delegation Discovery](/endpoint/windows_powerview_unconstrained_delegation_discovery/) | [Remote System Discovery](/tags/#remote-system-discovery) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Powershell Import Applocker Policy](/endpoint/windows_powershell_import_applocker_policy/) | [PowerShell](/tags/#powershell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Process With NamedPipe CommandLine](/endpoint/windows_process_with_namedpipe_commandline/) | [Process Injection](/tags/#process-injection) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Processes Killed By Industroyer2 Malware](/endpoint/windows_processes_killed_by_industroyer2_malware/) | [Service Stop](/tags/#service-stop) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Raccine Scheduled Task Deletion](/endpoint/windows_raccine_scheduled_task_deletion/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -893,7 +911,12 @@ sidebar:
 | [Windows Registry Certificate Added](/endpoint/windows_registry_certificate_added/) | [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Registry Delete Task SD](/endpoint/windows_registry_delete_task_sd/) | [Scheduled Task](/tags/#scheduled-task), [Impair Defenses](/tags/#impair-defenses) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Registry Modification for Safe Mode Persistence](/endpoint/windows_registry_modification_for_safe_mode_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Remote Access Software RMS Registry](/endpoint/windows_remote_access_software_rms_registry/) | [Remote Access Software](/tags/#remote-access-software) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Remote Assistance Spawning Process](/endpoint/windows_remote_assistance_spawning_process/) | [Process Injection](/tags/#process-injection) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Remote Service Rdpwinst Tool Execution](/endpoint/windows_remote_service_rdpwinst_tool_execution/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Remote Services Allow Rdp In Firewall](/endpoint/windows_remote_services_allow_rdp_in_firewall/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Remote Services Allow Remote Assistance](/endpoint/windows_remote_services_allow_remote_assistance/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Remote Services Rdp Enable](/endpoint/windows_remote_services_rdp_enable/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Root Domain linked policies Discovery](/endpoint/windows_root_domain_linked_policies_discovery/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Schtasks Create Run As System](/endpoint/windows_schtasks_create_run_as_system/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Security Account Manager Stopped](/endpoint/windows_security_account_manager_stopped/) | [Service Stop](/tags/#service-stop) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
@@ -903,9 +926,11 @@ sidebar:
 | [Windows Service Creation Using Registry Entry](/endpoint/windows_service_creation_using_registry_entry/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Service Creation on Remote Endpoint](/endpoint/windows_service_creation_on_remote_endpoint/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Service Initiation on Remote Endpoint](/endpoint/windows_service_initiation_on_remote_endpoint/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Service Stop By Deletion](/endpoint/windows_service_stop_by_deletion/) | [Service Stop](/tags/#service-stop) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows System File on Disk](/endpoint/windows_system_file_on_disk/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Terminating Lsass Process](/endpoint/windows_terminating_lsass_process/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows Users Authenticate Using Explicit Credentials](/endpoint/windows_users_authenticate_using_explicit_credentials/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
+| [Windows Valid Account With Never Expires Password](/endpoint/windows_valid_account_with_never_expires_password/) | [Service Stop](/tags/#service-stop) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows WMI Process Call Create](/endpoint/windows_wmi_process_call_create/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows connhost exe started forcefully](/deprecated/windows_connhost_exe_started_forcefully/) | [Windows Command Shell](/tags/#windows-command-shell) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
 | [Windows hosts file modification](/deprecated/windows_hosts_file_modification/) | None | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md
index ef936fc084..695c5a4275 100644
--- a/docs/_pages/stories.md
+++ b/docs/_pages/stories.md
@@ -18,13 +18,14 @@ sidebar:
 | [AWS Suspicious Provisioning Activities](aws_suspicious_provisioning_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion) |
 | [AWS User Monitoring](aws_user_monitoring) | [Cloud Service Discovery](/tags/#cloud-service-discovery), [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [AcidRain](acidrain) | [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact) |
-| [Active Directory Discovery](active_directory_discovery) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Remote System Discovery](/tags/#remote-system-discovery), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [Local Groups](/tags/#local-groups), [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Local Account](/tags/#local-account), [System Network Connections Discovery](/tags/#system-network-connections-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Internet Connection Discovery](/tags/#internet-connection-discovery), [Kerberoasting](/tags/#kerberoasting), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Credential Access](/tags/#credential-access), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
+| [Active Directory Discovery](active_directory_discovery) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Remote System Discovery](/tags/#remote-system-discovery), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Password Policy Discovery](/tags/#password-policy-discovery), [PowerShell](/tags/#powershell), [Local Groups](/tags/#local-groups), [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Local Account](/tags/#local-account), [System Network Connections Discovery](/tags/#system-network-connections-discovery), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Internet Connection Discovery](/tags/#internet-connection-discovery), [Kerberoasting](/tags/#kerberoasting), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Credential Access](/tags/#credential-access), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Active Directory Kerberos Attacks](active_directory_kerberos_attacks) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [AS-REP Roasting](/tags/#as-rep-roasting), [Kerberoasting](/tags/#kerberoasting), [Golden Ticket](/tags/#golden-ticket), [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Gather Victim Identity Information](/tags/#gather-victim-identity-information), [Email Addresses](/tags/#email-addresses), [Pass the Ticket](/tags/#pass-the-ticket), [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force), [OS Credential Dumping](/tags/#os-credential-dumping), [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts), [Remote System Discovery](/tags/#remote-system-discovery) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
-| [Active Directory Lateral Movement](active_directory_lateral_movement) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Windows Remote Management](/tags/#windows-remote-management), [Scheduled Task](/tags/#scheduled-task), [PowerShell](/tags/#powershell), [Scheduled Task/Job](/tags/#scheduled-task/job), [At](/tags/#at), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
+| [Active Directory Lateral Movement](active_directory_lateral_movement) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Hash](/tags/#pass-the-hash), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Windows Remote Management](/tags/#windows-remote-management), [MMC](/tags/#mmc), [Scheduled Task](/tags/#scheduled-task), [PowerShell](/tags/#powershell), [Scheduled Task/Job](/tags/#scheduled-task/job), [At](/tags/#at), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Active Directory Password Spraying](active_directory_password_spraying) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | [Credential Access](/tags/#credential-access) |
 | [Apache Struts Vulnerability](apache_struts_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) |
 | [Asset Tracking](asset_tracking) | None | None |
 | [Atlassian Confluence Server and Data Center CVE-2022-26134](atlassian_confluence_server_and_data_center_cve-2022-26134) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Server Software Component](/tags/#server-software-component) | [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
+| [Azorult](azorult) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Account Control](/tags/#bypass-user-account-control), [Service Stop](/tags/#service-stop), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Account Access Removal](/tags/#account-access-removal), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Masquerading](/tags/#masquerading), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups), [System Network Connections Discovery](/tags/#system-network-connections-discovery), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job), [Application Layer Protocol](/tags/#application-layer-protocol), [IP Addresses](/tags/#ip-addresses), [Gather Victim Network Information](/tags/#gather-victim-network-information), [Modify Registry](/tags/#modify-registry), [PowerShell](/tags/#powershell), [Remote Access Software](/tags/#remote-access-software) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
 | [BITS Jobs](bits_jobs) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence) |
 | [Baron Samedit CVE-2021-3156](baron_samedit_cve-2021-3156) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
 | [BlackMatter Ransomware](blackmatter_ransomware) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Defacement](/tags/#defacement), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Credential Access](/tags/#credential-access), [Impact](/tags/#impact) |
@@ -38,7 +39,7 @@ sidebar:
 | [Collection and Staging](collection_and_staging) | [Masquerading](/tags/#masquerading), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Email Collection](/tags/#email-collection), [Local Email Collection](/tags/#local-email-collection), [Remote Email Collection](/tags/#remote-email-collection) | [Collection](/tags/#collection), [Defense Evasion](/tags/#defense-evasion) |
 | [Command and Control](command_and_control) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [DNS](/tags/#dns), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) |
 | [Common Phishing Frameworks](common_phishing_frameworks) | [Spearphishing via Service](/tags/#spearphishing-via-service) | [Initial Access](/tags/#initial-access) |
-| [Container Implantation Monitoring and Investigation](container_implantation_monitoring_and_investigation) | [Implant Internal Image](/tags/#implant-internal-image) | [Persistence](/tags/#persistence) |
+| [Container Implantation Monitoring and Investigation](container_implantation_monitoring_and_investigation) | None | None |
 | [Credential Dumping](credential_dumping) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager), [NTDS](/tags/#ntds), [Modify Registry](/tags/#modify-registry), [Local Accounts](/tags/#local-accounts), [Credentials In Files](/tags/#credentials-in-files), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [CyclopsBLink](cyclopsblink) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses), [Masquerade Task or Service](/tags/#masquerade-task-or-service), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion) |
 | [DHS Report TA18-074A](dhs_report_ta18-074a) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Modify Registry](/tags/#modify-registry), [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
@@ -61,11 +62,11 @@ sidebar:
 | [FIN7](fin7) | [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Visual Basic](/tags/#visual-basic), [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation), [XSL Script Processing](/tags/#xsl-script-processing) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [GCP Cross Account Activity](gcp_cross_account_activity) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [HAFNIUM Group](hafnium_group) | [LSASS Memory](/tags/#lsass-memory), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [OS Credential Dumping](/tags/#os-credential-dumping), [NTDS](/tags/#ntds), [Email Collection](/tags/#email-collection), [Remote Email Collection](/tags/#remote-email-collection) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence) |
-| [Hermetic Wiper](hermetic_wiper) | [PowerShell](/tags/#powershell), [Malicious File](/tags/#malicious-file), [Active Setup](/tags/#active-setup), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution), [Windows Command Shell](/tags/#windows-command-shell), [OS Credential Dumping](/tags/#os-credential-dumping), [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Accessibility Features](/tags/#accessibility-features), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Process Injection](/tags/#process-injection), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32), [Access Token Manipulation](/tags/#access-token-manipulation), [Token Impersonation/Theft](/tags/#token-impersonation/theft), [Screensaver](/tags/#screensaver), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Time Providers](/tags/#time-providers), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Data Destruction](/tags/#data-destruction), [Modify Registry](/tags/#modify-registry), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Print Processors](/tags/#print-processors) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
+| [Hermetic Wiper](hermetic_wiper) | [PowerShell](/tags/#powershell), [Malicious File](/tags/#malicious-file), [Active Setup](/tags/#active-setup), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution), [Windows Command Shell](/tags/#windows-command-shell), [OS Credential Dumping](/tags/#os-credential-dumping), [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Accessibility Features](/tags/#accessibility-features), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [MMC](/tags/#mmc), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Process Injection](/tags/#process-injection), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32), [Access Token Manipulation](/tags/#access-token-manipulation), [Token Impersonation/Theft](/tags/#token-impersonation/theft), [Screensaver](/tags/#screensaver), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Time Providers](/tags/#time-providers), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Data Destruction](/tags/#data-destruction), [Modify Registry](/tags/#modify-registry), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Print Processors](/tags/#print-processors) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
 | [Hidden Cobra Malware](hidden_cobra_malware) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Network Share Connection Removal](/tags/#network-share-connection-removal), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol), [DNS](/tags/#dns), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Lateral Movement](/tags/#lateral-movement) |
 | [Host Redirection](host_redirection) | [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [DNS](/tags/#dns) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration) |
 | [IcedID](icedid) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Process Injection](/tags/#process-injection), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Scheduled Task](/tags/#scheduled-task) | [Collection](/tags/#collection), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
-| [Industroyer2](industroyer2) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [LSASS Memory](/tags/#lsass-memory), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data Destruction](/tags/#data-destruction), [Service Stop](/tags/#service-stop), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
+| [Industroyer2](industroyer2) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [LSASS Memory](/tags/#lsass-memory), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data Destruction](/tags/#data-destruction), [Service Stop](/tags/#service-stop), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Gather Victim Host Information](/tags/#gather-victim-host-information), [PowerShell](/tags/#powershell), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
 | [Information Sabotage](information_sabotage) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Exfiltration](/tags/#exfiltration) |
 | [Ingress Tool Transfer](ingress_tool_transfer) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [BITS Jobs](/tags/#bits-jobs) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence) |
 | [Insider Threat](insider_threat) | [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service), [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force), [Local Accounts](/tags/#local-accounts), [Credentials In Files](/tags/#credentials-in-files) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
@@ -76,10 +77,10 @@ sidebar:
 | [Linux Persistence Techniques](linux_persistence_techniques) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At](/tags/#at), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers), [Data Destruction](/tags/#data-destruction) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Linux Post-Exploitation](linux_post-exploitation) | [Unix Shell](/tags/#unix-shell) | [Execution](/tags/#execution) |
 | [Linux Privilege Escalation](linux_privilege_escalation) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At](/tags/#at), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers), [Data Destruction](/tags/#data-destruction) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
-| [Living Off The Land](living_off_the_land) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Control Panel](/tags/#control-panel), [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping), [Compiled HTML File](/tags/#compiled-html-file), [Mshta](/tags/#mshta), [Regsvcs/Regasm](/tags/#regsvcs/regasm), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [LSASS Memory](/tags/#lsass-memory), [Security Account Manager](/tags/#security-account-manager), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Unix Shell](/tags/#unix-shell), [Plist File Modification](/tags/#plist-file-modification), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Injection](/tags/#process-injection), [Modify Registry](/tags/#modify-registry), [Scheduled Task/Job](/tags/#scheduled-task/job), [At](/tags/#at), [Scheduled Task](/tags/#scheduled-task), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service), [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Indirect Command Execution](/tags/#indirect-command-execution), [InstallUtil](/tags/#installutil) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
+| [Living Off The Land](living_off_the_land) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Control Panel](/tags/#control-panel), [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping), [Compiled HTML File](/tags/#compiled-html-file), [Mshta](/tags/#mshta), [Regsvcs/Regasm](/tags/#regsvcs/regasm), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [LSASS Memory](/tags/#lsass-memory), [Security Account Manager](/tags/#security-account-manager), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Unix Shell](/tags/#unix-shell), [Plist File Modification](/tags/#plist-file-modification), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [MMC](/tags/#mmc), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Injection](/tags/#process-injection), [Modify Registry](/tags/#modify-registry), [Scheduled Task/Job](/tags/#scheduled-task/job), [At](/tags/#at), [Scheduled Task](/tags/#scheduled-task), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service), [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [Mavinject](/tags/#mavinject), [Indirect Command Execution](/tags/#indirect-command-execution), [InstallUtil](/tags/#installutil), [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription), [Odbcconf](/tags/#odbcconf) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Local Privilege Escalation With KrbRelayUp](local_privilege_escalation_with_krbrelayup) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Windows Service](/tags/#windows-service) | [Credential Access](/tags/#credential-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Log4Shell CVE-2021-44228](log4shell_cve-2021-44228) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Windows Command Shell](/tags/#windows-command-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Command And Control](/tags/#command-and-control), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) |
-| [Malicious PowerShell](malicious_powershell) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Process Injection](/tags/#process-injection), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
+| [Malicious PowerShell](malicious_powershell) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [OS Credential Dumping](/tags/#os-credential-dumping), [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [MMC](/tags/#mmc), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Process Injection](/tags/#process-injection), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Kerberoasting](/tags/#kerberoasting), [Impair Defenses](/tags/#impair-defenses) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
 | [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact) |
 | [Meterpreter](meterpreter) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Execution](/tags/#execution) |
 | [Microsoft MSHTML Remote Code Execution CVE-2021-40444](microsoft_mshtml_remote_code_execution_cve-2021-40444) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Control Panel](/tags/#control-panel), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Rundll32](/tags/#rundll32) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access) |
@@ -97,7 +98,7 @@ sidebar:
 | [PrintNightmare CVE-2021-34527](printnightmare_cve-2021-34527) | [Print Processors](/tags/#print-processors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Prohibited Traffic Allowed or Protocol Mismatch](prohibited_traffic_allowed_or_protocol_mismatch) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exfiltration Over Unencrypted Non-C2 Protocol](/tags/#exfiltration-over-unencrypted-non-c2-protocol), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement) |
 | [ProxyShell](proxyshell) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
-| [Ransomware](ransomware) | [Scheduled Task](/tags/#scheduled-task), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Service Stop](/tags/#service-stop), [Account Access Removal](/tags/#account-access-removal), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Visual Basic](/tags/#visual-basic), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Msiexec](/tags/#msiexec), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance), [Resource Development](/tags/#resource-development) |
+| [Ransomware](ransomware) | [Scheduled Task](/tags/#scheduled-task), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Service Stop](/tags/#service-stop), [Account Access Removal](/tags/#account-access-removal), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Visual Basic](/tags/#visual-basic), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [PowerShell](/tags/#powershell), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Msiexec](/tags/#msiexec), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance), [Resource Development](/tags/#resource-development) |
 | [Ransomware Cloud](ransomware_cloud) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
 | [Remcos](remcos) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Component Object Model](/tags/#component-object-model), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Screen Capture](/tags/#screen-capture), [Visual Basic](/tags/#visual-basic), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Collection](/tags/#collection), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
 | [Revil Ransomware](revil_ransomware) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [User Execution](/tags/#user-execution), [Modify Registry](/tags/#modify-registry), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
@@ -109,7 +110,7 @@ sidebar:
 | [Silver Sparrow](silver_sparrow) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Launch Agent](/tags/#launch-agent), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Staged](/tags/#data-staged) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Spearphishing Attachments](spearphishing_attachments) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Spearphishing Link](/tags/#spearphishing-link), [Malicious Link](/tags/#malicious-link), [User Execution](/tags/#user-execution) | [Credential Access](/tags/#credential-access), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) |
 | [Spectre And Meltdown Vulnerabilities](spectre_and_meltdown_vulnerabilities) | None | None |
-| [Splunk Vulnerabilities](splunk_vulnerabilities) | [File and Directory Discovery](/tags/#file-and-directory-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Digital Certificates](/tags/#digital-certificates), [Network Denial of Service](/tags/#network-denial-of-service), [Process Injection](/tags/#process-injection), [Protocol Impersonation](/tags/#protocol-impersonation), [Digital Certificates](/tags/#digital-certificates), [Valid Accounts](/tags/#valid-accounts), [Drive-by Compromise](/tags/#drive-by-compromise), [Network Sniffing](/tags/#network-sniffing) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Resource Development](/tags/#resource-development) |
+| [Splunk Vulnerabilities](splunk_vulnerabilities) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [File and Directory Discovery](/tags/#file-and-directory-discovery), [Digital Certificates](/tags/#digital-certificates), [Network Denial of Service](/tags/#network-denial-of-service), [Process Injection](/tags/#process-injection), [Protocol Impersonation](/tags/#protocol-impersonation), [Digital Certificates](/tags/#digital-certificates), [Valid Accounts](/tags/#valid-accounts), [Drive-by Compromise](/tags/#drive-by-compromise), [Network Sniffing](/tags/#network-sniffing) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Resource Development](/tags/#resource-development) |
 | [Spring4Shell CVE-2022-22965](spring4shell_cve-2022-22965) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Web Shell](/tags/#web-shell), [Server Software Component](/tags/#server-software-component) | [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
 | [Suspicious AWS EC2 Activities](suspicious_aws_ec2_activities) | [Cloud Accounts](/tags/#cloud-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Suspicious AWS Login Activities](suspicious_aws_login_activities) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions), [Cloud Accounts](/tags/#cloud-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
@@ -142,7 +143,7 @@ sidebar:
 | [Web Fraud Detection](web_fraud_detection) | [Create Account](/tags/#create-account), [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [WhisperGate](whispergate) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Data Destruction](/tags/#data-destruction), [Masquerading](/tags/#masquerading), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Virtualization/Sandbox Evasion](/tags/#virtualization/sandbox-evasion), [Time Based Evasion](/tags/#time-based-evasion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Visual Basic](/tags/#visual-basic), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe), [Process Injection](/tags/#process-injection), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Resource Development](/tags/#resource-development) |
 | [Windows DNS SIGRed CVE-2020-1350](windows_dns_sigred_cve-2020-1350) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) |
-| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Compile After Delivery](/tags/#compile-after-delivery), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Modify Registry](/tags/#modify-registry), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Privilege Escalation](/tags/#privilege-escalation) |
+| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Compile After Delivery](/tags/#compile-after-delivery), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Modify Registry](/tags/#modify-registry), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [MMC](/tags/#mmc), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Windows Discovery Techniques](windows_discovery_techniques) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
 | [Windows Drivers](windows_drivers) | [Rootkit](/tags/#rootkit), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Rename System Utilities](/tags/#rename-system-utilities), [Change Default File Association](/tags/#change-default-file-association), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
diff --git a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md
index f51059115f..d284f074ec 100644
--- a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md
+++ b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md
@@ -106,8 +106,8 @@ The search is used to detect systems that are still vulnerable to the Spectre an
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **spectre_and_meltdown_vulnerable_systems_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
index 658c53560a..ec79fde91f 100644
--- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
+++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
@@ -104,8 +104,8 @@ The search queries the authentication logs for assets that are categorized as ro
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_new_login_attempts_to_routers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md
index 64449b47a3..d485eb70b4 100644
--- a/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md
+++ b/docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md
@@ -99,8 +99,8 @@ This search returns a list of hosts that have not successfully completed a backu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **extended_period_without_successful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md
index 14cc93f2cc..31a66e2bfa 100644
--- a/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md
+++ b/docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md
@@ -98,8 +98,8 @@ This search gives you the hosts where a backup was attempted and then failed.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **unsuccessful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
index 1b3ac7265c..fe4ce2296c 100644
--- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
+++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
@@ -106,8 +106,8 @@ This search looks for Windows endpoints that have not generated an event indicat
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **no_windows_updates_in_a_time_frame_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
index 6c4980927b..d522844132 100644
--- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
+++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
@@ -103,8 +103,8 @@ Attackers often use spaces as a means to obfuscate an attachment's file extensio
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **email_attachments_with_lots_of_spaces_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
index 76b52316e2..410a212365 100644
--- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
+++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
@@ -104,8 +104,8 @@ This search looks for specific GET or HEAD requests to web servers that are indi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_attackers_scanning_for_vulnerable_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
index 375df95954..421516f284 100644
--- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
+++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
@@ -109,8 +109,8 @@ This search is used to detect malicious HTTP requests crafted to exploit jmx-con
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_malicious_requests_to_exploit_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md
index 9575dc6049..351df8d65f 100644
--- a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md
+++ b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md
@@ -96,8 +96,8 @@ This search looks for DNS requests for faux domains similar to the domains that
 #### Macros
 The SPL above uses the following Macros:
 * [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **monitor_dns_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
index 03d124960f..e9ed6c984d 100644
--- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
+++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
@@ -101,8 +101,8 @@ This search looks for Web requests to faux domains similar to the one that you w
 #### Macros
 The SPL above uses the following Macros:
 * [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **monitor_web_traffic_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2017-11-27-detect_usb_device_insertion.md b/docs/_posts/2017-11-27-detect_usb_device_insertion.md
index 6bcf6212ef..d728677662 100644
--- a/docs/_posts/2017-11-27-detect_usb_device_insertion.md
+++ b/docs/_posts/2017-11-27-detect_usb_device_insertion.md
@@ -100,8 +100,8 @@ The search is used to detect hosts that generate Windows Event ID 4663 for succe
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_usb_device_insertion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
index 155282e149..bfdf6ece90 100644
--- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
+++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
@@ -105,8 +105,8 @@ This search looks for emails claiming to be sent from a domain similar to one th
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **monitor_email_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md
index 256ee9687b..5208a6be64 100644
--- a/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md
+++ b/docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md
@@ -110,8 +110,8 @@ This search looks for AWS CloudTrail events where an instance is started in a pa
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **ec2_instance_started_in_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md
index a7a3e55b1d..3c1752ed2c 100644
--- a/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md
+++ b/docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md
@@ -106,8 +106,8 @@ This search looks for EC2 instances being created with previously unseen AMIs.
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **ec2_instance_started_with_previously_unseen_ami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md
index 5d9fec816d..3bc744ed03 100644
--- a/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md
+++ b/docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md
@@ -117,8 +117,8 @@ This search detects new API calls that have either never been seen before or tha
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **detect_new_api_calls_from_user_roles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
index bbb21c3187..ba87d130b6 100644
--- a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
+++ b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
@@ -124,8 +124,8 @@ This search will detect users creating spikes in API activity related to securit
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **detect_spike_in_security_group_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md
index cfa1600f09..2a13cabd7e 100644
--- a/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md
+++ b/docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md
@@ -101,8 +101,8 @@ This search looks for AWS CloudTrail events where a user logged into the AWS acc
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **detect_api_activity_from_users_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
index 7ed3679870..638971b92a 100644
--- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
+++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
@@ -110,8 +110,8 @@ This search looks for outbound ICMP packets with a packet size larger than 1,000
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_large_outbound_icmp_packets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
index f4a348e37c..473271fdc1 100644
--- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
+++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
@@ -118,8 +118,8 @@ This search looks at S3 bucket-access logs and detects new or previously unseen
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [aws_s3_accesslogs](https://github.com/splunk/security_content/blob/develop/macros/aws_s3_accesslogs.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **detect_s3_access_from_a_new_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
index 7ddc9ec68b..5604b56488 100644
--- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
+++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
@@ -114,8 +114,8 @@ This search looks for the creation of WMI permanent event subscriptions.
 
 #### Macros
 The SPL above uses the following Macros:
-* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
 
 > :information_source:
 > **wmi_permanent_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
index 02ca8ce578..71d6f444e4 100644
--- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
+++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
@@ -113,8 +113,8 @@ This search looks for the creation of WMI temporary event subscriptions.
 
 #### Macros
 The SPL above uses the following Macros:
-* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
 
 > :information_source:
 > **wmi_temporary_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-11-02-windows_hosts_file_modification.md b/docs/_posts/2018-11-02-windows_hosts_file_modification.md
index 7af88de92d..a4d2ecf6d7 100644
--- a/docs/_posts/2018-11-02-windows_hosts_file_modification.md
+++ b/docs/_posts/2018-11-02-windows_hosts_file_modification.md
@@ -104,8 +104,8 @@ The search looks for modifications to the hosts file on all Windows endpoints ac
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_hosts_file_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md
index 80916277f9..e330d0107c 100644
--- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md
+++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md
@@ -111,8 +111,8 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote
 #### Macros
 The SPL above uses the following Macros:
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **remote_wmi_command_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-12-03-usn_journal_deletion.md b/docs/_posts/2018-12-03-usn_journal_deletion.md
index 3c7e03fb3e..c7193842d3 100644
--- a/docs/_posts/2018-12-03-usn_journal_deletion.md
+++ b/docs/_posts/2018-12-03-usn_journal_deletion.md
@@ -113,8 +113,8 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **usn_journal_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-12-14-file_with_samsam_extension.md b/docs/_posts/2018-12-14-file_with_samsam_extension.md
index 7fce34dd7a..92a288413c 100644
--- a/docs/_posts/2018-12-14-file_with_samsam_extension.md
+++ b/docs/_posts/2018-12-14-file_with_samsam_extension.md
@@ -101,8 +101,8 @@ The search looks for file writes with extensions consistent with a SamSam ransom
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **file_with_samsam_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2018-12-14-samsam_test_file_write.md b/docs/_posts/2018-12-14-samsam_test_file_write.md
index 99c865c735..57b1aa725c 100644
--- a/docs/_posts/2018-12-14-samsam_test_file_write.md
+++ b/docs/_posts/2018-12-14-samsam_test_file_write.md
@@ -107,8 +107,8 @@ The search looks for a file named "test.txt" written to the windows system direc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **samsam_test_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md
index dae186beec..47ee78a2f2 100644
--- a/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md
+++ b/docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md
@@ -112,8 +112,8 @@ This search looks for PowerShell requesting privileges consistent with credentia
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **detect_mimikatz_via_powershell_and_eventcode_4703_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md
index 22f0bac396..48fbc32d63 100644
--- a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md
+++ b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md
@@ -107,8 +107,8 @@ The search looks for command-line arguments used to hide a file or directory usi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **reg_exe_used_to_hide_files_directories_via_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
index da386816ec..36e29731e8 100644
--- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
+++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
@@ -108,8 +108,8 @@ This search looks for suspicious processes on all systems labeled as web servers
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **web_servers_executing_suspicious_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-04-25-suspicious_file_write.md b/docs/_posts/2019-04-25-suspicious_file_write.md
index 16d8353900..d7830d2ff0 100644
--- a/docs/_posts/2019-04-25-suspicious_file_write.md
+++ b/docs/_posts/2019-04-25-suspicious_file_write.md
@@ -100,8 +100,8 @@ The search looks for files created with names that have been linked to malicious
 #### Macros
 The SPL above uses the following Macros:
 * [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
index 68572ad175..903fc504cb 100644
--- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
+++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
@@ -106,8 +106,8 @@ Command lines that are extremely long may be indicative of malicious activity on
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **unusually_long_command_line_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md
index 700f99aa56..52db687451 100644
--- a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md
+++ b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md
@@ -103,8 +103,8 @@ This search looks for applications on the endpoint that you have marked as prohi
 #### Macros
 The SPL above uses the following Macros:
 * [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **prohibited_software_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
index be75b3546b..875ff5b43e 100644
--- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
+++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
@@ -114,8 +114,8 @@ This search looks for reading lsass memory consistent with credential dumping.
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **detect_credential_dumping_through_lsass_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
index 3de046b373..445b0aa8ec 100644
--- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
+++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
@@ -113,8 +113,8 @@ This search looks for reading loaded Images unique to credential dumping with Mi
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **detect_mimikatz_using_loaded_images_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
index ade57132a5..6228d32f4a 100644
--- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
+++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
@@ -111,8 +111,8 @@ Detect memory dumping of the LSASS process.
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **access_lsass_memory_for_dump_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
index be36a668be..01a8bca88b 100644
--- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
+++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
@@ -111,8 +111,8 @@ Detect remote thread creation into LSASS consistent with credential dumping.
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **create_remote_thread_into_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md
index f7818c9cf6..6ce1a2e91d 100644
--- a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md
+++ b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md
@@ -106,8 +106,8 @@ This search detects loading of unsigned images by LSASS. Deprecated because too
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **unsigned_image_loaded_by_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2019-12-10-creation_of_shadow_copy.md b/docs/_posts/2019-12-10-creation_of_shadow_copy.md
index 1da58c7e7f..08da7eedb3 100644
--- a/docs/_posts/2019-12-10-creation_of_shadow_copy.md
+++ b/docs/_posts/2019-12-10-creation_of_shadow_copy.md
@@ -112,8 +112,8 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **creation_of_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
index 0d2319e660..0634b112b0 100644
--- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
+++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
@@ -123,8 +123,8 @@ This search allows you to identify DNS requests that are unusually large for the
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **dns_query_length_outliers_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
index d877cebd94..e89e183dd1 100644
--- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
+++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
@@ -111,8 +111,8 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **creation_of_lsass_dump_with_taskmgr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md
index 89f684f87a..68804c7335 100644
--- a/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md
+++ b/docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md
@@ -108,8 +108,8 @@ This search looks for EC2 instances being created with previously unseen instanc
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **ec2_instance_started_with_previously_unseen_instance_type_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
index 950d215c37..39452d1266 100644
--- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
+++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
@@ -102,8 +102,8 @@ This search looks for processes referencing the plist files that determine which
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **macos_-_re-opened_applications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
index 4da5e0416f..9f92f7ce49 100644
--- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
+++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
@@ -114,8 +114,8 @@ Detect the usage of comsvcs.dll for dumping the lsass process.
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **dump_lsass_via_comsvcs_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-03-02-remote_registry_key_modifications.md b/docs/_posts/2020-03-02-remote_registry_key_modifications.md
index 31c7141664..9182f443c0 100644
--- a/docs/_posts/2020-03-02-remote_registry_key_modifications.md
+++ b/docs/_posts/2020-03-02-remote_registry_key_modifications.md
@@ -98,8 +98,8 @@ This search monitors for remote modifications to registry keys.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **remote_registry_key_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
index b0acf6b1a0..33c18be258 100644
--- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
+++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
@@ -116,8 +116,8 @@ This search looks for child processes of spoolsv.exe. This activity is associate
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **child_processes_of_spoolsv_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md
index 22a46cbcac..11c14b9a07 100644
--- a/docs/_posts/2020-03-16-detect_rare_executables.md
+++ b/docs/_posts/2020-03-16-detect_rare_executables.md
@@ -114,8 +114,8 @@ This search will return a table of rare processes, the names of the systems runn
 #### Macros
 The SPL above uses the following Macros:
 * [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_rare_executables_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-03-16-process_execution_via_wmi.md b/docs/_posts/2020-03-16-process_execution_via_wmi.md
index 8b0f895a95..ee4bab1330 100644
--- a/docs/_posts/2020-03-16-process_execution_via_wmi.md
+++ b/docs/_posts/2020-03-16-process_execution_via_wmi.md
@@ -110,8 +110,8 @@ The following analytic identifies `WmiPrvSE.exe` spawning a process. This typica
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **process_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-03-16-script_execution_via_wmi.md b/docs/_posts/2020-03-16-script_execution_via_wmi.md
index 8297eac46d..8cfa6e77a5 100644
--- a/docs/_posts/2020-03-16-script_execution_via_wmi.md
+++ b/docs/_posts/2020-03-16-script_execution_via_wmi.md
@@ -110,8 +110,8 @@ This search looks for scripts launched via WMI.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **script_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
index 1309557b22..f8e8536bb0 100644
--- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
+++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
@@ -103,8 +103,8 @@ This search provides information of unauthenticated requests via user agent, and
 
 #### Macros
 The SPL above uses the following Macros:
-* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
 
 > :information_source:
 > **amazon_eks_kubernetes_cluster_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
index 881939da87..a963f0417f 100644
--- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
+++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
@@ -103,8 +103,8 @@ This search provides detection information on unauthenticated requests against K
 
 #### Macros
 The SPL above uses the following Macros:
-* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
 
 > :information_source:
 > **amazon_eks_kubernetes_pod_scan_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
index 190595c646..6314c7448b 100644
--- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
+++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
@@ -113,9 +113,9 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **first_time_seen_child_process_of_zoom_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
index fca76e2e1c..e170e0f832 100644
--- a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
+++ b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
@@ -123,8 +123,8 @@ The detection Detect Path Interception By Creation Of program exe is detecting t
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_path_interception_by_creation_of_program_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-06-short_lived_windows_accounts.md b/docs/_posts/2020-07-06-short_lived_windows_accounts.md
index 4e0025dae1..3412fb9342 100644
--- a/docs/_posts/2020-07-06-short_lived_windows_accounts.md
+++ b/docs/_posts/2020-07-06-short_lived_windows_accounts.md
@@ -114,8 +114,8 @@ This search detects accounts that were created and deleted in a short time perio
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **short_lived_windows_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md
index 610808a839..57187c0ff4 100644
--- a/docs/_posts/2020-07-06-windows_event_log_cleared.md
+++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md
@@ -116,8 +116,8 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve
 #### Macros
 The SPL above uses the following Macros:
 * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **windows_event_log_cleared_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
index c45ef8426b..545796a26c 100644
--- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
+++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
@@ -117,8 +117,8 @@ This search looks for network traffic on TCP/3389, the default port used by remo
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **remote_desktop_network_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-08-detect_new_local_admin_account.md b/docs/_posts/2020-07-08-detect_new_local_admin_account.md
index b14f43e277..3e6512d9d8 100644
--- a/docs/_posts/2020-07-08-detect_new_local_admin_account.md
+++ b/docs/_posts/2020-07-08-detect_new_local_admin_account.md
@@ -113,8 +113,8 @@ This search looks for newly created accounts that have been elevated to local ad
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **detect_new_local_admin_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md
index e63eaaca93..62acb2404b 100644
--- a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md
+++ b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md
@@ -119,8 +119,8 @@ This search looks for attempts to stop security-related services on the endpoint
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **attempt_to_stop_security_service_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -155,6 +155,7 @@ None identified. Attempts to disable security-related services should be identif
 * [Disabling Security Tools](/stories/disabling_security_tools)
 * [Trickbot](/stories/trickbot)
 * [WhisperGate](/stories/whispergate)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md
index 899c3b213b..73fd4e7abe 100644
--- a/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md
+++ b/docs/_posts/2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md
@@ -118,8 +118,8 @@ This search looks for successful AWS CloudTrail activity by user accounts that a
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **detect_aws_api_activities_from_unapproved_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md
index 6806765a00..1a5dc12da3 100644
--- a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md
+++ b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md
@@ -123,14 +123,14 @@ This search looks for DNS requests for phishing domains that are leveraging Evil
 
 #### Macros
 The SPL above uses the following Macros:
-* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml)
 * [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml)
+* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml)
+* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml)
 * [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml)
+* [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml)
 * [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml)
 * [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml)
-* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml)
 
 > :information_source:
 > **detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
index 6d646d59fc..e9fd64eac7 100644
--- a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
+++ b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
@@ -119,8 +119,8 @@ This search detects user accounts that have been locked out a relatively high nu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_excessive_user_account_lockouts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md
index 65843532d0..8a71757140 100644
--- a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md
+++ b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md
@@ -115,8 +115,8 @@ This search is used to detect attempts to use DNS tunneling, by calculating the
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_long_dns_txt_record_response_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md
index a7eb0b73a1..8694a6d3a9 100644
--- a/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md
+++ b/docs/_posts/2020-07-21-detect_new_user_aws_console_login.md
@@ -113,8 +113,8 @@ This search looks for AWS CloudTrail events wherein a console login event by a u
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
index 3deacfc3e0..0282f5b820 100644
--- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
+++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
@@ -114,8 +114,8 @@ This search looks for outbound SMB connections made by hosts within your network
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_outbound_smb_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
index 7440974e9a..d8e12c392f 100644
--- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
+++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
@@ -126,8 +126,8 @@ This search looks for execution of process `outlook.exe` where the process is wr
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_outlook_exe_writing_a_zip_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
index fe3c0f36fd..6bc4eddfd5 100644
--- a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
+++ b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
@@ -112,8 +112,8 @@ This search looks for the execution of the cscript.exe or wscript.exe processes,
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_use_of_cmd_exe_to_launch_script_interpreters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -137,6 +137,7 @@ Some legitimate applications may exhibit this behavior.
 #### Associated Analytic story
 * [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
 * [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md
index 468a29995e..da4c4419a2 100644
--- a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md
+++ b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md
@@ -109,9 +109,9 @@ This search looks for web connections to dynamic DNS providers.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_web_traffic_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
index c83c255d84..79bd71b2c0 100644
--- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
+++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
@@ -110,8 +110,8 @@ This search looks for specific command-line arguments that may indicate the exec
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detection_of_tools_built_by_nirsoft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md
index 6a92d69fb0..7706e0d302 100644
--- a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md
+++ b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md
@@ -118,9 +118,9 @@ This search looks for EC2 instances being modified by users who have not previou
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **ec2_instance_modified_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md
index f37bf58289..a779faf335 100644
--- a/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md
+++ b/docs/_posts/2020-07-21-ec2_instance_started_with_previously_unseen_user.md
@@ -117,8 +117,8 @@ This search looks for EC2 instances being created by users who have not created
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **ec2_instance_started_with_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
index ef311872d0..602677cc95 100644
--- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
+++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
@@ -111,8 +111,8 @@ The search looks at the change-analysis data model and detects email files creat
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **email_files_written_outside_of_the_outlook_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md
index c7a48b2c3f..29a348aab2 100644
--- a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md
+++ b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md
@@ -126,8 +126,8 @@ This search looks for command-line arguments that use a `/c` parameter to execut
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **first_time_seen_command_line_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
index e846d6a5a6..ee2f30531a 100644
--- a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
+++ b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
@@ -111,8 +111,8 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **hiding_files_and_directories_with_attrib_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -135,6 +135,7 @@ Some applications and users may legitimately use attrib.exe to interact with the
 #### Associated Analytic story
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
 * [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
index c7fc1c1960..d5e6c456dc 100644
--- a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
+++ b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
@@ -116,9 +116,9 @@ This search looks for PowerShell processes started with parameters used to bypas
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **malicious_powershell_process_-_execution_policy_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
index 553fd07f28..3d3a23142f 100644
--- a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
+++ b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
@@ -114,8 +114,8 @@ Microsoft Windows contains accessibility features that can be launched with a ke
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **overwriting_accessibility_binaries_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
index d8faab220c..631e7a941c 100644
--- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
+++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
@@ -113,8 +113,8 @@ This search looks for network traffic defined by port and transport layer protoc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **prohibited_network_traffic_allowed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md
index dc8a715ac8..2a83d0b689 100644
--- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md
+++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md
@@ -115,8 +115,8 @@ This search looks for network traffic on common ports where a higher layer proto
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **protocol_or_port_mismatch_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
index b7dc8e4a0e..80127df206 100644
--- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
+++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
@@ -117,8 +117,8 @@ This search looks for the remote desktop process mstsc.exe running on systems up
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **remote_desktop_process_running_on_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
index 031cb96663..a8bbdeb2cf 100644
--- a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
+++ b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
@@ -119,8 +119,8 @@ This search looks for arguments to sc.exe indicating the creation or modificatio
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **sc_exe_manipulating_windows_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -147,6 +147,7 @@ Using sc.exe to manipulate Windows services is uncommon. However, there may be l
 * [Windows Persistence Techniques](/stories/windows_persistence_techniques)
 * [Disabling Security Tools](/stories/disabling_security_tools)
 * [NOBELIUM Group](/stories/nobelium_group)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md
index 4142da78fc..1e8576cece 100644
--- a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md
+++ b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md
@@ -109,8 +109,8 @@ This search looks for flags passed to schtasks.exe on the command-line that indi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **scheduled_tasks_used_in_badrabbit_ransomware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md
index 27a3f80476..ee8e48bbb9 100644
--- a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md
+++ b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md
@@ -113,8 +113,8 @@ This search looks for changes to registry values that control Windows file assoc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_changes_to_file_associations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md
index 97b844b205..8610cdf3c4 100644
--- a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md
+++ b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md
@@ -107,8 +107,8 @@ This detection looks for emails that are suspicious because of their sender, dom
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_email_-_uba_anomaly_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
index 2004b3acf4..a9d2a15203 100644
--- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
+++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
@@ -117,9 +117,9 @@ This search looks for emails that have attachments with suspicious file extensio
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_email_attachment_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md
index 6c6326adb0..64c07fce81 100644
--- a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md
+++ b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md
@@ -114,8 +114,8 @@ This search looks for reg.exe being launched from a command prompt not started b
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_reg_exe_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md
index 2ba8eb08fa..9b0f587725 100644
--- a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md
+++ b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md
@@ -104,8 +104,8 @@ This search detects writes to the 'System Volume Information' folder by somethin
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **suspicious_writes_to_system_volume_information_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md
index 3dd7fb8db4..f6411060b4 100644
--- a/docs/_posts/2020-07-22-tor_traffic.md
+++ b/docs/_posts/2020-07-22-tor_traffic.md
@@ -114,8 +114,8 @@ This search looks for network traffic identified as The Onion Router (TOR), a be
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **tor_traffic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md
index 8bcf280cc2..d5664f0705 100644
--- a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md
+++ b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md
@@ -108,9 +108,9 @@ This search looks for applications on the endpoint that you have marked as uncom
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **uncommon_processes_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
index 906d51e1ca..ed73e8c274 100644
--- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
+++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
@@ -117,8 +117,8 @@ This search detects SIGRed via Splunk Stream.
 
 #### Macros
 The SPL above uses the following Macros:
-* [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml)
 * [stream_dns](https://github.com/splunk/security_content/blob/develop/macros/stream_dns.yml)
+* [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml)
 
 > :information_source:
 > **detect_windows_dns_sigred_via_splunk_stream_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
index 17c0607e42..86f9ad6e66 100644
--- a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
+++ b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
@@ -122,8 +122,8 @@ This search looks for cloud instances being modified by users who have not previ
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **cloud_instance_modified_by_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md
index 7ef5a0acff..5369ba31dd 100644
--- a/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md
+++ b/docs/_posts/2020-09-08-cloud_network_access_control_list_deleted.md
@@ -98,8 +98,8 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **cloud_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
index 5bd362328d..e7d3584681 100644
--- a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
+++ b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
@@ -114,8 +114,8 @@ This search looks for the creation or deletion of hidden shares using net.exe.
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **create_or_delete_windows_shares_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
index d7016c612e..8afe9011b3 100644
--- a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
+++ b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
@@ -117,8 +117,8 @@ This search looks for specific authentication events from the Windows Security E
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **detect_activity_related_to_pass_the_hash_attacks_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md
index a1331265ee..11f87c2188 100644
--- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md
+++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md
@@ -117,8 +117,8 @@ Adversaries may abuse netbooting to load an unauthorized network device operatin
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_software_download_to_network_device_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-06-ryuk_test_files_detected.md b/docs/_posts/2020-11-06-ryuk_test_files_detected.md
index f6f753f18d..30d6f15c08 100644
--- a/docs/_posts/2020-11-06-ryuk_test_files_detected.md
+++ b/docs/_posts/2020-11-06-ryuk_test_files_detected.md
@@ -107,8 +107,8 @@ The search looks for files that contain the key word *Ryuk* under any folder in
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **ryuk_test_files_detected_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md
index b82ace11fb..aad62e03e2 100644
--- a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md
+++ b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md
@@ -106,8 +106,8 @@ The search looks for the Console Window Host process (connhost.exe) executed usi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_connhost_exe_started_forcefully_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md
index 08408f2536..8863ecb9c6 100644
--- a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md
+++ b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md
@@ -107,8 +107,8 @@ The search looks for a Windows Security Account Manager (SAM) was stopped via co
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_security_account_manager_stopped_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md
index 92fc1f7780..875e9afa63 100644
--- a/docs/_posts/2020-11-09-common_ransomware_extensions.md
+++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md
@@ -110,8 +110,8 @@ The search looks for file modifications with extensions commonly used by Ransomw
 #### Macros
 The SPL above uses the following Macros:
 * [ransomware_extensions](https://github.com/splunk/security_content/blob/develop/macros/ransomware_extensions.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **common_ransomware_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md
index fcae1b501f..9aa515ac82 100644
--- a/docs/_posts/2020-11-09-common_ransomware_notes.md
+++ b/docs/_posts/2020-11-09-common_ransomware_notes.md
@@ -108,9 +108,9 @@ The search looks for files created with names matching those typically used in r
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **common_ransomware_notes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-09-deleting_shadow_copies.md b/docs/_posts/2020-11-09-deleting_shadow_copies.md
index 5220a7a914..f6b57fe6ab 100644
--- a/docs/_posts/2020-11-09-deleting_shadow_copies.md
+++ b/docs/_posts/2020-11-09-deleting_shadow_copies.md
@@ -109,8 +109,8 @@ The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **deleting_shadow_copies_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
index a66f50336a..2deda244e4 100644
--- a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
+++ b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
@@ -119,8 +119,8 @@ This search identifies endpoints that have caused a relatively high number of ac
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_excessive_account_lockouts_from_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
index 5bfea4bfef..c0b41eca2c 100644
--- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
+++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
@@ -113,9 +113,9 @@ This search looks for fast execution of processes used for system network config
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_processes_used_for_system_network_configuration_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
index 073047c7e4..67a0109b7f 100644
--- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
+++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
@@ -113,10 +113,10 @@ This search looks for executions of cmd.exe spawned by a process that is often a
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_prohibited_applications_spawning_cmd_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md
index 889f73dd64..3755196466 100644
--- a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md
+++ b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md
@@ -138,6 +138,7 @@ This registry key may be modified via administrators to implement a change in sy
 * [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities)
 * [Remcos](/stories/remcos)
 * [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md
index a635804329..83b2b703c9 100644
--- a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md
+++ b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md
@@ -114,8 +114,8 @@ This search looks for processes launched from files that have double extensions
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **execution_of_file_with_multiple_extensions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md
index 55390d3e19..5850ce8104 100644
--- a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md
+++ b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md
@@ -109,8 +109,8 @@ This search looks for processes launched from files with at least five spaces in
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **execution_of_file_with_spaces_before_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-23-processes_created_by_netsh.md b/docs/_posts/2020-11-23-processes_created_by_netsh.md
index 4f822f395c..7b7f79645c 100644
--- a/docs/_posts/2020-11-23-processes_created_by_netsh.md
+++ b/docs/_posts/2020-11-23-processes_created_by_netsh.md
@@ -107,8 +107,8 @@ This search looks for processes launching netsh.exe to execute various commands
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **processes_created_by_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md
index 4b7da73120..e2c9aaaf5c 100644
--- a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md
+++ b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md
@@ -113,8 +113,8 @@ This search detects the process execution and arguments required to silently cre
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **shim_database_installation_with_suspicious_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
index 3ae13aaa91..14d83a388f 100644
--- a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
+++ b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
@@ -121,8 +121,8 @@ The search looks for reg.exe modifying registry keys that define Windows service
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **reg_exe_manipulating_windows_services_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md
index a491d093cf..bf5a4d23b9 100644
--- a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md
+++ b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md
@@ -115,8 +115,8 @@ This search looks for flags passed to schtasks.exe on the command-line that indi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **schtasks_used_for_forcing_a_reboot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-12-08-shim_database_file_creation.md b/docs/_posts/2020-12-08-shim_database_file_creation.md
index 89be12496d..499b7a4006 100644
--- a/docs/_posts/2020-12-08-shim_database_file_creation.md
+++ b/docs/_posts/2020-12-08-shim_database_file_creation.md
@@ -113,8 +113,8 @@ This search looks for shim database files being written to default directories.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **shim_database_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md
index 1f18944d0c..545bc9c5ad 100644
--- a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md
+++ b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md
@@ -115,8 +115,8 @@ This search looks for process names that consist only of a single letter.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **single_letter_process_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
index e6918240a1..6f18cf8b5a 100644
--- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
+++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
@@ -115,9 +115,9 @@ During triage, review the parallel processes - what process moved the native Win
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **system_processes_run_from_unexpected_locations_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-12-08-unusually_long_command_line.md b/docs/_posts/2020-12-08-unusually_long_command_line.md
index 4bca43b17b..a6874e39d2 100644
--- a/docs/_posts/2020-12-08-unusually_long_command_line.md
+++ b/docs/_posts/2020-12-08-unusually_long_command_line.md
@@ -105,8 +105,8 @@ Command lines that are extremely long may be indicative of malicious activity on
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **unusually_long_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
index ba26589ce1..97b7a140ca 100644
--- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
+++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
@@ -110,8 +110,8 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **sunburst_correlation_dll_and_network_event_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md
index cbaa2a7114..9a0522dffa 100644
--- a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md
+++ b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md
@@ -106,8 +106,8 @@ This search looks for flags passed to bcdedit.exe modifications to the built-in
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **bcdedit_failure_recovery_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
index 7e569728b0..a3cca683c2 100644
--- a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
+++ b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
@@ -107,8 +107,8 @@ This search provides detection of KMS keys where action kms:Encrypt is accessibl
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
index 94ca9fd7d9..c0a423f76c 100644
--- a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
+++ b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
@@ -101,8 +101,8 @@ This search provides detection of users with KMS keys performing encryption spec
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_detect_users_with_kms_keys_performing_encryption_s3_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
index 9c6b89bff6..738b9292e8 100644
--- a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
+++ b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
@@ -114,8 +114,8 @@ The search looks for AWS CloudTrail events to detect if any network ACLs were cr
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_network_access_control_list_created_with_all_open_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md
index 97fe890be8..338cc3e6db 100644
--- a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md
+++ b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md
@@ -111,8 +111,8 @@ Enforcing network-access controls is one of the defensive mechanisms used by clo
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_network_access_control_list_deleted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
index 56ad8afeab..3bd6804b8d 100644
--- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
+++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
@@ -107,9 +107,9 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso
 
 #### Macros
 The SPL above uses the following Macros:
+* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml)
 
 > :information_source:
 > **suspicious_microsoft_workflow_compiler_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
index 3fb78bf21f..2981f697b7 100644
--- a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
+++ b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
@@ -113,8 +113,8 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_msbuild_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md
index 62ab0f3d32..f837ac19d1 100644
--- a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md
+++ b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md
@@ -112,8 +112,8 @@ The following analytic identifies child processes spawning from  "mshta.exe". Th
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_mshta_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
index 625ce535e6..72437922ef 100644
--- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
+++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
@@ -112,9 +112,9 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_hosts_connecting_to_dynamic_domain_providers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
index 58fc09e6f8..c255a85d26 100644
--- a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
+++ b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
@@ -118,9 +118,9 @@ This search looks for PowerShell processes launched with arguments that have cha
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **malicious_powershell_process_with_obfuscation_techniques_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md
index da3b0bca32..f48bcf3d8c 100644
--- a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md
+++ b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md
@@ -112,8 +112,8 @@ This search looks for PowerShell processes started with a base64 encoded command
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_powershell_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
index 3c942c3b56..76b85517e1 100644
--- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
+++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
@@ -113,8 +113,8 @@ The following analytic identifies "rundll32.exe" execution with inline protocol
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_rundll32_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md
index 8c9e4e8eab..c1aa23acd7 100644
--- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md
+++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md
@@ -112,9 +112,9 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_mshta_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md
index adb6f92ec6..1a8acc8dc0 100644
--- a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md
+++ b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md
@@ -106,8 +106,8 @@ This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **wbadmin_delete_system_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md
index 07c93cbcb7..10e272bfee 100644
--- a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md
+++ b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md
@@ -103,8 +103,8 @@ This search provides specific SAML access from specific Service Provider, user a
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_saml_access_by_provider_user_and_principal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md
index 2fb4f610c3..6f97ccba4f 100644
--- a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md
+++ b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md
@@ -103,8 +103,8 @@ This search provides detection of updates to SAML provider in AWS. Updates to SA
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_saml_update_identity_provider_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
index 9137afe955..bf8e91a006 100644
--- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
+++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
@@ -113,9 +113,9 @@ Upon investigating, look for network connections to remote destinations (interna
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_regsvr32_application_control_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md
index dda50e0817..c02bb291a8 100644
--- a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md
+++ b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md
@@ -114,8 +114,8 @@ This technique uses "Install from Media" (IFM), which will extract a copy of the
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **ntdsutil_export_ntds_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
index 30de2e8012..67902820ae 100644
--- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
+++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
@@ -112,9 +112,9 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_regsvr32_register_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md
index beea6f235b..f790f144d3 100644
--- a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md
+++ b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md
@@ -108,8 +108,8 @@ During triage, confirm this is procdump.exe executing. If it is the first time a
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **dump_lsass_via_procdump_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
index d287869beb..8c91ad0ac3 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
@@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_rundll32_application_control_bypass_-_advpack_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
index 0f349fef61..51c0ba4071 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
@@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_rundll32_application_control_bypass_-_setupapi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
index 517530f49a..b157c01edb 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
@@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_rundll32_application_control_bypass_-_syssetup_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
index 6491636d6d..e6450c2428 100644
--- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
+++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
@@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe executing a DLL function name, St
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_rundll32_startw_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
index ebf44d99d2..ac7a1c4a6d 100644
--- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
+++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
@@ -113,8 +113,8 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_rundll32_dllregisterserver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md
index cd95ed0054..331d8cd804 100644
--- a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md
+++ b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md
@@ -112,8 +112,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_html_help_spawn_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md
index cd7ca3972f..f85e76b088 100644
--- a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md
+++ b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md
@@ -112,8 +112,8 @@ The following analytic identifies regasm.exe spawning a process. This particular
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_regasm_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md
index 762ef51bb9..078a873546 100644
--- a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md
+++ b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md
@@ -112,8 +112,8 @@ The following analytic identifies regsvcs.exe spawning a process. This particula
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_regsvcs_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md
index 7514435156..df0c99103c 100644
--- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md
+++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md
@@ -104,8 +104,8 @@ The following analytic identifies the use of a curl contacting suspicious remote
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_curl_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md
index 349624e824..6b7c13d843 100644
--- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md
+++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md
@@ -118,8 +118,8 @@ Upon triage, capture the property list file being written to disk and review for
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_plistbuddy_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
index 18b16fbc62..2a90b73471 100644
--- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
+++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
@@ -104,8 +104,8 @@ The following analytic identifies the use of a SQLite3 querying the MacOS prefer
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_sqlite3_lsquarantine_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md
index fb9a5ddf1b..592926edfb 100644
--- a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md
+++ b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md
@@ -118,8 +118,8 @@ Upon triage, fodhelper.exe will have a child process and read access will occur
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **fodhelper_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md
index 607c8d3cf4..9050ba0148 100644
--- a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md
+++ b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md
@@ -107,8 +107,8 @@ This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **ryuk_wake_on_lan_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md
index f036563722..5dd5e0a279 100644
--- a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md
+++ b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md
@@ -111,8 +111,8 @@ The following detection identifies Scheduled Tasks registering (creating a new t
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_scheduled_task_from_public_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -140,6 +140,7 @@ Limited false positives may be present. Filter as needed by parent process or co
 * [Ryuk Ransomware](/stories/ryuk_ransomware)
 * [Windows Persistence Techniques](/stories/windows_persistence_techniques)
 * [Living Off The Land](/stories/living_off_the_land)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md
index 82c80cbbd3..3c9f85d4ee 100644
--- a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md
+++ b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md
@@ -117,8 +117,8 @@ This search looks for AWS CloudTrail events where a user has set a default polic
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_setdefaultpolicyversion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md
index dc1f5ff116..6c19456715 100644
--- a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md
+++ b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md
@@ -107,8 +107,8 @@ This detection identifies Microsoft Exchange Server's Unified Messaging services
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **unified_messaging_service_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md
index 171845712b..5bd04bc753 100644
--- a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md
+++ b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md
@@ -112,8 +112,8 @@ The search looks for the Registry Key DisableAntiSpyware set to disable. This is
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_disableantispyware_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -137,6 +137,7 @@ It is unusual to turn this feature off a Windows system since it is a default se
 * [Ryuk Ransomware](/stories/ryuk_ransomware)
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
 * [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md
index b3a8fd21b4..54aa9d9e45 100644
--- a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md
+++ b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md
@@ -107,9 +107,9 @@ This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **nishang_powershelltcponeline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md
index 8cefde7ecd..ddd9eedfd9 100644
--- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md
+++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md
@@ -116,10 +116,10 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **w3wp_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
index fd1bb2b46c..05dc65a75a 100644
--- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
+++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
@@ -103,8 +103,8 @@ The following analytics identifies a big number of instance of ransomware notes
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **ransomware_notes_bulk_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md
index 1136a6729e..9f9fd5b333 100644
--- a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md
+++ b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md
@@ -102,8 +102,8 @@ The following analytics identifies the resizing of shadowstorage by ransomware m
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **resize_shadowstorage_volume_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md
index 6ecdeac0fa..83a596b564 100644
--- a/docs/_posts/2021-03-16-high_process_termination_frequency.md
+++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md
@@ -103,8 +103,8 @@ This analytics are designed to indentify a high frequency of process termination
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **high_process_termination_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md
index 5c9d198d84..92265d67b6 100644
--- a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md
+++ b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md
@@ -102,8 +102,8 @@ This search looks for high frequency of file deletion relative to process name a
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **windows_high_file_deletion_frequency_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-17-clop_common_exec_parameter.md b/docs/_posts/2021-03-17-clop_common_exec_parameter.md
index 755d9d5e2b..95b4806b3e 100644
--- a/docs/_posts/2021-03-17-clop_common_exec_parameter.md
+++ b/docs/_posts/2021-03-17-clop_common_exec_parameter.md
@@ -102,8 +102,8 @@ The following analytics are designed to identifies some CLOP ransomware variant
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **clop_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md
index ad4c1ab818..b7495a6ba1 100644
--- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md
+++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md
@@ -102,9 +102,9 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **certutil_with_decode_argument_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md
index 88a08e2887..9db397178f 100644
--- a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md
+++ b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md
@@ -103,9 +103,9 @@ Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functio
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **powershell_start-bitstransfer_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md
index 58cc4bc2de..c36f3c3426 100644
--- a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md
+++ b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md
@@ -110,8 +110,8 @@ The following query uses IAM events to track the success of a group being delete
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_iam_successful_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
index 608d7a43ff..70a4adb637 100644
--- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
+++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
@@ -108,8 +108,8 @@ This search is to identifies suspicious firewall disabling using netsh applicati
 #### Macros
 The SPL above uses the following Macros:
 * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **disabling_firewall_with_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-31-dsquery_domain_discovery.md b/docs/_posts/2021-03-31-dsquery_domain_discovery.md
index 33f02b64e7..b076a89e3a 100644
--- a/docs/_posts/2021-03-31-dsquery_domain_discovery.md
+++ b/docs/_posts/2021-03-31-dsquery_domain_discovery.md
@@ -107,8 +107,8 @@ In addition to trust discovery, review parallel processes for additional behavio
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **dsquery_domain_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md
index 816cf97240..b60136f69f 100644
--- a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md
+++ b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md
@@ -106,8 +106,8 @@ The following detection identifies any malformed policy document exceptions with
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_iam_assume_role_policy_brute_force_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-01-aws_iam_delete_policy.md b/docs/_posts/2021-04-01-aws_iam_delete_policy.md
index d6f1902252..4a24129392 100644
--- a/docs/_posts/2021-04-01-aws_iam_delete_policy.md
+++ b/docs/_posts/2021-04-01-aws_iam_delete_policy.md
@@ -100,8 +100,8 @@ The following detection identifes when a policy is deleted on AWS. This does not
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_iam_delete_policy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md
index e260cd7bb3..213ebb88ad 100644
--- a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md
+++ b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md
@@ -100,8 +100,8 @@ This detection identifies failure attempts to delete groups. We want to identify
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_iam_failure_group_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md
index 8298ca7fc7..6809b34a14 100644
--- a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md
+++ b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md
@@ -115,8 +115,8 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or was it v
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **winevent_scheduled_task_created_within_public_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-12-excel_spawning_powershell.md b/docs/_posts/2021-04-12-excel_spawning_powershell.md
index 26c70e1c55..6ecfb6fed8 100644
--- a/docs/_posts/2021-04-12-excel_spawning_powershell.md
+++ b/docs/_posts/2021-04-12-excel_spawning_powershell.md
@@ -107,9 +107,9 @@ The following detection identifies Microsoft Excel spawning PowerShell. Typicall
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **excel_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md
index 97711642bd..881449035a 100644
--- a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md
+++ b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md
@@ -107,8 +107,8 @@ The following detection identifies Microsoft Excel spawning Windows Script Host
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **excel_spawning_windows_script_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md
index 5ff4bdb821..fa288d86e1 100644
--- a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md
+++ b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md
@@ -115,8 +115,8 @@ Upon triage, identify the task scheduled source. Was it schtasks.exe or via Task
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **winevent_scheduled_task_created_to_spawn_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-12-winword_spawning_powershell.md b/docs/_posts/2021-04-12-winword_spawning_powershell.md
index 2135b2af10..a6e3b2fd4f 100644
--- a/docs/_posts/2021-04-12-winword_spawning_powershell.md
+++ b/docs/_posts/2021-04-12-winword_spawning_powershell.md
@@ -107,9 +107,9 @@ The following detection identifies Microsoft Word spawning PowerShell. Typically
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **winword_spawning_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md
index 594cd28d35..1b841987af 100644
--- a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md
+++ b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md
@@ -107,8 +107,8 @@ The following detection identifies Microsoft Winword.exe spawning Windows Script
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **winword_spawning_windows_script_host_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md
index 630da0dd3c..af0757675b 100644
--- a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md
+++ b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md
@@ -107,8 +107,8 @@ This search looks for AWS CloudTrail events and analyse the amount of eventNames
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_excessive_security_scanning_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
index c8dc27db62..395cc1b89a 100644
--- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
+++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
@@ -108,8 +108,8 @@ this detection was designed to identifies suspicious spawned process of known MS
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **office_application_spawn_rundll32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
index 56c059af2a..bef8758516 100644
--- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
+++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
@@ -106,8 +106,8 @@ this search detects a potential malicious office document that create schedule t
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **office_document_creating_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md
index e3e263aa54..036ae99d5e 100644
--- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md
+++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md
@@ -106,8 +106,8 @@ this detection was designed to identifies suspicious office documents that using
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **office_document_executing_macro_code_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md
index 32348a1256..4f941e1c9b 100644
--- a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md
+++ b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md
@@ -102,8 +102,8 @@ this search is to detect potential DNS exfiltration using nslookup application.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **dns_exfiltration_using_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
index 85a2c57319..000c69e486 100644
--- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
+++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
@@ -102,8 +102,8 @@ this search is designed to detect suspicious powershell process that tries to in
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **powershell_remote_thread_to_known_windows_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md
index b297562c89..3518e5e547 100644
--- a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md
+++ b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md
@@ -105,8 +105,8 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **schedule_task_with_http_command_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md
index 2831b2bc73..6ca813b619 100644
--- a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md
+++ b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md
@@ -105,8 +105,8 @@ The following query utilizes Windows Security EventCode 4698, `A scheduled task
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **schedule_task_with_rundll32_command_trigger_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
index efd0ae1863..c2c705791c 100644
--- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
+++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
@@ -101,8 +101,8 @@ this search is designed to detect potential malicious wermgr.exe process that dr
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **wermgr_process_create_executable_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
index b31dc8c715..0a6a55d2cd 100644
--- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
+++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
@@ -102,10 +102,10 @@ This search is designed to detect suspicious cmd and powershell process spawned
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **wermgr_process_spawned_cmd_or_powershell_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md
index 730593c05b..7d58b841d5 100644
--- a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md
+++ b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md
@@ -107,8 +107,8 @@ The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllh
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **anomalous_usage_of_7zip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
index fd3e25319c..c40ab2bb31 100644
--- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
+++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
@@ -108,8 +108,8 @@ The following detection identifies the latest behavior utilized by IcedID malwar
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **office_product_spawning_rundll32_with_no_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md
index eb76a29dcb..cd8bc91dff 100644
--- a/docs/_posts/2021-04-22-winword_spawning_cmd.md
+++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md
@@ -107,9 +107,9 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically,
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **winword_spawning_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md
index aff2d794c5..1678be0cca 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md
@@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by different mal
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **office_product_spawning_bitsadmin_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md
index fdb416d0cb..aee81a0e17 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md
@@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by different mal
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **office_product_spawning_certutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md
index 928f33d95d..5fda55ea06 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md
@@ -107,9 +107,9 @@ The following detection identifies the latest behavior utilized by different mal
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **office_product_spawning_mshta_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md
index 01d1ab8d7b..5eb7a599ed 100644
--- a/docs/_posts/2021-04-26-trickbot_named_pipe.md
+++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md
@@ -102,8 +102,8 @@ this search is to detect potential trickbot infection through the create/connect
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **trickbot_named_pipe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-29-icacls_deny_command.md b/docs/_posts/2021-04-29-icacls_deny_command.md
index 0564a725e3..5bed11167c 100644
--- a/docs/_posts/2021-04-29-icacls_deny_command.md
+++ b/docs/_posts/2021-04-29-icacls_deny_command.md
@@ -102,8 +102,8 @@ This analytic identifies a potential adversary that changes the security permiss
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **icacls_deny_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -126,6 +126,7 @@ Unknown. It is possible some administrative scripts use ICacls. Filter as needed
 
 #### Associated Analytic story
 * [XMRig](/stories/xmrig)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
index 43c3a38d63..ff1e142ac3 100644
--- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
+++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
@@ -108,8 +108,8 @@ This analytic will detect suspicious driver loaded paths. This technique is comm
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **suspicious_driver_loaded_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md
index aea92238c8..7046351428 100644
--- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md
+++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md
@@ -108,8 +108,8 @@ This analytic identifies XMRIG coinminer driver installation on the system. The
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **xmrig_driver_loaded_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-04-deleting_of_net_users.md b/docs/_posts/2021-05-04-deleting_of_net_users.md
index 2d513333bd..696ce71d06 100644
--- a/docs/_posts/2021-05-04-deleting_of_net_users.md
+++ b/docs/_posts/2021-05-04-deleting_of_net_users.md
@@ -103,8 +103,8 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **deleting_of_net_users_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-04-disabling_net_user_account.md b/docs/_posts/2021-05-04-disabling_net_user_account.md
index 5d3c6378ba..f1a0878aad 100644
--- a/docs/_posts/2021-05-04-disabling_net_user_account.md
+++ b/docs/_posts/2021-05-04-disabling_net_user_account.md
@@ -103,8 +103,8 @@ This analytic will identify a suspicious command-line that disables a user accou
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **disabling_net_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md
index a0299d74cd..5ca072aeea 100644
--- a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md
+++ b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md
@@ -94,7 +94,7 @@ This analytic will identify suspicious series of command-line to disable several
 ```
 
 | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime  from datamodel=Endpoint.Processes where   Processes.process_name = "sc.exe" AND Processes.process="*config*" OR Processes.process="*Disabled*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m 
-| where count >=5 
+| where count >=4 
 | `drop_dm_object_name(Processes)` 
 | `security_content_ctime(firstTime)` 
 | `security_content_ctime(lastTime)` 
@@ -103,8 +103,8 @@ This analytic will identify suspicious series of command-line to disable several
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **excessive_attempt_to_disable_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -127,6 +127,7 @@ unknown
 
 #### Associated Analytic story
 * [XMRig](/stories/xmrig)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md
index 3dec5b2e36..95aba44e11 100644
--- a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md
+++ b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md
@@ -104,8 +104,8 @@ This analytic identifies suspicious series of attempt to kill multiple services
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **excessive_service_stop_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md
index 6f39ebd87d..33f149cc00 100644
--- a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md
+++ b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md
@@ -108,8 +108,8 @@ This analytic identifies excessive usage of `taskkill.exe` application. This app
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **excessive_usage_of_taskkill_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -132,6 +132,7 @@ Unknown. Filter as needed.
 
 #### Associated Analytic story
 * [XMRig](/stories/xmrig)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2021-05-04-icacls_grant_command.md b/docs/_posts/2021-05-04-icacls_grant_command.md
index eb7ba0395c..01c62fcfba 100644
--- a/docs/_posts/2021-05-04-icacls_grant_command.md
+++ b/docs/_posts/2021-05-04-icacls_grant_command.md
@@ -102,8 +102,8 @@ This analytic identifies potential adversaries that modify the security permissi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **icacls_grant_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md
index 2c38baa934..2991a72568 100644
--- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md
+++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md
@@ -108,8 +108,8 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove
 #### Macros
 The SPL above uses the following Macros:
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **process_kill_base_on_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-05-suspicious_process_file_path.md b/docs/_posts/2021-05-05-suspicious_process_file_path.md
index 20defc4a27..aea34adffa 100644
--- a/docs/_posts/2021-05-05-suspicious_process_file_path.md
+++ b/docs/_posts/2021-05-05-suspicious_process_file_path.md
@@ -103,8 +103,8 @@ The following analytic will detect a suspicious process running in a file path w
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md
index e75d99cd23..43eaa37a0b 100644
--- a/docs/_posts/2021-05-06-download_files_using_telegram.md
+++ b/docs/_posts/2021-05-06-download_files_using_telegram.md
@@ -101,8 +101,8 @@ The following analytic will identify a suspicious download by the Telegram appli
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **download_files_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md
index 2283e7d33e..04879af5f4 100644
--- a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md
+++ b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md
@@ -101,8 +101,8 @@ This analytic will detect a suspicious Telegram process enumerating all network
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **enumerate_users_local_group_using_telegram_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md
index 2b90be4869..6fd3ea4bce 100644
--- a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md
+++ b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md
@@ -104,8 +104,8 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **excessive_usage_of_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -134,6 +134,7 @@ unknown. Filter as needed. Modify the time span as needed.
 #### Associated Analytic story
 * [XMRig](/stories/xmrig)
 * [Ransomware](/stories/ransomware)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md
index f92d154dec..ce7b6312f2 100644
--- a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md
+++ b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md
@@ -102,8 +102,8 @@ This analytic will identify suspicious executable or scripts (known file extensi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **executables_or_script_creation_in_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -131,6 +131,7 @@ Administrators may allow creation of script or exe in the paths specified. Filte
 * [WhisperGate](/stories/whispergate)
 * [Hermetic Wiper](/stories/hermetic_wiper)
 * [Industroyer2](/stories/industroyer2)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md
index 90fde55d8b..39668c135d 100644
--- a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md
+++ b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md
@@ -103,8 +103,8 @@ The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` o
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **excessive_usage_of_cacls_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -127,6 +127,7 @@ Administrators or administrative scripts may use this application. Filter as nee
 
 #### Associated Analytic story
 * [XMRig](/stories/xmrig)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md
index d63ea1659d..9e8d148a76 100644
--- a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md
+++ b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md
@@ -104,8 +104,8 @@ This analytic identifies an on demand run of a Windows Schedule Task through she
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **schtasks_run_task_on_demand_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
index 869bea7299..64ff8b9995 100644
--- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
+++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
@@ -106,8 +106,8 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **cmlua_or_cmstplua_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-13-slui_runas_elevated.md b/docs/_posts/2021-05-13-slui_runas_elevated.md
index b8bdc71816..9467a16fca 100644
--- a/docs/_posts/2021-05-13-slui_runas_elevated.md
+++ b/docs/_posts/2021-05-13-slui_runas_elevated.md
@@ -109,8 +109,8 @@ The following analytic identifies the Microsoft Software Licensing User Interfac
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **slui_runas_elevated_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-13-slui_spawning_a_process.md b/docs/_posts/2021-05-13-slui_spawning_a_process.md
index 2de1acd76e..ae5608e181 100644
--- a/docs/_posts/2021-05-13-slui_spawning_a_process.md
+++ b/docs/_posts/2021-05-13-slui_spawning_a_process.md
@@ -109,8 +109,8 @@ The following analytic identifies the Microsoft Software Licensing User Interfac
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **slui_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-18-services_escalate_exe.md b/docs/_posts/2021-05-18-services_escalate_exe.md
index 200b45ac0f..611bdb3994 100644
--- a/docs/_posts/2021-05-18-services_escalate_exe.md
+++ b/docs/_posts/2021-05-18-services_escalate_exe.md
@@ -103,8 +103,8 @@ The following analytic identifies the use of `svc-exe` with Cobalt Strike. The b
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **services_escalate_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
index 38b96a46ec..c32f863108 100644
--- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
+++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
@@ -119,9 +119,9 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **cmd_echo_pipe_-_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md
index 586f6a757d..60c4fd6778 100644
--- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md
+++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md
@@ -110,8 +110,8 @@ The following analytic identifies suspicious processes spawning from WinRM (wsmp
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **winrm_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md
index a21d072f69..42ee811fe0 100644
--- a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md
+++ b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md
@@ -107,8 +107,8 @@ This analytic detects a potential usage of secretsdump.py tool for dumping crede
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **secretdumps_offline_ntds_dumping_tool_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md
index 41ab2d83b9..f6da8244e1 100644
--- a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md
+++ b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md
@@ -132,8 +132,8 @@ SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. Shar
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_sharphound_file_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-05-27-detect_sharphound_usage.md b/docs/_posts/2021-05-27-detect_sharphound_usage.md
index 152ca345eb..3fe7723c86 100644
--- a/docs/_posts/2021-05-27-detect_sharphound_usage.md
+++ b/docs/_posts/2021-05-27-detect_sharphound_usage.md
@@ -132,8 +132,8 @@ The following analytic identifies SharpHound binary usage by using the original
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_sharphound_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
index ff48516595..93e1e6b5cc 100644
--- a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
+++ b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
@@ -132,8 +132,8 @@ The following analytic identifies the common command-line argument used by Azure
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_azurehound_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md
index 4b312b53f1..b9c6d7610e 100644
--- a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md
+++ b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md
@@ -132,8 +132,8 @@ The following analytic is similar to SharpHound file modifications, but this ins
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_azurehound_file_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
index 5b0437505b..efc68eb9c4 100644
--- a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
+++ b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
@@ -132,8 +132,8 @@ The following analytic identifies common command-line arguments used by SharpHou
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_sharphound_command-line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-02-conti_common_exec_parameter.md b/docs/_posts/2021-06-02-conti_common_exec_parameter.md
index 9167d33ce5..316ee41a9b 100644
--- a/docs/_posts/2021-06-02-conti_common_exec_parameter.md
+++ b/docs/_posts/2021-06-02-conti_common_exec_parameter.md
@@ -102,8 +102,8 @@ This search detects the suspicious commandline argument of revil ransomware to e
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **conti_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md
index 5286c0105c..bb4baa84c7 100644
--- a/docs/_posts/2021-06-02-modification_of_wallpaper.md
+++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md
@@ -101,8 +101,8 @@ This analytic identifies suspicious modification of registry to deface or change
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **modification_of_wallpaper_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-02-revil_common_exec_parameter.md b/docs/_posts/2021-06-02-revil_common_exec_parameter.md
index 3a23505f10..333cfb289a 100644
--- a/docs/_posts/2021-06-02-revil_common_exec_parameter.md
+++ b/docs/_posts/2021-06-02-revil_common_exec_parameter.md
@@ -102,8 +102,8 @@ This analytic identifies suspicious commandline parameter that are commonly used
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **revil_common_exec_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
index f095875738..aa6d560171 100644
--- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
+++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
@@ -106,8 +106,8 @@ this search is designed to detect potential malicious process loading COM object
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **wbemprox_com_object_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md
index 78a645abb8..21bfada3a3 100644
--- a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md
+++ b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md
@@ -107,8 +107,8 @@ This detection targets behaviors observed in post exploit kits like Meterpreter
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **excessive_number_of_taskhost_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md
index 793f8550d3..900b792ef2 100644
--- a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md
+++ b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md
@@ -120,10 +120,10 @@ The SPL above uses the following Macros:
 
 #### Required field
 * _time
-* Message
-* OpCode
-* ComputerName
-* User
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
 * EventCode
 
 
@@ -144,7 +144,7 @@ Potential for some third party applications to disable AMSI upon invocation. Fil
 
 | Risk Score  | Impact      | Confidence   | Message      |
 | ----------- | ----------- |--------------|--------------|
-| 49.0 | 70 | 70 | Possible AMSI Unloading via Reflection using PowerShell on $ComputerName$ |
+| 49.0 | 70 | 70 | Possible AMSI Unloading via Reflection using PowerShell on $Computer$ |
 
 
 > :information_source:
diff --git a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md
index 6961249843..262e1b6bf6 100644
--- a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md
+++ b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md
@@ -107,8 +107,8 @@ this search is to detect execution of `cipher.exe` to clear the unallocated sect
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **clear_unallocated_sector_using_cipher_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md
index 0a14d81719..0ea696d65d 100644
--- a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md
+++ b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md
@@ -107,8 +107,8 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **disable_logs_using_wevtutil_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md
index 5c7f7d0575..d895f70a46 100644
--- a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md
+++ b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md
@@ -102,8 +102,8 @@ This search is to detect a modification of file or directory permission using ta
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **permission_modification_using_takeown_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
index b4c8dfb0b9..63c2fafb1b 100644
--- a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
+++ b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
@@ -102,8 +102,8 @@ This search is to detect a suspicious bcdedit.exe execution to ignore all failur
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **prevent_automatic_repair_mode_using_bcdedit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
index ede1afad84..e75f0eb6fd 100644
--- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
+++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
@@ -112,8 +112,8 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **detect_wmi_event_subscription_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md
index f638d3f37f..ff2ea0cea2 100644
--- a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md
+++ b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md
@@ -115,8 +115,8 @@ The following analytic utilizes Windows Event ID 1100 to identify when Windows e
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **suspicious_event_log_service_behavior_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md
index d4cd44e404..f41f7f15d2 100644
--- a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md
+++ b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md
@@ -107,8 +107,8 @@ This analytic will identify suspicious process of cscript.exe where it tries to
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **execute_javascript_with_jscript_com_clsid_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
index 5016caf9db..eb65981ea1 100644
--- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
+++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
@@ -107,9 +107,9 @@ This search is to detect a suspicious commandline designed to delete files or di
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **recursive_delete_of_directory_in_batch_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
index 7008624346..bd72e6e9a8 100644
--- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
+++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
@@ -108,8 +108,8 @@ This search is to detect a suspicious modification of firewall to allow file and
 #### Macros
 The SPL above uses the following Macros:
 * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **allow_file_and_printing_sharing_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
index 7e79d3a83f..b5759a2471 100644
--- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
+++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
@@ -108,8 +108,8 @@ This search is to detect a suspicious modification to the firewall to allow netw
 #### Macros
 The SPL above uses the following Macros:
 * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **allow_network_discovery_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
index f3fa23324d..a425090e69 100644
--- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
+++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
@@ -111,8 +111,8 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **excessive_usage_of_sc_service_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -132,6 +132,7 @@ excessive execution of sc.exe is quite suspicious since it can modify or execute
 
 #### Associated Analytic story
 * [Ransomware](/stories/ransomware)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md
index c25832cc7b..ef62d7eafc 100644
--- a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md
+++ b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md
@@ -108,8 +108,8 @@ This detection targets behaviors observed when threat actors have used sc.exe to
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **excessive_number_of_service_control_start_as_disabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
index 6acb309142..0715b23fe2 100644
--- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
+++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
@@ -115,8 +115,8 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **spoolsv_spawning_rundll32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
index c3db511f1e..bbc1985d5b 100644
--- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
+++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
@@ -114,8 +114,8 @@ This search is to detect suspicious loading of dll in specific path relative to
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **spoolsv_suspicious_loaded_modules_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
index d77df07dd8..1b43ca5a8e 100644
--- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
+++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
@@ -106,8 +106,8 @@ This analytic identifies a suspicious behavior related to PrintNightmare, or CVE
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **spoolsv_suspicious_process_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
index fa14f5826f..28dfef2479 100644
--- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
+++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
@@ -113,8 +113,8 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **spoolsv_writing_a_dll_-_sysmon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md
index 6a27da8bc7..d736ada874 100644
--- a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md
+++ b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md
@@ -111,8 +111,8 @@ This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in no
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **msmpeng_application_dll_side_loading_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
index 6f9d39c5bf..c8832363f7 100644
--- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
+++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
@@ -2,6 +2,7 @@
 title: "UAC Bypass MMC Load Unsigned Dll"
 excerpt: "Bypass User Account Control
 , Abuse Elevation Control Mechanism
+, MMC
 "
 categories:
   - Endpoint
@@ -11,10 +12,12 @@ toc_label: ""
 tags:
   - Bypass User Account Control
   - Abuse Elevation Control Mechanism
+  - MMC
   - Defense Evasion
   - Privilege Escalation
   - Defense Evasion
   - Privilege Escalation
+  - Defense Evasion
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
@@ -51,6 +54,8 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application
 
 | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
 
+| [T1218.014](https://attack.mitre.org/techniques/T1218/014/) | MMC | Defense Evasion |
+
 </div>
 </details>
 
@@ -108,8 +113,8 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **uac_bypass_mmc_load_unsigned_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
index cc2b500868..9c8e890bd2 100644
--- a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
+++ b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
@@ -122,8 +122,8 @@ This search looks for cloud compute instances created by users who have not crea
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **cloud_compute_instance_created_by_previously_unseen_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-19-aws_createloginprofile.md b/docs/_posts/2021-07-19-aws_createloginprofile.md
index 7cb71f6877..b2e2c7f42c 100644
--- a/docs/_posts/2021-07-19-aws_createloginprofile.md
+++ b/docs/_posts/2021-07-19-aws_createloginprofile.md
@@ -116,8 +116,8 @@ This search looks for AWS CloudTrail events where a user A(victim A) creates a l
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_createloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md
index d7b9b393f5..6c3e88a3a7 100644
--- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md
+++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md
@@ -115,8 +115,8 @@ This search looks for AWS CloudTrail events where a user has created an open/pub
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **detect_new_open_s3_buckets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
index e8abc8052d..fae0ca6e88 100644
--- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
+++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
@@ -108,8 +108,8 @@ This search looks for AWS CloudTrail events where a user has created an open/pub
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **detect_new_open_s3_buckets_over_aws_cli_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
index 85d0179475..4d3b8451a5 100644
--- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
+++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
@@ -108,9 +108,9 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **mshta_spawning_rundll32_or_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
index cb00cd3555..1a8abd0c7d 100644
--- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
+++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
@@ -107,9 +107,9 @@ this search is to detect a suspicious office product process that spawn cmd chil
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **office_product_spawn_cmd_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
index ef3e261bdf..7ee60a9e83 100644
--- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
+++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
@@ -102,8 +102,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **rundll32_createremotethread_in_browser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
index 2612bc03e8..2fee621286 100644
--- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
+++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
@@ -106,8 +106,8 @@ This search is to detect a suspicious rundll32 process that drops executable (.e
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **rundll32_process_creating_exe_dll_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
index 9264ea657c..e574e6f691 100644
--- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
+++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
@@ -108,8 +108,8 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_icedid_rundll32_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
index e63dc15bff..2c4448604c 100644
--- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
+++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
@@ -108,8 +108,8 @@ This search is to detect a suspicious rundll32.exe process with plugininit param
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_rundll32_plugininit_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-27-chcp_command_execution.md b/docs/_posts/2021-07-27-chcp_command_execution.md
index b665569a64..247e12d47f 100644
--- a/docs/_posts/2021-07-27-chcp_command_execution.md
+++ b/docs/_posts/2021-07-27-chcp_command_execution.md
@@ -102,8 +102,8 @@ This search is to detect execution of chcp.exe application. this utility is used
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **chcp_command_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -128,6 +128,7 @@ other tools or script may used this to change code page to UTF-* or others
 
 #### Associated Analytic story
 * [IcedID](/stories/icedid)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
index 045cd228b1..27cbb5c585 100644
--- a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
+++ b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
@@ -109,9 +109,9 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **regsvr32_with_known_silent_switch_cmdline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
index 57dd88fc58..fdf4ec8c06 100644
--- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
+++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
@@ -102,8 +102,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **rundll32_create_remote_thread_to_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md
index 84c0e7fd30..77dd7cbdcb 100644
--- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md
+++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md
@@ -106,8 +106,8 @@ This search is to detect dropping a suspicious file named as "license.dat" in %a
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **drop_icedid_license_dat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
index 06a0119cf5..785cda45b1 100644
--- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
+++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
@@ -106,8 +106,8 @@ This search is to detect a suspicious file creation namely passff.tar and cookie
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **icedid_exfiltrated_archived_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
index 39e21e5d16..ae7b48391d 100644
--- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
+++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
@@ -107,9 +107,9 @@ this detection was designed to identifies suspicious spawned process of known MS
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **office_application_spawn_regsvr32_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
index d7e802c3c9..ce3d5c295e 100644
--- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
+++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
@@ -101,8 +101,8 @@ This search is to detect a suspicious file creation of sqlite3.dll in %temp% fol
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **sqlite_module_in_temp_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
index 2d8501f31d..bf0db94672 100644
--- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
+++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
@@ -102,8 +102,8 @@ This search is to detect suspicious process injection in command shell. This tec
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **create_remote_thread_in_shell_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-09-rundll32_lockworkstation.md b/docs/_posts/2021-08-09-rundll32_lockworkstation.md
index ded585a468..5058d1066c 100644
--- a/docs/_posts/2021-08-09-rundll32_lockworkstation.md
+++ b/docs/_posts/2021-08-09-rundll32_lockworkstation.md
@@ -107,8 +107,8 @@ This search is to detect a suspicious rundll32 commandline to lock the workstati
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **rundll32_lockworkstation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md
index 96458e18c1..9da25e52ad 100644
--- a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md
+++ b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md
@@ -107,8 +107,8 @@ This search is to detect a suspicious un-installation of application using msiex
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **uninstall_app_using_msiexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-11-fsutil_zeroing_file.md b/docs/_posts/2021-08-11-fsutil_zeroing_file.md
index cf2f3085c5..d250310e6a 100644
--- a/docs/_posts/2021-08-11-fsutil_zeroing_file.md
+++ b/docs/_posts/2021-08-11-fsutil_zeroing_file.md
@@ -102,8 +102,8 @@ This search is to detect a suspicious fsutil process to zeroing a target file. T
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **fsutil_zeroing_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
index 3fb4417f2a..65a9387f53 100644
--- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
+++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
@@ -106,8 +106,8 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object.
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **uac_bypass_with_colorui_com_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
index b6f0d3c01a..1bb1a670db 100644
--- a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
+++ b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
@@ -111,8 +111,8 @@ This search is to detect suspicious google drive or google docs files shared out
 
 #### Macros
 The SPL above uses the following Macros:
-* [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml)
 
 > :information_source:
 > **gsuite_drive_share_in_external_email_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md
index 3c41a25ed8..9503d402ab 100644
--- a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md
+++ b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md
@@ -107,8 +107,8 @@ This search is to detect a suspicious attachment file extension in Gsuite email
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **gsuite_email_suspicious_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md
index 2ffcffc326..e9fe2ca201 100644
--- a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md
+++ b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md
@@ -107,8 +107,8 @@ This search is to detect a suspicious 7z process with commandline pointing to SM
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **7zip_commandline_to_smb_share_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
index 8bda2214bc..d96bb8f419 100644
--- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
+++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
@@ -119,8 +119,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_ecr_container_scanning_findings_low_informational_unknown_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md
index ba20d125d6..096fcc5bea 100644
--- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md
+++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md
@@ -119,8 +119,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_ecr_container_scanning_findings_medium_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
index a5d581a73a..c869495b9b 100644
--- a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
+++ b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
@@ -112,8 +112,8 @@ This search is to detect a suspicious outbound e-mail from internal email to ext
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **gsuite_outbound_email_with_attachment_to_external_domain_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-18-esentutl_sam_copy.md b/docs/_posts/2021-08-18-esentutl_sam_copy.md
index a6c235bac4..fcb09a3843 100644
--- a/docs/_posts/2021-08-18-esentutl_sam_copy.md
+++ b/docs/_posts/2021-08-18-esentutl_sam_copy.md
@@ -107,9 +107,9 @@ The following analytic identifies the process - `esentutl.exe` - being used to c
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **esentutl_sam_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md
index 7a1ef37c9a..6fc836489c 100644
--- a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md
+++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md
@@ -115,8 +115,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_ecr_container_upload_outside_business_hours_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
index 6bc9d50178..c53734cb79 100644
--- a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
+++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
@@ -115,9 +115,9 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **aws_ecr_container_upload_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
index f70e2c6197..e3595cd0d7 100644
--- a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
+++ b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
@@ -110,8 +110,8 @@ This search is to detect a gsuite email contains suspicious subject having known
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **gsuite_email_suspicious_subject_with_attachment_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md
index 60c6036b42..cd7873937d 100644
--- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md
+++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md
@@ -105,8 +105,8 @@ The following analytic identifies cleartext protocols at risk of leaking sensiti
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **protocols_passing_authentication_in_cleartext_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-20-github_commit_changes_in_master.md b/docs/_posts/2021-08-20-github_commit_changes_in_master.md
index b176886222..0db42eec42 100644
--- a/docs/_posts/2021-08-20-github_commit_changes_in_master.md
+++ b/docs/_posts/2021-08-20-github_commit_changes_in_master.md
@@ -101,8 +101,8 @@ This search is to detect a pushed or commit to master or main branch. This is to
 
 #### Macros
 The SPL above uses the following Macros:
-* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
 
 > :information_source:
 > **github_commit_changes_in_master_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md
index 3fbd261d84..55b0cd8cf1 100644
--- a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md
+++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **getlocaluser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md
index 1ae86ca355..65ed551ddb 100644
--- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md
+++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **getwmiobject_user_account_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
index b9eae53195..97395a0a7b 100644
--- a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
+++ b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
@@ -110,8 +110,8 @@ This analytics is to detect a gmail containing a link that are known to be abuse
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **gsuite_email_with_known_abuse_web_service_link_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
index 05e5bc2a52..222f8bb9a1 100644
--- a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
+++ b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
@@ -111,8 +111,8 @@ This search is to detect a shared file in google drive with suspicious file name
 
 #### Macros
 The SPL above uses the following Macros:
-* [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml)
 
 > :information_source:
 > **gsuite_suspicious_shared_file_name_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md
index 2ed18073be..6161794c2a 100644
--- a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md
+++ b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **domain_account_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md
index 68b6e25aab..e7c336bbb4 100644
--- a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md
+++ b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md
@@ -108,8 +108,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **domain_account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md
index 35ae4c525e..0f8edcb217 100644
--- a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md
+++ b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **domain_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
index fb4bc0a96e..1abdd8c065 100644
--- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
+++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
@@ -102,8 +102,8 @@ This analytic identifies Get-DomainTrust from PowerView in order to gather domai
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **get-domaintrust_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell.md b/docs/_posts/2021-08-24-get_aduser_with_powershell.md
index 0a1bc88c75..99d7a6b93d 100644
--- a/docs/_posts/2021-08-24-get_aduser_with_powershell.md
+++ b/docs/_posts/2021-08-24-get_aduser_with_powershell.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **get_aduser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md
index 00faa196d4..5e3ccc9ec7 100644
--- a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md
+++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **get_domainuser_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md
index 4b1da86585..12ffa406ce 100644
--- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md
+++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **getwmiobject_ds_user_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md
index 346c0b4ae4..aa06e4111a 100644
--- a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md
+++ b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `net.exe` with command-line arguments u
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **domain_group_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md
index 5549827dd9..53315ed956 100644
--- a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md
+++ b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **domain_group_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md
index cd7c57ded7..eb3df3262c 100644
--- a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md
+++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe`  with command-l
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **elevated_group_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md
index f31eb06efa..289891f3b1 100644
--- a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md
+++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **elevated_group_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell.md b/docs/_posts/2021-08-25-getadgroup_with_powershell.md
index c1130fdbc7..78d29754ca 100644
--- a/docs/_posts/2021-08-25-getadgroup_with_powershell.md
+++ b/docs/_posts/2021-08-25-getadgroup_with_powershell.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **getadgroup_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md
index a166e237ad..bd53c4c7a6 100644
--- a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md
+++ b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **getdomaingroup_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md
index b56d16194b..ad340cae7a 100644
--- a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md
+++ b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line util
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **getnettcpconnection_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md
index 3db9586806..4ec21d1676 100644
--- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md
+++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **getwmiobject_ds_group_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
index 5d25f49cba..b95ef0b2e8 100644
--- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
+++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` executing the Get-ADDe
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **get_addefaultdomainpasswordpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
index e278c8d820..2e9ec509b7 100644
--- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
+++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` executing the Get ADUs
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **get_aduserresultantpasswordpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md
index c2e1d92b4b..68210802d9 100644
--- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md
+++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` executing the `Get-Dom
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **get_domainpolicy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md
index 4cdf009cfa..7f195b6c3d 100644
--- a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md
+++ b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command li
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **password_policy_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md
index d8b606a7ef..b15a922a25 100644
--- a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md
+++ b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md
@@ -121,8 +121,8 @@ This search looks for a process launching an `*.lnk` file under `C:\User*` or `*
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **process_creating_lnk_file_in_suspicious_location_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md
index a4109f88e7..27495bc909 100644
--- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md
+++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md
@@ -107,8 +107,8 @@ Review the source attempting to perform this activity against your environment.
 
 #### Macros
 The SPL above uses the following Macros:
-* [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [exchange](https://github.com/splunk/security_content/blob/develop/macros/exchange.yml)
 
 > :information_source:
 > **exchange_powershell_abuse_via_ssrf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md
index 8b4e1daf49..a7a7709f4a 100644
--- a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md
+++ b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `nltest.exe` with command-line argument
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **domain_controller_discovery_with_nltest_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md
index 34de9a917a..933e997068 100644
--- a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md
+++ b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **remote_system_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md
index 74fd24e098..7ae0dd38c1 100644
--- a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md
+++ b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md
@@ -108,8 +108,8 @@ During triage, review parallel security events to identify further suspicious ac
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **petitpotam_network_share_access_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md
index 097e4595bc..639b6ff4aa 100644
--- a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md
+++ b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md
@@ -105,8 +105,8 @@ The following analytic identifes Event Code 4768, A `Kerberos authentication tic
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **petitpotam_suspicious_kerberos_tgt_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md
index f04ca91335..1526c5c5e8 100644
--- a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md
+++ b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **remote_system_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md
index fed4ecbd94..6158e6df76 100644
--- a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md
+++ b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **domain_controller_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md
index 5bbe8e09bc..9534f2d6fd 100644
--- a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md
+++ b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **domain_group_discovery_with_dsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-01-github_commit_in_develop.md b/docs/_posts/2021-09-01-github_commit_in_develop.md
index 2eef99dca3..e2886e38e9 100644
--- a/docs/_posts/2021-09-01-github_commit_in_develop.md
+++ b/docs/_posts/2021-09-01-github_commit_in_develop.md
@@ -101,8 +101,8 @@ This search is to detect a pushed or commit to develop branch. This is to avoid
 
 #### Macros
 The SPL above uses the following Macros:
-* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
 
 > :information_source:
 > **github_commit_in_develop_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-01-github_dependabot_alert.md b/docs/_posts/2021-09-01-github_dependabot_alert.md
index fd2a212384..8e071247fe 100644
--- a/docs/_posts/2021-09-01-github_dependabot_alert.md
+++ b/docs/_posts/2021-09-01-github_dependabot_alert.md
@@ -113,8 +113,8 @@ This search looks for Dependabot Alerts in Github logs.
 
 #### Macros
 The SPL above uses the following Macros:
-* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
 
 > :information_source:
 > **github_dependabot_alert_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
index b9e564a35b..c13d9a26c5 100644
--- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
+++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
@@ -114,9 +114,9 @@ This search looks for Pull Request from unknown user.
 
 #### Macros
 The SPL above uses the following Macros:
-* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
 * [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
 
 > :information_source:
 > **github_pull_request_from_unknown_user_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md
index eea36a44e0..d2cbc9336e 100644
--- a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md
+++ b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **remote_system_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
index 35ff69f6e7..dfa36ed572 100644
--- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
+++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
@@ -102,8 +102,8 @@ This analytic identifies Get-ForestTrust from PowerSploit in order to gather dom
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **get-foresttrust_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
index 88e16dfd41..ac2289bd7c 100644
--- a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
+++ b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
@@ -102,8 +102,8 @@ This search is to detect a suspicious bcdedit commandline to configure the host
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **bcdedit_command_back_to_normal_mode_boot_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md
index bd0b7da87a..fda1a61b06 100644
--- a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md
+++ b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md
@@ -102,8 +102,8 @@ This search is to detect a suspicious bcdedit commandline to configure the host
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **change_to_safe_mode_with_network_config_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md
index f651563fe7..90bf4429ed 100644
--- a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md
+++ b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **getadcomputer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md
index 518a0b9f38..713fbc5000 100644
--- a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md
+++ b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **getdomaincomputer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md
index fce0306599..d908a9d014 100644
--- a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md
+++ b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **getdomaincontroller_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md
index db435f2c37..fb7d6d46cf 100644
--- a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md
+++ b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **getwmiobject_ds_computer_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
index 64cb7c7e3c..5f1e7fe3f7 100644
--- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
+++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
@@ -106,8 +106,8 @@ This analytic is to detect an application try to connect and create ADSI Object
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **schcache_change_by_app_connect_and_create_adsi_object_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-07-system_information_discovery_detection.md b/docs/_posts/2021-09-07-system_information_discovery_detection.md
index 0161023606..8508ab29a4 100644
--- a/docs/_posts/2021-09-07-system_information_discovery_detection.md
+++ b/docs/_posts/2021-09-07-system_information_discovery_detection.md
@@ -110,8 +110,8 @@ Detect system information discovery techniques used by attackers to understand c
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **system_information_discovery_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md
index 48003e4082..594531298f 100644
--- a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md
+++ b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md
@@ -112,8 +112,8 @@ The following detection identifies control.exe loading either a .cpl or .inf fro
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **control_loading_from_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md
index fd396ad9ae..5681350cc9 100644
--- a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md
+++ b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md
@@ -112,8 +112,8 @@ This search looks for the creation of local administrator accounts using net.exe
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **create_local_admin_accounts_using_net_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -141,6 +141,7 @@ Administrators often leverage net.exe to create admin accounts.
 
 #### Associated Analytic story
 * [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2021-09-08-office_spawning_control.md b/docs/_posts/2021-09-08-office_spawning_control.md
index 1d451095a8..c8c05e9d02 100644
--- a/docs/_posts/2021-09-08-office_spawning_control.md
+++ b/docs/_posts/2021-09-08-office_spawning_control.md
@@ -112,8 +112,8 @@ The following detection identifies control.exe spawning from an office product.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **office_spawning_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
index 8b8a3ff9c7..134b9a1a46 100644
--- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
+++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
@@ -113,8 +113,8 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **rundll32_control_rundll_hunt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
index b9e405aef2..9e7b8b4572 100644
--- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
+++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
@@ -113,8 +113,8 @@ The following detection identifies rundll32.exe with `control_rundll` within the
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **rundll32_control_rundll_world_writable_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md
index b323aa4525..f34dcadfbc 100644
--- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md
+++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md
@@ -107,9 +107,9 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **extraction_of_registry_hives_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md
index e21ffecea2..c89ce7ea75 100644
--- a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md
+++ b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `arp.exe` utilized to get a listing of
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **network_connection_discovery_with_arp_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md
index 155e7de23b..4c0494e90a 100644
--- a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md
+++ b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `net.exe` with command-line arguments u
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **network_connection_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -130,6 +130,7 @@ Administrators or power users may use this command for troubleshooting.
 
 #### Associated Analytic story
 * [Active Directory Discovery](/stories/active_directory_discovery)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md
index 810c81f80b..02afe963b8 100644
--- a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md
+++ b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `netstat.exe` with command-line argumen
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **network_connection_discovery_with_netstat_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md
index d0d660741e..7e6072e5ca 100644
--- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md
+++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powerhsell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **getcurrent_user_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md
index db30b5adf5..3fcf5e264c 100644
--- a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md
+++ b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md
@@ -107,8 +107,8 @@ This search is to detect a execution of jscript using cscript process. Commonly
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **jscript_execution_using_cscript_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
index 6bc3aff1ed..aa61d94c40 100644
--- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
+++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
@@ -106,8 +106,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **ms_scripting_process_loading_ldap_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
index a0d9a01148..663b1aeade 100644
--- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
+++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
@@ -106,8 +106,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **ms_scripting_process_loading_wmi_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_query.md b/docs/_posts/2021-09-13-system_user_discovery_with_query.md
index b62e73bfdf..3d5f542883 100644
--- a/docs/_posts/2021-09-13-system_user_discovery_with_query.md
+++ b/docs/_posts/2021-09-13-system_user_discovery_with_query.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `query.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **system_user_discovery_with_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md
index 027b3910fe..6c269f5979 100644
--- a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md
+++ b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `whoami.exe` without any arguments. Thi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **system_user_discovery_with_whoami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md
index 92435c9d5c..52e651933e 100644
--- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md
+++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md
@@ -102,8 +102,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **user_discovery_with_env_vars_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md
index 9fad82c973..2bdb9d99a4 100644
--- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md
+++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md
@@ -103,8 +103,8 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t
 #### Macros
 The SPL above uses the following Macros:
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **xsl_script_execution_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
index d3e692ef10..0df0d7499b 100644
--- a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
+++ b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
@@ -107,8 +107,8 @@ The following analytic identifies a non-standard parent process (not matching CM
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **cmdline_tool_not_executed_in_cmd_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md
index 624f0c31d3..0c112c1c9b 100644
--- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md
+++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md
@@ -107,8 +107,8 @@ The following hunting analytic identifies the use of `Get-WMIObject Win32_Group`
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **get_wmiobject_group_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-14-net_localgroup_discovery.md b/docs/_posts/2021-09-14-net_localgroup_discovery.md
index 0284a73976..cae36a82be 100644
--- a/docs/_posts/2021-09-14-net_localgroup_discovery.md
+++ b/docs/_posts/2021-09-14-net_localgroup_discovery.md
@@ -107,8 +107,8 @@ The following hunting analytic will identify the use of localgroup discovery usi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **net_localgroup_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -137,6 +137,7 @@ False positives may be present. Tune as needed.
 #### Associated Analytic story
 * [Active Directory Discovery](/stories/active_directory_discovery)
 * [Windows Discovery Techniques](/stories/windows_discovery_techniques)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md
index 3356fed25c..d1cfcb3cc0 100644
--- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md
+++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md
@@ -107,8 +107,8 @@ The following hunting analytic identifies the use of `get-localgroup` being used
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **powershell_get_localgroup_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-14-wmic_group_discovery.md b/docs/_posts/2021-09-14-wmic_group_discovery.md
index c697bf5232..4934e04504 100644
--- a/docs/_posts/2021-09-14-wmic_group_discovery.md
+++ b/docs/_posts/2021-09-14-wmic_group_discovery.md
@@ -109,8 +109,8 @@ During triage, review parallel processes and identify any further suspicious beh
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **wmic_group_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md
index 4c8a4013eb..694618f1b7 100644
--- a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md
+++ b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md
@@ -102,8 +102,8 @@ This search is to detect a suspicious whoami execution to check if the cmd or sh
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **check_elevated_cmd_using_whoami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md
index 9f48a1bb5b..d8ee054155 100644
--- a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md
+++ b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md
@@ -106,8 +106,8 @@ This search is to detect an anomaly event of non-chrome process accessing the fi
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **non_chrome_process_accessing_chrome_default_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md
index eb47910925..8ed284f78d 100644
--- a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md
+++ b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md
@@ -106,8 +106,8 @@ This search is to detect an anomaly event of non-firefox process accessing the f
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **non_firefox_process_access_firefox_profile_dir_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -134,6 +134,7 @@ other browser not listed related to firefox may catch by this rule.
 #### Associated Analytic story
 * [FIN7](/stories/fin7)
 * [Remcos](/stories/remcos)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2021-09-16-account_discovery_with_net_app.md b/docs/_posts/2021-09-16-account_discovery_with_net_app.md
index 3eb54391d9..2c66cec6fb 100644
--- a/docs/_posts/2021-09-16-account_discovery_with_net_app.md
+++ b/docs/_posts/2021-09-16-account_discovery_with_net_app.md
@@ -109,8 +109,8 @@ this search is to detect a potential account discovery series of command used by
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **account_discovery_with_net_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
index a387f7e780..54672494fe 100644
--- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
+++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
@@ -116,9 +116,9 @@ Attempt To Add Certificate To Untrusted Store
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **attempt_to_add_certificate_to_untrusted_store_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
index ee6b8e9c8c..8ee59db57a 100644
--- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
+++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
@@ -113,10 +113,10 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-bits_job_persistence.md b/docs/_posts/2021-09-16-bits_job_persistence.md
index 4bacba5373..65b5026013 100644
--- a/docs/_posts/2021-09-16-bits_job_persistence.md
+++ b/docs/_posts/2021-09-16-bits_job_persistence.md
@@ -103,9 +103,9 @@ The following query identifies Microsoft Background Intelligent Transfer Service
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **bits_job_persistence_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-bitsadmin_download_file.md b/docs/_posts/2021-09-16-bitsadmin_download_file.md
index b7c07192d5..e430f829c2 100644
--- a/docs/_posts/2021-09-16-bitsadmin_download_file.md
+++ b/docs/_posts/2021-09-16-bitsadmin_download_file.md
@@ -108,9 +108,9 @@ The following query identifies Microsoft Background Intelligent Transfer Service
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_bitsadmin](https://github.com/splunk/security_content/blob/develop/macros/process_bitsadmin.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **bitsadmin_download_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
index 2b93b8622b..3a7ad373e5 100644
--- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
+++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
@@ -113,9 +113,9 @@ This search detects the use of wmic and Powershell to create a shadow copy.
 #### Macros
 The SPL above uses the following Macros:
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **creation_of_shadow_copy_with_wmic_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
index 4df0255546..dcf5dcfcc6 100644
--- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
+++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
@@ -112,9 +112,9 @@ This search detects credential dumping using copy command from a shadow copy.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **credential_dumping_via_copy_command_from_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
index e216f6991c..07f3c1ee10 100644
--- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
+++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
@@ -112,9 +112,9 @@ This search detects the creation of a symlink to a shadow copy.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **credential_dumping_via_symlink_to_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md
index 494d89b749..a3b6fe1e24 100644
--- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md
+++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md
@@ -113,8 +113,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM
 #### Macros
 The SPL above uses the following Macros:
 * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_html_help_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md
index 5d586df5e8..64f09c68b7 100644
--- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md
+++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md
@@ -113,8 +113,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM
 #### Macros
 The SPL above uses the following Macros:
 * [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_html_help_using_infotech_storage_handlers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md
index 94be623f27..eacfc71a0e 100644
--- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md
+++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md
@@ -112,9 +112,9 @@ The following analytic identifies "mshta.exe" execution with inline protocol han
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_mshta_inline_hta_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md
index 8b03c85b2b..6e43b419ee 100644
--- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md
+++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md
@@ -112,9 +112,9 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_mshta_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
index 3922861f63..792de3fc4f 100644
--- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
+++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
@@ -112,9 +112,9 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **detect_psexec_with_accepteula_flag_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_renamed_7-zip.md b/docs/_posts/2021-09-16-detect_renamed_7-zip.md
index e00bafd53b..2aa3a5d738 100644
--- a/docs/_posts/2021-09-16-detect_renamed_7-zip.md
+++ b/docs/_posts/2021-09-16-detect_renamed_7-zip.md
@@ -107,8 +107,8 @@ The following analytic identifies renamed 7-Zip usage using Sysmon. At this stag
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_renamed_7-zip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_renamed_rclone.md b/docs/_posts/2021-09-16-detect_renamed_rclone.md
index 0170c0ed03..88e57e0dc8 100644
--- a/docs/_posts/2021-09-16-detect_renamed_rclone.md
+++ b/docs/_posts/2021-09-16-detect_renamed_rclone.md
@@ -102,8 +102,8 @@ The following analytic identifies the usage of `rclone.exe`, renamed, being used
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_renamed_rclone_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_renamed_winrar.md b/docs/_posts/2021-09-16-detect_renamed_winrar.md
index fda3661084..e0a0dee5d6 100644
--- a/docs/_posts/2021-09-16-detect_renamed_winrar.md
+++ b/docs/_posts/2021-09-16-detect_renamed_winrar.md
@@ -107,8 +107,8 @@ The following analtyic identifies renamed instances of `WinRAR.exe`. In most cas
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_renamed_winrar_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
index b85418080b..cbd7f74e6d 100644
--- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
+++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
@@ -114,9 +114,9 @@ During triage, confirm this is procdump.exe executing. If it is the first time a
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **dump_lsass_via_procdump_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_net.md b/docs/_posts/2021-09-16-local_account_discovery_with_net.md
index f4b3227e0b..53d906c803 100644
--- a/docs/_posts/2021-09-16-local_account_discovery_with_net.md
+++ b/docs/_posts/2021-09-16-local_account_discovery_with_net.md
@@ -108,8 +108,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **local_account_discovery_with_net_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md
index 3be4ca3539..8bbbca5fdd 100644
--- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md
+++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md
@@ -108,8 +108,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
 #### Macros
 The SPL above uses the following Macros:
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **local_account_discovery_with_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md
index bc01d8f37b..11ee174959 100644
--- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md
+++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md
@@ -108,8 +108,8 @@ The following detection identifies the latest behavior utilized by Ursnif malwar
 #### Macros
 The SPL above uses the following Macros:
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **office_product_spawning_wmic_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md
index d68351a19e..5907724877 100644
--- a/docs/_posts/2021-09-16-processes_launching_netsh.md
+++ b/docs/_posts/2021-09-16-processes_launching_netsh.md
@@ -113,8 +113,8 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr
 #### Macros
 The SPL above uses the following Macros:
 * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **processes_launching_netsh_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -139,6 +139,7 @@ Some VPN applications are known to launch netsh.exe. Outside of these instances,
 * [Netsh Abuse](/stories/netsh_abuse)
 * [Disabling Security Tools](/stories/disabling_security_tools)
 * [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md
index 108a92cdd0..5a3740eb78 100644
--- a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md
+++ b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md
@@ -107,8 +107,8 @@ This search is to detect potential malicious office document executing lolbin ch
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **office_document_spawned_child_process_to_download_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
index 4988b10ad9..9f36797a90 100644
--- a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
+++ b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
@@ -102,8 +102,8 @@ This search is to detect file creation in remcos folder in appdata which is the
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **remcos_rat_file_creation_in_remcos_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-27-change_default_file_association.md b/docs/_posts/2021-09-27-change_default_file_association.md
index 4244fd0b89..cb7c02689c 100644
--- a/docs/_posts/2021-09-27-change_default_file_association.md
+++ b/docs/_posts/2021-09-27-change_default_file_association.md
@@ -109,8 +109,8 @@ This analytic is developed to detect suspicious registry modification to change
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **change_default_file_association_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md
index 3b034ccca2..65c5eeab70 100644
--- a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md
+++ b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md
@@ -109,8 +109,8 @@ This search is to detect a suspicious modification of registry entry to persist
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **logon_script_event_trigger_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md
index e692c931a0..b84ed3e5c4 100644
--- a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md
+++ b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md
@@ -109,8 +109,8 @@ This analytic is developed to detect possible event trigger execution through sc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **screensaver_event_trigger_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md
index 7271d312a2..d0cbefcb3b 100644
--- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md
+++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md
@@ -111,8 +111,8 @@ This analytic is to detect a suspicious modification or new registry entry regar
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **print_processor_registry_autostart_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md
index be4fd3f7ba..5ed0df7318 100644
--- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md
+++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md
@@ -108,8 +108,8 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **verclsid_clsid_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md
index 542a0c8b46..e3c8f76556 100644
--- a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md
+++ b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md
@@ -107,8 +107,8 @@ This analytic is to detect a suspicious wscript commandline to execute vbscript.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **vbscript_execution_using_wscript_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md
index dabdccd53c..8ae8f4edaf 100644
--- a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md
+++ b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md
@@ -108,8 +108,8 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **msbuild_suspicious_spawned_by_script_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
index 169b85a91a..aba5066818 100644
--- a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
+++ b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
@@ -109,9 +109,9 @@ This analytic is to detect a loading of dll using regsvr32 application with sile
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **regsvr32_silent_and_install_param_dll_loading_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md
index 04b84d8c5e..f72b3e29df 100644
--- a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md
+++ b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md
@@ -112,8 +112,8 @@ The following analytic identifies a process modifying the registry with a known
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **malicious_inprocserver32_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md
index f0c83e517f..f42d4979d5 100644
--- a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md
+++ b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md
@@ -112,8 +112,8 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **process_writing_dynamicwrapperx_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
index f7e4a6b192..a3863a8678 100644
--- a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
+++ b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
@@ -103,8 +103,8 @@ This analytic is to detect a suspicious rundll32 commandline to clear shim cache
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **rundll32_shimcache_flush_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
index 73f8cdfa44..c13cc3d56c 100644
--- a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
+++ b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
@@ -108,8 +108,8 @@ This analytic is to detect a suspicious copy of file from systemroot folder of t
 #### Macros
 The SPL above uses the following Macros:
 * [process_copy](https://github.com/splunk/security_content/blob/develop/macros/process_copy.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_copy_on_system32_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md
index 899a5b9487..0fbefce559 100644
--- a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md
+++ b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md
@@ -103,8 +103,8 @@ The following analytic identifies winhlp32.exe, found natively in `c:\windows\`,
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **winhlp32_spawning_a_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-06-sdelete_application_execution.md b/docs/_posts/2021-10-06-sdelete_application_execution.md
index d018edade9..0cd61d1772 100644
--- a/docs/_posts/2021-10-06-sdelete_application_execution.md
+++ b/docs/_posts/2021-10-06-sdelete_application_execution.md
@@ -112,9 +112,9 @@ This analytic is to detect the execution of sdelete.exe application sysinternal
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_sdelete](https://github.com/splunk/security_content/blob/develop/macros/process_sdelete.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **sdelete_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md
index 4a2f07702a..238d194fdd 100644
--- a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md
+++ b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md
@@ -121,8 +121,8 @@ This analytic identifies a suspicious spawned process by WScript or CScript proc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **wscript_or_cscript_suspicious_child_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md
index 1834efe99a..762e377e0f 100644
--- a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md
+++ b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md
@@ -118,8 +118,8 @@ The wevtutil.exe application is the windows event log utility. This searches for
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_wevtutil_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md
index 0916b6fef8..36e33ba380 100644
--- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md
+++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md
@@ -110,8 +110,8 @@ During triage, review parallel processes for further suspicious activity.
 #### Macros
 The SPL above uses the following Macros:
 * [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **serviceprincipalnames_discovery_with_setspn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-18-disable_schedule_task.md b/docs/_posts/2021-10-18-disable_schedule_task.md
index cc6eee3d12..1b4cfa60ad 100644
--- a/docs/_posts/2021-10-18-disable_schedule_task.md
+++ b/docs/_posts/2021-10-18-disable_schedule_task.md
@@ -107,8 +107,8 @@ This analytic is to detect a suspicious commandline to disable existing schedule
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **disable_schedule_task_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md
index 4320088985..22720e91d1 100644
--- a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md
+++ b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md
@@ -105,8 +105,8 @@ During triage, review parallel processes for further behavior. In addition, iden
 #### Macros
 The SPL above uses the following Macros:
 * [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_curl_download_to_suspicious_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-03-windows_adfind_exe.md b/docs/_posts/2021-11-03-windows_adfind_exe.md
index d0aa902176..f998e017cf 100644
--- a/docs/_posts/2021-11-03-windows_adfind_exe.md
+++ b/docs/_posts/2021-11-03-windows_adfind_exe.md
@@ -107,8 +107,8 @@ This search looks for the execution of `adfind.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_adfind_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md
index e9d0341f4a..fd0857c133 100644
--- a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md
+++ b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md
@@ -126,8 +126,8 @@ This search looks for execution of commonly used attacker tools on an endpoint.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **attacker_tools_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md
index 1aa535fe1c..fe5471fb42 100644
--- a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md
+++ b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md
@@ -107,8 +107,8 @@ Adversaries may use one of the three methods based on the remote destination and
 #### Macros
 The SPL above uses the following Macros:
 * [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_curl_upload_to_remote_destination_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
index 00688011cc..be55e557b9 100644
--- a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
@@ -109,8 +109,8 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_service_creation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
index e3f0c5a257..30f8951fe7 100644
--- a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
@@ -109,8 +109,8 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_service_initiation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
index 5bb1da6c62..4adbe759e9 100644
--- a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
+++ b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
@@ -107,8 +107,8 @@ This analytic looks for the execution of `winrs.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **remote_process_instantiation_via_winrm_and_winrs_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
index d5f4812d79..9efa6c3b0c 100644
--- a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
+++ b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
@@ -111,8 +111,8 @@ This analytic looks for the execution of `at.exe` with command-line arguments ut
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **scheduled_task_creation_on_remote_endpoint_using_at_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
index 7c615d89a5..8f7eb63971 100644
--- a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
@@ -111,8 +111,8 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **scheduled_task_initiation_on_remote_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md
index 6e8a86eaef..284af4d9fc 100644
--- a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md
+++ b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md
@@ -103,8 +103,8 @@ The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible St
 #### Macros
 The SPL above uses the following Macros:
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **wmic_xsl_execution_via_url_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md
index 6e3ae286d2..0d1451a1db 100644
--- a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md
+++ b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md
@@ -102,8 +102,8 @@ The following detection identifies excessive AccessDenied events within an hour
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_iam_accessdenied_discovery_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
index cfdd0c66c0..52abb47d1e 100644
--- a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
+++ b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
@@ -107,9 +107,9 @@ this analytic is to detect a suspicious compile before delivery approach of .net
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **csc_net_on_the_fly_compilation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md
index b4a8f3bba3..a40ceb6936 100644
--- a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md
+++ b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md
@@ -98,7 +98,7 @@ This analytic detects a potential suspicious modification of firewall rule allow
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*firewall*" Processes.process = "*allowedprogram*" Processes.process = "*add*" Processes.process = "*ENABLE*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*firewall*" Processes.process = "*allow*" Processes.process = "*add*" Processes.process = "*ENABLE*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
 | `drop_dm_object_name(Processes)` 
 | `security_content_ctime(firstTime)` 
 | `security_content_ctime(lastTime)` 
@@ -107,8 +107,8 @@ This analytic detects a potential suspicious modification of firewall rule allow
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **firewall_allowed_program_enable_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -133,6 +133,7 @@ A network operator or systems administrator may utilize an automated or manual e
 
 #### Associated Analytic story
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
index 689b08553e..9d9050df1a 100644
--- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
+++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
@@ -108,8 +108,8 @@ This analytic look for a spawned process of route.exe windows application. Adver
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **network_discovery_using_route_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
index f061dea140..622f31b0c1 100644
--- a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
+++ b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
@@ -111,8 +111,8 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc
 #### Macros
 The SPL above uses the following Macros:
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **remote_process_instantiation_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-12-runas_execution_in_commandline.md b/docs/_posts/2021-11-12-runas_execution_in_commandline.md
index 8fc160fc66..cc681854c0 100644
--- a/docs/_posts/2021-11-12-runas_execution_in_commandline.md
+++ b/docs/_posts/2021-11-12-runas_execution_in_commandline.md
@@ -109,9 +109,9 @@ This analytic look for a spawned runas.exe process with a administrator user opt
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **runas_execution_in_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
index 1eb00cabc5..55bc046bbd 100644
--- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
+++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
@@ -112,8 +112,8 @@ During triage review resulting network connections, file modifications, and para
 #### Macros
 The SPL above uses the following Macros:
 * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_installutil_uninstall_option_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
index 528f6b0294..c2736e0ce1 100644
--- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
+++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
@@ -111,8 +111,8 @@ During triage review resulting network connections, file modifications, and para
 #### Macros
 The SPL above uses the following Macros:
 * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_installutil_url_in_command_line_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
index 89388cead9..81de8c5624 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
@@ -107,9 +107,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **remote_process_instantiation_via_dcom_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
index 47fd1b737f..5b8a381b82 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
@@ -102,9 +102,9 @@ This analytic looks for the execution of `powershell.exe` leveraging the `Invoke
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **remote_process_instantiation_via_wmi_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md
index f6a1e66377..9d36129ad0 100644
--- a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md
+++ b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md
@@ -102,8 +102,8 @@ The following analytic identifies DiskCryptor  process name of dcrypt.exe or int
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_diskcryptor_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
index 77c478c787..cd91819f97 100644
--- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
+++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
@@ -107,9 +107,9 @@ This analytic looks for the execution of `powershell.exe` with arguments utilize
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **remote_process_instantiation_via_winrm_and_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-17-windows_dism_remove_defender.md b/docs/_posts/2021-11-17-windows_dism_remove_defender.md
index de4bb52790..407e0e576c 100644
--- a/docs/_posts/2021-11-17-windows_dism_remove_defender.md
+++ b/docs/_posts/2021-11-17-windows_dism_remove_defender.md
@@ -107,8 +107,8 @@ The following analytic identifies the use of the Windows Disk Image Utility, `di
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_dism_remove_defender_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
index 98e16c7643..3262267714 100644
--- a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
+++ b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
@@ -105,8 +105,8 @@ The following analytic identifies executable files (.exe or .dll) being written
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **executable_file_written_in_administrative_smb_share_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
index 1c834b88c8..ab844da06b 100644
--- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
+++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
@@ -108,8 +108,8 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **loading_of_dynwrapx_module_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md
index 13e86cbc0e..7616892f0b 100644
--- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md
+++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md
@@ -102,9 +102,9 @@ This analytic is to detect a suspicious dxdiag.exe process command-line executio
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_dxdiag](https://github.com/splunk/security_content/blob/develop/macros/process_dxdiag.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **system_info_gathering_using_dxdiag_application_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md
index 0302e0e287..a240857b3c 100644
--- a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md
+++ b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md
@@ -107,8 +107,8 @@ This analytic will detect if a suspicious process contains a commandline paramet
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **possible_browser_pass_view_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
index 4a7df02b80..f1d26ef0d2 100644
--- a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
@@ -109,8 +109,8 @@ The following analytic identifies `services.exe` spawning a LOLBAS execution pro
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **services_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
index 6393b95a4f..49d8668e14 100644
--- a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
@@ -111,8 +111,8 @@ The following analytic identifies `svchost.exe` spawning a LOLBAS execution proc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **svchost_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
index 5020e994f5..479ec8abb8 100644
--- a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
@@ -102,8 +102,8 @@ The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution pro
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **wmiprsve_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
index 4f98add5e0..cc5641f5df 100644
--- a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
@@ -107,8 +107,8 @@ The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **wsmprovhost_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
index cc8520ac4b..7b21a8c296 100644
--- a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
@@ -2,6 +2,7 @@
 title: "Mmc LOLBAS Execution Process Spawn"
 excerpt: "Remote Services
 , Distributed Component Object Model
+, MMC
 "
 categories:
   - Endpoint
@@ -11,8 +12,10 @@ toc_label: ""
 tags:
   - Remote Services
   - Distributed Component Object Model
+  - MMC
   - Lateral Movement
   - Lateral Movement
+  - Defense Evasion
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
@@ -49,6 +52,8 @@ The following analytic identifies `mmc.exe` spawning a LOLBAS execution process.
 
 | [T1021.003](https://attack.mitre.org/techniques/T1021/003/) | Distributed Component Object Model | Lateral Movement |
 
+| [T1218.014](https://attack.mitre.org/techniques/T1218/014/) | MMC | Defense Evasion |
+
 </div>
 </details>
 
@@ -107,8 +112,8 @@ The following analytic identifies `mmc.exe` spawning a LOLBAS execution process.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **mmc_lolbas_execution_process_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -145,7 +150,7 @@ Legitimate applications may trigger this behavior, filter as needed.
 
 | Risk Score  | Impact      | Confidence   | Message      |
 | ----------- | ----------- |--------------|--------------|
-| 54.0 | 90 | 60 | Mmc.exe spawned a LOLBAS process on $dest |
+| 54.0 | 90 | 60 | Mmc.exe spawned a LOLBAS process on $dest$. |
 
 
 > :information_source:
diff --git a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md
index fd75d5de84..c4f1f46cc0 100644
--- a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md
+++ b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md
@@ -107,8 +107,8 @@ This analytic will identify a suspicious process command-line related to Windows
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **add_or_set_windows_defender_exclusion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md b/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md
index e177a9deac..a3e9f131d9 100644
--- a/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md
+++ b/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md
@@ -136,6 +136,7 @@ admin or user may choose to use this windows features.
 #### Associated Analytic story
 * [Remcos](/stories/remcos)
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
index 9a1601b332..6ededee035 100644
--- a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
+++ b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
@@ -102,9 +102,9 @@ This analytic identifies commonly used command-line arguments used by `rclone.ex
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_rclone](https://github.com/splunk/security_content/blob/develop/macros/process_rclone.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **detect_rclone_command-line_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
index e55b185381..86a012dfd6 100644
--- a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
+++ b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
@@ -7,6 +7,7 @@ excerpt: "Remote Services
 , Scheduled Task
 , Windows Service
 , PowerShell
+, MMC
 "
 categories:
   - Endpoint
@@ -21,6 +22,7 @@ tags:
   - Scheduled Task
   - Windows Service
   - PowerShell
+  - MMC
   - Lateral Movement
   - Lateral Movement
   - Lateral Movement
@@ -31,6 +33,7 @@ tags:
   - Persistence
   - Privilege Escalation
   - Execution
+  - Defense Evasion
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
@@ -77,6 +80,8 @@ The following analytic assists with identifying a PowerShell process spawned as
 
 | [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
 
+| [T1218.014](https://attack.mitre.org/techniques/T1218/014/) | MMC | Defense Evasion |
+
 </div>
 </details>
 
@@ -135,8 +140,8 @@ The following analytic assists with identifying a PowerShell process spawned as
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **possible_lateral_movement_powershell_spawn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md
index 27fc81bebd..f70a9508fb 100644
--- a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md
+++ b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md
@@ -107,8 +107,8 @@ The search logic specifically looks for high number of distinct commands run in
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_linux_discovery_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md
index 1979e02a34..2ef2e5e6e0 100644
--- a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md
+++ b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md
@@ -102,8 +102,8 @@ The following analytic identifies the Raccine Rules Updater scheduled task being
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_raccine_scheduled_task_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
index 180db1a279..d94c2cff62 100644
--- a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
+++ b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
@@ -119,8 +119,8 @@ In addition, `msi.dll` has been abused in DLL side-loading attacks by being load
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **msi_module_loaded_by_non-system_binary_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md
index 0581a6cb2e..0c8c4f2440 100644
--- a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md
+++ b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md
@@ -108,8 +108,8 @@ The following analytic identifies the use of curl on Linux or MacOS attempting t
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **curl_download_and_bash_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md
index bfed14bc43..3247414e8f 100644
--- a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md
+++ b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md
@@ -108,8 +108,8 @@ The following analytic identifies the use of wget on Linux or MacOS attempting t
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **wget_download_and_bash_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md
index 363dd9cec2..9c3749457a 100644
--- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md
+++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md
@@ -107,9 +107,9 @@ The following analytic identifies the process name of Java, Apache, or Tomcat sp
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [linux_shells](https://github.com/splunk/security_content/blob/develop/macros/linux_shells.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **linux_java_spawning_shell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
index be6c7be8fc..09319deb53 100644
--- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
+++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
@@ -124,8 +124,8 @@ CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **log4shell_jndi_payload_injection_with_outbound_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md
index 4a076c35c3..130435c879 100644
--- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md
+++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md
@@ -109,9 +109,9 @@ The following analytic identifies the process name of java.exe and w3wp.exe spaw
 
 #### Macros
 The SPL above uses the following Macros:
+* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml)
 
 > :information_source:
 > **windows_java_spawning_shells_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md
index 42cc8ce213..7a887aa3c0 100644
--- a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md
+++ b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md
@@ -117,8 +117,8 @@ The following analytic identifies a suspicious file creation in known cron table
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_add_files_in_known_crontab_directories_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md
index 47319dbe9c..bb6a258cfd 100644
--- a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md
+++ b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md
@@ -117,8 +117,8 @@ The following analytic identifies a suspicious file creation of /etc/at.allow or
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_at_allow_config_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md
index 6d59c78222..953ced99a4 100644
--- a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md
+++ b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md
@@ -117,8 +117,8 @@ The following analytic identifies a suspicious cronjobs modification using cront
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_edit_cron_table_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md
index 48da01550b..03a9fd16f5 100644
--- a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md
+++ b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md
@@ -117,8 +117,8 @@ This analytic looks for possible suspicious commandline that may use to append a
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md
index 74e771fcd1..ed0ee79276 100644
--- a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md
+++ b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md
@@ -117,8 +117,8 @@ This analytic looks for possible modification of cronjobs file using editor. Thi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_possible_cronjob_modification_with_editor_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md
index 8a5ef21df0..6f00971b99 100644
--- a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md
+++ b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md
@@ -115,8 +115,8 @@ This analytic looks for suspicious file creation on init system directories for
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_file_creation_in_init_boot_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md
index b0fe1a2c23..2dbf6a99e7 100644
--- a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md
+++ b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md
@@ -115,8 +115,8 @@ This analytic looks for suspicious file creation in /etc/profile.d directory to
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_file_creation_in_profile_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md
index dd50e5d092..a9fdbc8fcb 100644
--- a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md
+++ b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md
@@ -115,8 +115,8 @@ This analytic looks for suspicious command-lines that can be possibly used to mo
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_possible_append_command_to_profile_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md
index 84593309e0..987f16168d 100644
--- a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md
+++ b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md
@@ -117,8 +117,8 @@ This analytic looks for suspicious file creation in systemd timer directory in l
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_service_file_created_in_systemd_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-20-linux_service_restarted.md b/docs/_posts/2021-12-20-linux_service_restarted.md
index 07b80b63ae..f35765c93a 100644
--- a/docs/_posts/2021-12-20-linux_service_restarted.md
+++ b/docs/_posts/2021-12-20-linux_service_restarted.md
@@ -117,8 +117,8 @@ This analytic looks for restarted or re-enable services in linux platform. This
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_service_restarted_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md
index 8b5aa7f4d1..eec3c468b0 100644
--- a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md
+++ b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md
@@ -117,8 +117,8 @@ This analytic looks for created or enable services in linux platform. This techn
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_service_started_or_enabled_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-21-linux_add_user_account.md b/docs/_posts/2021-12-21-linux_add_user_account.md
index 73ed7ae760..9584b01ede 100644
--- a/docs/_posts/2021-12-21-linux_add_user_account.md
+++ b/docs/_posts/2021-12-21-linux_add_user_account.md
@@ -113,8 +113,8 @@ This analytic looks for commands to create user accounts on the linux platform.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_add_user_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md
index 1ee27b641b..35bdfcb666 100644
--- a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md
+++ b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md
@@ -113,8 +113,8 @@ This analytic looks for a commandline that change the file owner to root using c
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_change_file_owner_to_root_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md
index ff9d2ee30f..31ddc7dcaa 100644
--- a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md
+++ b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md
@@ -115,8 +115,8 @@ This analytic is to look for suspicious command lines that may add entry to /etc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_nopasswd_entry_in_sudoers_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md
index 70cb99b0bc..a5ce53de0b 100644
--- a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md
+++ b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md
@@ -115,8 +115,8 @@ This analytic looks for suspicious chmod utility execution to enable SUID bit. T
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_setuid_using_chmod_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md
index f532a50a5d..3f84cbaeda 100644
--- a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md
+++ b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md
@@ -115,8 +115,8 @@ This analytic looks for suspicious setcap utility execution to enable SUID bit.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_setuid_using_setcap_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md
index 814ef3f322..3116da0cc8 100644
--- a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md
+++ b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md
@@ -115,8 +115,8 @@ This analytic is to looks for suspicious commandline that add entry to /etc/sudo
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_visudo_utility_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md
index 66b34d739a..e756d513a2 100644
--- a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md
+++ b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md
@@ -115,8 +115,8 @@ This analytic looks for suspicious file creation in kernel/driver directory in l
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_file_created_in_kernel_driver_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md
index 94a25b61c5..b2488c3634 100644
--- a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md
+++ b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md
@@ -115,8 +115,8 @@ This analytic looks for inserting of linux kernel module using insmod utility fu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_insert_kernel_module_using_insmod_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md
index b251fd4fae..7f68a84eeb 100644
--- a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md
+++ b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md
@@ -115,8 +115,8 @@ This analytic looks for possible installing a linux kernel module using modprobe
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_install_kernel_module_using_modprobe_utility_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md
index 8634937703..ecf91245bd 100644
--- a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md
+++ b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md
@@ -117,8 +117,8 @@ This analytic is to detect a suspicious command that may hijack a library functi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_preload_hijack_library_calls_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md
index e41cc28923..c58ac363d4 100644
--- a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md
+++ b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md
@@ -115,8 +115,8 @@ This analytic is to look for possible elevation control access using a common kn
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_common_process_for_elevation_control_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md
index 61633cc0b9..0087e4ed82 100644
--- a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md
+++ b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md
@@ -115,8 +115,8 @@ This analytic is to looks for file creation of sudoers.tmp file cause by editing
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_sudoers_tmp_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md
index cdb6c7fd4b..339e2ffa54 100644
--- a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md
+++ b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md
@@ -115,8 +115,8 @@ This analytic is to detect the execution of sudo or su command in linux operatin
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_sudo_or_su_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md
index d5b3d92b20..9eb88bf61d 100644
--- a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md
+++ b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md
@@ -115,8 +115,8 @@ This analytic is to detect the creation of doas.conf file in linux host platform
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_doas_conf_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-05-linux_doas_tool_execution.md b/docs/_posts/2022-01-05-linux_doas_tool_execution.md
index 2de453899f..a322917bc6 100644
--- a/docs/_posts/2022-01-05-linux_doas_tool_execution.md
+++ b/docs/_posts/2022-01-05-linux_doas_tool_execution.md
@@ -115,8 +115,8 @@ This analytic is to detect the doas tool execution in linux host platform. This
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_doas_tool_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md
index 2aa11354c6..9050778c1c 100644
--- a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md
+++ b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md
@@ -113,8 +113,8 @@ This analytic is to detect a possible attempt to dump or access the content of /
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_possible_access_to_credential_files_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md
index ccd0161f40..7a328f51ca 100644
--- a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md
+++ b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md
@@ -115,8 +115,8 @@ This analytic is to detect a possible access or modification of /etc/sudoers fil
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_possible_access_to_sudoers_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md
index 7a3d71fcb8..3116f02ed4 100644
--- a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md
+++ b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md
@@ -113,8 +113,8 @@ This analytic is to look for suspicious process command-line that might be acces
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_possible_access_or_modification_of_sshd_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md
index e48b498599..ee96e8edd4 100644
--- a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md
+++ b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md
@@ -113,8 +113,8 @@ This analytic is to look for possible ssh key file creation on ~/.ssh/ folder. T
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_possible_ssh_key_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md
index 713db23011..35a8742ac8 100644
--- a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md
+++ b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md
@@ -126,9 +126,9 @@ The following hunting analytic identifies PowerShell commands utilizing the Wind
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **powershell_-_connect_to_internet_with_hidden_window_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
index ee9b513261..58ff38a98a 100644
--- a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
+++ b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
@@ -109,8 +109,8 @@ The following hunting analytic identifies all processes requesting access into L
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **windows_hunting_system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
index cc2eb7766c..c48ad067c4 100644
--- a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
+++ b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
@@ -109,8 +109,8 @@ The following analytic identifies non SYSTEM accounts requesting access to lsass
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **windows_non-system_account_targeting_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
index b9a6f99a07..bbc1eaf197 100644
--- a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
+++ b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
@@ -108,9 +108,9 @@ The following analytic uses a pretrained machine learning text classifier to det
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [potentially_malicious_code_on_cmdline_tokenize_score](https://github.com/splunk/security_content/blob/develop/macros/potentially_malicious_code_on_cmdline_tokenize_score.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **potentially_malicious_code_on_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
index 7cf91e628e..10fc37afbb 100644
--- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
+++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
@@ -112,9 +112,9 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **cmd_carry_out_string_command_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -145,6 +145,7 @@ False positives may be high based on legitimate scripted code in any environment
 * [WhisperGate](/stories/whispergate)
 * [Hermetic Wiper](/stories/hermetic_wiper)
 * [Living Off The Land](/stories/living_off_the_land)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md
index a5ede8b26a..bc07278512 100644
--- a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md
+++ b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md
@@ -123,8 +123,8 @@ This analytic looks for the presence of suspicious commandline parameters typica
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **impacket_lateral_movement_commandline_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md
index d674b46386..77efddec03 100644
--- a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md
+++ b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md
@@ -119,9 +119,9 @@ Alternatively, may use regex per matching here https://regexr.com/662ov.
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **malicious_powershell_process_-_encoded_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
index 02fb93e350..b4a40a14d5 100644
--- a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
+++ b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
@@ -106,8 +106,8 @@ This analytic detects a suspicious process making a DNS query via known, abused
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **suspicious_process_dns_query_known_abuse_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
index 57a706f4f6..1ce9a54f4f 100644
--- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
+++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
@@ -119,8 +119,8 @@ The following analytic identifies native .net binaries within the Windows operat
 #### Macros
 The SPL above uses the following Macros:
 * [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_dotnet_binary_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
index 921bf0c555..14da8b3f81 100644
--- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
+++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
@@ -118,8 +118,8 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro
 #### Macros
 The SPL above uses the following Macros:
 * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_installutil_in_non_standard_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
index 837ffae589..f0282edf5f 100644
--- a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
+++ b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
@@ -108,8 +108,8 @@ This analytic will identify excessive file deletion events in the Windows Defend
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **excessive_file_deletion_in_windefender_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md
index 343ee79b70..24d910afbf 100644
--- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md
+++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md
@@ -115,9 +115,9 @@ This analytic will identify the possible execution of ping sleep batch commands.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **ping_sleep_batch_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md
index 3abf7bcc8b..63f965312e 100644
--- a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md
+++ b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md
@@ -102,8 +102,8 @@ The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe ha
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_nirsoft_advancedrun_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
index 5784a8b047..5a80b1df2e 100644
--- a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
+++ b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
@@ -103,9 +103,9 @@ The following hunting analytic assists with identifying the proces execution of
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [is_nirsoft_software](https://github.com/splunk/security_content/blob/develop/macros/is_nirsoft_software.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_nirsoft_utilities_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md
index 03327806bb..47944116d0 100644
--- a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md
+++ b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md
@@ -130,6 +130,7 @@ unknown
 #### Associated Analytic story
 * [Ransomware](/stories/ransomware)
 * [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md
index e8ecd64163..8e3dd93cfa 100644
--- a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md
+++ b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md
@@ -136,6 +136,7 @@ admin or user may choose to disable windows defender product
 #### Associated Analytic story
 * [IceID](/stories/iceid)
 * [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md
index 613b45ea6c..ec0d139879 100644
--- a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md
+++ b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md
@@ -136,6 +136,7 @@ user may choose to disable windows defender AV
 #### Associated Analytic story
 * [IceID](/stories/iceid)
 * [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md
index 071f89f0f7..ff8afa4d65 100644
--- a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md
+++ b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md
@@ -136,6 +136,7 @@ admin or user may choose to disable windows defender product
 #### Associated Analytic story
 * [IceID](/stories/iceid)
 * [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md
index 153296ecd2..d47dc7e78d 100644
--- a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md
+++ b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md
@@ -25,7 +25,7 @@ tags:
 
 #### Description
 
-his analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
+This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis..
 
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
@@ -136,6 +136,7 @@ admin or user may choose to disable windows defender product
 #### Associated Analytic story
 * [IceID](/stories/iceid)
 * [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md
index 172fb5e898..26e45f6eac 100644
--- a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md
+++ b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md
@@ -121,8 +121,8 @@ This correlation find exploitation of Log4Shell CVE-2021-44228 against systems u
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **log4shell_cve-2021-44228_exploitation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md
index cd12971e34..802f961654 100644
--- a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md
+++ b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md
@@ -150,6 +150,7 @@ There are many legitimate applications that must execute on system startup and w
 * [IcedID](/stories/icedid)
 * [Remcos](/stories/remcos)
 * [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2022-01-27-disable_show_hidden_files.md b/docs/_posts/2022-01-27-disable_show_hidden_files.md
index 1fbb625a27..cdd4147341 100644
--- a/docs/_posts/2022-01-27-disable_show_hidden_files.md
+++ b/docs/_posts/2022-01-27-disable_show_hidden_files.md
@@ -145,6 +145,7 @@ unknown
 #### Associated Analytic story
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
 * [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md
index 97b4f403b9..607d2f65a0 100644
--- a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md
+++ b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md
@@ -137,6 +137,7 @@ admin or user may choose to disable this windows features.
 * [Ransomware](/stories/ransomware)
 * [Revil Ransomware](/stories/revil_ransomware)
 * [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
index 7799ba7e41..e89c702ca3 100644
--- a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
+++ b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
@@ -113,8 +113,8 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll.
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **windows_possible_credential_dumping_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
index afa35b8952..e9e34612d3 100644
--- a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
+++ b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
@@ -134,6 +134,7 @@ Unknown. Filter as needed.
 #### Associated Analytic story
 * [XMRig](/stories/xmrig)
 * [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md
index 73f2bb9494..b4d42dcb83 100644
--- a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md
+++ b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md
@@ -108,8 +108,8 @@ The following analytic identifies `pkexec` spawning with no command-line argumen
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_pkexec_privilege_escalation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md
index 373aab455c..ea2831e11f 100644
--- a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md
+++ b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md
@@ -109,8 +109,8 @@ The following analytic looks for the use of Mimikatz command line parameters lev
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **mimikatz_passtheticket_commandline_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md
index 4d24a25666..b5218c8b77 100644
--- a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md
+++ b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md
@@ -124,8 +124,8 @@ Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily ad
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **rubeus_command_line_parameters_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
index 40fc976731..f84dbd4d80 100644
--- a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
+++ b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
@@ -102,9 +102,9 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **certutil_download_with_urlcache_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
index 3ee1db0a58..b4a4ddd812 100644
--- a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
+++ b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
@@ -102,9 +102,9 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **certutil_download_with_verifyctl_and_split_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md
index aceafc0290..16040e64ed 100644
--- a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md
+++ b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md
@@ -108,8 +108,8 @@ The following analytic looks for a process accessing the winlogon.exe system pro
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **rubeus_kerberos_ticket_exports_through_winlogon_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md
index e5645065c1..250e164d6a 100644
--- a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md
+++ b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md
@@ -103,9 +103,9 @@ The following analytic identifies the use of Microsoft Remote Assistance, msra.e
 
 #### Macros
 The SPL above uses the following Macros:
+* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml)
 
 > :information_source:
 > **windows_remote_assistance_spawning_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
index 5f804c74bc..7722585244 100644
--- a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
+++ b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
@@ -111,9 +111,9 @@ The following analytic identifies Schtasks.exe creating a new task to start and
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_schtasks_create_run_as_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
index 7722a45d94..64239bc1a7 100644
--- a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
+++ b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
@@ -114,8 +114,8 @@ The following analytic identifies rundll32.exe loading an export function by ord
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **rundll_loading_dll_by_ordinal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md
index b8aee83d87..8dacc63d10 100644
--- a/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md
+++ b/docs/_posts/2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md
@@ -110,8 +110,8 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **kerberoasting_spn_request_with_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md
index f986444057..0cfb7e786f 100644
--- a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md
+++ b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md
@@ -108,8 +108,8 @@ This analytic is to look for dd command to overwrite file. This technique was ab
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_dd_file_overwrite_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md
index e5923bbaac..1ca1eaee9e 100644
--- a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md
+++ b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md
@@ -106,9 +106,9 @@ DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_diskshadow_proxy_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md
index c3e0bf98fc..e3ba39dbbc 100644
--- a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md
+++ b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md
@@ -114,8 +114,8 @@ The following analytic identifies the Windows Windows Remote Auto Dialer, rasaut
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_rasautou_dll_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md
index 12bd46fc7a..39f2b80d72 100644
--- a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md
+++ b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md
@@ -112,8 +112,8 @@ This analytic is to look for suspicious raw access read to drive where the maste
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **windows_raw_access_to_master_boot_record_drive_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md
index b8e76acd2d..51d1e73d56 100644
--- a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md
+++ b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md
@@ -111,8 +111,8 @@ The following analytic identifies regasm.exe with a network connection to a publ
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **detect_regasm_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md
index 6c6367c37c..663285a202 100644
--- a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md
+++ b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md
@@ -111,8 +111,8 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **detect_regsvcs_with_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md
index 4ee6ea7a4a..1cf612c716 100644
--- a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md
+++ b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md
@@ -109,8 +109,8 @@ This search is to detect modification of registry to bypass UAC windows feature.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **net_profiler_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md
index a68784e06b..1e3d6d93d3 100644
--- a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md
+++ b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md
@@ -103,8 +103,8 @@ This detection is to identify a suspicious process that tries to delete the proc
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **process_deleting_its_process_file_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-18-rundll32_dnsquery.md b/docs/_posts/2022-02-18-rundll32_dnsquery.md
index d2f3c5bda6..75b9319c65 100644
--- a/docs/_posts/2022-02-18-rundll32_dnsquery.md
+++ b/docs/_posts/2022-02-18-rundll32_dnsquery.md
@@ -106,8 +106,8 @@ This search is to detect a suspicious rundll32.exe process having a http connect
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **rundll32_dnsquery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
index f9ccc2a3bb..13c28723df 100644
--- a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
+++ b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
@@ -113,8 +113,8 @@ Monitor for changes of the ExecutionPolicy in the registry to the values "unrest
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md
index fd63b65fa0..6ac4eef9b9 100644
--- a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md
+++ b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md
@@ -115,8 +115,8 @@ The following analytic identifies the creation or deletion of a scheduled task u
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **scheduled_task_deleted_or_created_via_cmd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -142,6 +142,7 @@ It is possible scripts or administrators may trigger this analytic. Filter as ne
 * [NOBELIUM Group](/stories/nobelium_group)
 * [Windows Persistence Techniques](/stories/windows_persistence_techniques)
 * [Living Off The Land](/stories/living_off_the_land)
+* [Azorult](/stories/azorult)
 
 
 
diff --git a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md
index eaff2cd6b9..96eedbf53b 100644
--- a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md
+++ b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md
@@ -109,8 +109,8 @@ This analytic is to look for wmi commandlines to execute or create process. This
 #### Macros
 The SPL above uses the following Macros:
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_wmi_process_call_create_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md
index ac188f0ae5..e336a11827 100644
--- a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md
+++ b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md
@@ -109,8 +109,8 @@ This analytic is to look for process commandline that contains named pipe. This
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_process_with_namedpipe_commandline_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-24-detect_empire_with_powershell_script_block_logging.md b/docs/_posts/2022-02-24-detect_empire_with_powershell_script_block_logging.md
new file mode 100644
index 0000000000..489425ca79
--- /dev/null
+++ b/docs/_posts/2022-02-24-detect_empire_with_powershell_script_block_logging.md
@@ -0,0 +1,168 @@
+---
+title: "Detect Empire with PowerShell Script Block Logging"
+excerpt: "Command and Scripting Interpreter
+, PowerShell
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-24
+toc: true
+toc_label: ""
+tags:
+  - Command and Scripting Interpreter
+  - PowerShell
+  - Execution
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \
+This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-02-24
+- **Author**: Michael Haag, Splunk
+- **ID**: bc1dc6b8-c954-11eb-bade-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104  (ScriptBlockText=*system.net.webclient* AND ScriptBlockText=*frombase64string*) 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `detect_empire_with_powershell_script_block_logging_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **detect_empire_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+False positives may only pertain to it not being related to Empire, but another framework. Filter as needed if any applications use the same pattern.
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 81.0 | 90 | 90 | The following behavior was identified and typically related to PowerShell-Empire on $Computer$ by $UserID$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+* [https://github.com/BC-SECURITY/Empire](https://github.com/BC-SECURITY/Empire)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/empire.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/empire.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-24-detect_mimikatz_with_powershell_script_block_logging.md b/docs/_posts/2022-02-24-detect_mimikatz_with_powershell_script_block_logging.md
new file mode 100644
index 0000000000..e4b8cd9522
--- /dev/null
+++ b/docs/_posts/2022-02-24-detect_mimikatz_with_powershell_script_block_logging.md
@@ -0,0 +1,167 @@
+---
+title: "Detect Mimikatz With PowerShell Script Block Logging"
+excerpt: "OS Credential Dumping
+, PowerShell
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-24
+toc: true
+toc_label: ""
+tags:
+  - OS Credential Dumping
+  - PowerShell
+  - Credential Access
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+This analytic identifies common Mimikatz functions that may be identified in the script block, including `mimikatz`. This will catch the most basic use cases for Pass the Ticket, Pass the Hash and `-DumprCreds`. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-02-24
+- **Author**: Michael Haag, Splunk
+- **ID**: 8148c29c-c952-11eb-9255-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*, *kerberos::ptt*, *kerberos::golden*) 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `detect_mimikatz_with_powershell_script_block_logging_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **detect_mimikatz_with_powershell_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+False positives should be limited as the commands being identifies are quite specific to EventCode 4104 and Mimikatz. Filter as needed.
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 90.0 | 90 | 100 | The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $Computer$ by $UserID$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-24-get-foresttrust_with_powershell_script_block.md b/docs/_posts/2022-02-24-get-foresttrust_with_powershell_script_block.md
new file mode 100644
index 0000000000..5182816179
--- /dev/null
+++ b/docs/_posts/2022-02-24-get-foresttrust_with_powershell_script_block.md
@@ -0,0 +1,164 @@
+---
+title: "Get-ForestTrust with PowerShell Script Block"
+excerpt: "Domain Trust Discovery
+, PowerShell
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-24
+toc: true
+toc_label: ""
+tags:
+  - Domain Trust Discovery
+  - PowerShell
+  - Discovery
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \
+This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-02-24
+- **Author**: Michael Haag, Splunk
+- **ID**: 70fac80e-0bf1-11ec-9ba0-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText = "*get-foresttrust*" 
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `get_foresttrust_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **get-foresttrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* EventCode
+* ScriptBlockText
+* Path
+* Opcode
+* Computer
+* UserID
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+False positives may be present. Tune as needed.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 12.0 | 30 | 40 | Suspicious PowerShell Get-ForestTrust was identified on endpoint $Computer$ by user $UserID$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/](https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell-xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell-xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-25-powershell_domain_enumeration.md b/docs/_posts/2022-02-25-powershell_domain_enumeration.md
new file mode 100644
index 0000000000..3013b00e9f
--- /dev/null
+++ b/docs/_posts/2022-02-25-powershell_domain_enumeration.md
@@ -0,0 +1,167 @@
+---
+title: "PowerShell Domain Enumeration"
+excerpt: "Command and Scripting Interpreter
+, PowerShell
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-25
+toc: true
+toc_label: ""
+tags:
+  - Command and Scripting Interpreter
+  - PowerShell
+  - Execution
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \
+This analytic identifies specific PowerShell modules typically used to enumerate an organizations domain or users. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-02-25
+- **Author**: Michael Haag, Splunk
+- **ID**: e1866ce2-ca22-11eb-8e44-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText IN (*get-netdomaintrust*, *get-netforesttrust*, *get-addomain*, *get-adgroupmember*, *get-domainuser*) 
+| stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `powershell_domain_enumeration_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **powershell_domain_enumeration_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+It is possible there will be false positives, filter as needed.
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 42.0 | 60 | 70 | A suspicious powershell script contains domain enumeration command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_domain_enumeration.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-25-powershell_enable_smb1protocol_feature.md b/docs/_posts/2022-02-25-powershell_enable_smb1protocol_feature.md
new file mode 100644
index 0000000000..05dd1e46ee
--- /dev/null
+++ b/docs/_posts/2022-02-25-powershell_enable_smb1protocol_feature.md
@@ -0,0 +1,163 @@
+---
+title: "Powershell Enable SMB1Protocol Feature"
+excerpt: "Obfuscated Files or Information
+, Indicator Removal from Tools
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-25
+toc: true
+toc_label: ""
+tags:
+  - Obfuscated Files or Information
+  - Indicator Removal from Tools
+  - Defense Evasion
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the compromise network system.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-02-25
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: afed80b2-d34b-11eb-a952-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion |
+
+| [T1027.005](https://attack.mitre.org/techniques/T1027/005/) | Indicator Removal from Tools | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText = "*Enable-WindowsOptionalFeature*" ScriptBlockText = "*SMB1Protocol*" 
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `powershell_enable_smb1protocol_feature_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **powershell_enable_smb1protocol_feature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* EventCode
+* ScriptBlockText
+* Computer
+* UserID
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
+
+#### Known False Positives
+network operator may enable or disable this windows feature.
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+* [Ransomware](/stories/ransomware)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 25.0 | 50 | 50 | Powershell Enable SMB1Protocol Feature |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/](https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_enable_smb1protocol_feature.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-25-powershell_fileless_process_injection_via_getprocaddress.md b/docs/_posts/2022-02-25-powershell_fileless_process_injection_via_getprocaddress.md
new file mode 100644
index 0000000000..161f350dd4
--- /dev/null
+++ b/docs/_posts/2022-02-25-powershell_fileless_process_injection_via_getprocaddress.md
@@ -0,0 +1,174 @@
+---
+title: "Powershell Fileless Process Injection via GetProcAddress"
+excerpt: "Command and Scripting Interpreter
+, Process Injection
+, PowerShell
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-25
+toc: true
+toc_label: ""
+tags:
+  - Command and Scripting Interpreter
+  - Process Injection
+  - PowerShell
+  - Execution
+  - Defense Evasion
+  - Privilege Escalation
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+This analytic identifies `GetProcAddress` in the script block. This is not normal to be used by most PowerShell scripts and is typically unsafe/malicious. Many attack toolkits use GetProcAddress to obtain code execution. \
+In use, `$var_gpa = $var_unsafe_native_methods.GetMethod(GetProcAddress` and later referenced/executed elsewhere. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-02-25
+- **Author**: Michael Haag, Splunk
+- **ID**: a26d9db4-c883-11eb-9d75-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+| [T1055](https://attack.mitre.org/techniques/T1055/) | Process Injection | Defense Evasion, Privilege Escalation |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText=*getprocaddress* 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `powershell_fileless_process_injection_via_getprocaddress_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **powershell_fileless_process_injection_via_getprocaddress_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Limited false positives. Filter as needed.
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 48.0 | 60 | 80 | A suspicious powershell script contains GetProcAddress API in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-25-powershell_processing_stream_of_data.md b/docs/_posts/2022-02-25-powershell_processing_stream_of_data.md
new file mode 100644
index 0000000000..f037eba0bd
--- /dev/null
+++ b/docs/_posts/2022-02-25-powershell_processing_stream_of_data.md
@@ -0,0 +1,166 @@
+---
+title: "Powershell Processing Stream Of Data"
+excerpt: "Command and Scripting Interpreter
+, PowerShell
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-25
+toc: true
+toc_label: ""
+tags:
+  - Command and Scripting Interpreter
+  - PowerShell
+  - Execution
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is processing compressed stream data. This is typically found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files that are stream flattened and will be deflated durnig execution. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-02-25
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 0d718b52-c9f1-11eb-bc61-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText = "*IO.Compression.*" OR ScriptBlockText = "*IO.StreamReader*" OR ScriptBlockText = "*]::Decompress*" 
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `powershell_processing_stream_of_data_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **powershell_processing_stream_of_data_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* EventCode
+* ScriptBlockText
+* Computer
+* UserID
+* Score
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+powershell may used this function to process compressed data.
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 40.0 | 50 | 80 | A suspicious powershell script contains stream command in $ScriptBlockText$ commonly for processing compressed or to decompressed binary file with EventCode $EventCode$ in host $Computer$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9](https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9)
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/streamreader.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/streamreader.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_processing_stream_of_data.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-25-recon_using_wmi_class.md b/docs/_posts/2022-02-25-recon_using_wmi_class.md
new file mode 100644
index 0000000000..42740bd3da
--- /dev/null
+++ b/docs/_posts/2022-02-25-recon_using_wmi_class.md
@@ -0,0 +1,167 @@
+---
+title: "Recon Using WMI Class"
+excerpt: "Gather Victim Host Information
+, PowerShell
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-25
+toc: true
+toc_label: ""
+tags:
+  - Gather Victim Host Information
+  - PowerShell
+  - Reconnaissance
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies suspicious PowerShell via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found where the adversary will identify services and system information on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-02-25
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 018c1972-ca07-11eb-9473-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 (ScriptBlockText= "*SELECT*" OR ScriptBlockText= "*Get-WmiObject*") AND (ScriptBlockText= "*Win32_Bios*" OR ScriptBlockText= "*Win32_OperatingSystem*" OR ScriptBlockText= "*Win32_Processor*" OR ScriptBlockText= "*Win32_ComputerSystem*" OR ScriptBlockText= "*Win32_ComputerSystemProduct*" OR ScriptBlockText= "*Win32_ShadowCopy*") 
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `recon_using_wmi_class_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **recon_using_wmi_class_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* EventCode
+* ScriptBlockText
+* Computer
+* UserID
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+network administrator may used this command for checking purposes
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+* [Industroyer2](/stories/industroyer2)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 60.0 | 75 | 80 | A suspicious powershell script contains host recon command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/](https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/)
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+* [https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/](https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/recon_using_wmi_class.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md
index 87dfcd6ea1..7c5c0a2b02 100644
--- a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md
+++ b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md
@@ -114,8 +114,8 @@ This analytic is to look for suspicious file creation in the critical folder lik
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_file_without_extension_in_critical_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md
index 539abbfa7f..8585a4f9e0 100644
--- a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md
+++ b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md
@@ -112,8 +112,8 @@ This analytic is to look for suspicious raw access read to device disk partition
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **windows_raw_access_to_disk_volume_partition_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-02-26-serviceprincipalnames_discovery_with_powershell.md b/docs/_posts/2022-02-26-serviceprincipalnames_discovery_with_powershell.md
new file mode 100644
index 0000000000..765203e484
--- /dev/null
+++ b/docs/_posts/2022-02-26-serviceprincipalnames_discovery_with_powershell.md
@@ -0,0 +1,174 @@
+---
+title: "ServicePrincipalNames Discovery with PowerShell"
+excerpt: "Kerberoasting
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-02-26
+toc: true
+toc_label: ""
+tags:
+  - Kerberoasting
+  - Credential Access
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies `powershell.exe` usage, using Script Block Logging EventCode 4104, related to querying the domain for Service Principle Names. typically, this is a precursor activity related to kerberoasting or the silver ticket attack. \
+What is a ServicePrincipleName? \
+A service principal name (SPN) is a unique identifier of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account. This allows a client application to request that the service authenticate an account even if the client does not have the account name.\
+The following analytic identifies the use of KerberosRequestorSecurityToken class within the script block. Using .NET System.IdentityModel.Tokens.KerberosRequestorSecurityToken class in PowerShell is the equivelant of using setspn.exe. \
+During triage, review parallel processes for further suspicious activity.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-02-26
+- **Author**: Michael Haag, Splunk
+- **ID**: 13243068-2d38-11ec-8908-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1558.003](https://attack.mitre.org/techniques/T1558/003/) | Kerberoasting | Credential Access |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText="*KerberosRequestorSecurityToken*" 
+| stats count min(_time) as firstTime max(_time) as lastTime by ScriptBlockText Opcode Computer UserID EventCode 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `serviceprincipalnames_discovery_with_powershell_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **serviceprincipalnames_discovery_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+False positives should be limited, however filter as needed.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $Computer$ by user $UserID$ attempting to identify service principle names. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names](https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names)
+* [https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8](https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8)
+* [https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting](https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting)
+* [https://strontic.github.io/xcyclopedia/library/setspn.exe-5C184D581524245DAD7A0A02B51FD2C2.html](https://strontic.github.io/xcyclopedia/library/setspn.exe-5C184D581524245DAD7A0A02B51FD2C2.html)
+* [https://attack.mitre.org/techniques/T1558/003/](https://attack.mitre.org/techniques/T1558/003/)
+* [https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spn-setspn-syntax.aspx](https://social.technet.microsoft.com/wiki/contents/articles/717.service-principal-names-spn-setspn-syntax.aspx)
+* [https://web.archive.org/web/20220212163642/https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/](https://web.archive.org/web/20220212163642/https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/)
+* [https://blog.zsec.uk/paving-2-da-wholeset/](https://blog.zsec.uk/paving-2-da-wholeset/)
+* [https://msitpros.com/?p=3113](https://msitpros.com/?p=3113)
+* [https://adsecurity.org/?p=3466](https://adsecurity.org/?p=3466)
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-powershell_kerberos.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-powershell_kerberos.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md
index 574b009b8e..74b80bc8eb 100644
--- a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md
+++ b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md
@@ -103,8 +103,8 @@ This analytic will identify suspicious series of process executions.  We have ob
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **excessive_distinct_processes_from_windows_temp_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-03-aws_createaccesskey.md b/docs/_posts/2022-03-03-aws_createaccesskey.md
index 9e1ff21eae..bad265d09a 100644
--- a/docs/_posts/2022-03-03-aws_createaccesskey.md
+++ b/docs/_posts/2022-03-03-aws_createaccesskey.md
@@ -113,8 +113,8 @@ This search looks for AWS CloudTrail events where a user A who has already permi
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_createaccesskey_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-03-aws_updateloginprofile.md b/docs/_posts/2022-03-03-aws_updateloginprofile.md
index 696c5ea753..8b8bb3f691 100644
--- a/docs/_posts/2022-03-03-aws_updateloginprofile.md
+++ b/docs/_posts/2022-03-03-aws_updateloginprofile.md
@@ -113,8 +113,8 @@ This search looks for AWS CloudTrail events where a user A who has already permi
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_updateloginprofile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-08-suspicious_msbuild_path.md b/docs/_posts/2022-03-08-suspicious_msbuild_path.md
index cdc1d04670..f3a0b01783 100644
--- a/docs/_posts/2022-03-08-suspicious_msbuild_path.md
+++ b/docs/_posts/2022-03-08-suspicious_msbuild_path.md
@@ -123,8 +123,8 @@ The following analytic identifies msbuild.exe executing from a non-standard path
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_msbuild_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md b/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md
index f693985285..ccc0b8dbdc 100644
--- a/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md
+++ b/docs/_posts/2022-03-09-unknown_process_using_the_kerberos_protocol.md
@@ -108,8 +108,8 @@ The following analytic identifies a process performing an outbound connection on
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **unknown_process_using_the_kerberos_protocol_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md
index a34980db99..166aa0dead 100644
--- a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md
@@ -113,9 +113,9 @@ The following analytic identifies regasm.exe with no command line arguments. Thi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_regasm_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md
index 7451a3e1bf..2a33a397b7 100644
--- a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md
@@ -113,9 +113,9 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_regsvcs_with_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md
index 34da063428..ada2c79c91 100644
--- a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md
@@ -109,8 +109,8 @@ The following analytic identifies DLLHost.exe with no command line arguments wit
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **dllhost_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md
index 4be64bf6d4..c518f1efca 100644
--- a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md
@@ -109,8 +109,8 @@ The following analytic identifies gpupdate.exe with no command line arguments an
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **gpupdate_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md b/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md
index 54d27c0615..2b4295dc4f 100644
--- a/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md
+++ b/docs/_posts/2022-03-15-kerberos_service_ticket_request_using_rc4_encryption.md
@@ -105,8 +105,8 @@ The following analytic leverages Kerberos Event 4769, A Kerberos service ticket
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **kerberos_service_ticket_request_using_rc4_encryption_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md
index 7d5b5c81d6..d7c1351544 100644
--- a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md
@@ -119,8 +119,8 @@ The following analytic identifies rundll32.exe with no command line arguments an
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **rundll32_with_no_command_line_arguments_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md
index e7b0675784..04a239f788 100644
--- a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md
+++ b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md
@@ -109,8 +109,8 @@ The following analytic identifies searchprotocolhost.exe with no command line ar
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **searchprotocolhost_with_no_command_line_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md
index 38499707fa..1e1a15cdee 100644
--- a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md
@@ -104,9 +104,9 @@ The following analytic identifies DLLHost.exe with no command line arguments. It
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_dllhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md
index b0cb0b9aa5..2f48fe3ae8 100644
--- a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md
@@ -104,9 +104,9 @@ The following analytic identifies gpupdate.exe with no command line arguments. I
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **suspicious_gpupdate_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md
index 330e87fee4..7df417a8ed 100644
--- a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md
@@ -119,8 +119,8 @@ The following analytic identifies rundll32.exe with no command line arguments. I
 #### Macros
 The SPL above uses the following Macros:
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_rundll32_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md
index 7ae0f68c7e..38bf86e1be 100644
--- a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md
@@ -104,8 +104,8 @@ The following analytic identifies searchprotocolhost.exe with no command line ar
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_searchprotocolhost_no_command_line_arguments_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md
index 02546a0eed..f012129af1 100644
--- a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md
+++ b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md
@@ -116,8 +116,8 @@ During triage review resulting network connections, file modifications, and para
 #### Macros
 The SPL above uses the following Macros:
 * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_installutil_remote_network_connection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md
index 4eba7529a2..5204d6ee21 100644
--- a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md
+++ b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md
@@ -117,8 +117,8 @@ During triage review resulting network connections, file modifications, and para
 #### Macros
 The SPL above uses the following Macros:
 * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_installutil_uninstall_option_with_network_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md b/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md
index 68b0b97869..248502084b 100644
--- a/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md
+++ b/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md
@@ -102,8 +102,8 @@ This analytic identifies suspicious modification of ACL permission to a files or
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **modify_acl_permission_to_files_or_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md b/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md
index fce94f7e8c..daf52c2a5f 100644
--- a/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md
+++ b/docs/_posts/2022-03-22-getlocaluser_with_powershell_script_block.md
@@ -2,6 +2,7 @@
 title: "GetLocalUser with PowerShell Script Block"
 excerpt: "Account Discovery
 , Local Account
+, PowerShell
 "
 categories:
   - Endpoint
@@ -11,8 +12,10 @@ toc_label: ""
 tags:
   - Account Discovery
   - Local Account
+  - PowerShell
   - Discovery
   - Discovery
+  - Execution
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
@@ -48,6 +51,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
 
 | [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery |
 
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
 </div>
 </details>
 
@@ -113,6 +118,10 @@ The SPL above uses the following Macros:
 
 #### Required field
 * _time
+* EventCode
+* ScriptBlockText
+* Computer
+* UserID
 
 
 #### How To Implement
@@ -123,6 +132,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
 
 #### Associated Analytic story
 * [Active Directory Discovery](/stories/active_directory_discovery)
+* [Malicious PowerShell](/stories/malicious_powershell)
 
 
 
@@ -131,7 +141,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
 
 | Risk Score  | Impact      | Confidence   | Message      |
 | ----------- | ----------- |--------------|--------------|
-| 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ |
+| 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $Computer$ by $user$ |
 
 
 > :information_source:
@@ -140,6 +150,7 @@ Administrators or power users may use this PowerShell commandlet for troubleshoo
 #### Reference
 
 * [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
 
 
 
diff --git a/docs/_posts/2022-03-22-powershell_execute_com_object.md b/docs/_posts/2022-03-22-powershell_execute_com_object.md
index 18ed9ef03a..d817299c3a 100644
--- a/docs/_posts/2022-03-22-powershell_execute_com_object.md
+++ b/docs/_posts/2022-03-22-powershell_execute_com_object.md
@@ -2,6 +2,7 @@
 title: "Powershell Execute COM Object"
 excerpt: "Component Object Model Hijacking
 , Event Triggered Execution
+, PowerShell
 "
 categories:
   - Endpoint
@@ -11,10 +12,12 @@ toc_label: ""
 tags:
   - Component Object Model Hijacking
   - Event Triggered Execution
+  - PowerShell
   - Persistence
   - Privilege Escalation
   - Persistence
   - Privilege Escalation
+  - Execution
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
@@ -51,6 +54,8 @@ This search is to detect a COM CLSID execution through powershell. This techniqu
 
 | [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation |
 
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
 </div>
 </details>
 
@@ -116,6 +121,9 @@ The SPL above uses the following Macros:
 
 #### Required field
 * _time
+* ScriptBlockText
+* Computer
+* EventCode
 
 
 #### How To Implement
@@ -136,7 +144,7 @@ network operrator may use this command.
 
 | Risk Score  | Impact      | Confidence   | Message      |
 | ----------- | ----------- |--------------|--------------|
-| 5.0 | 10 | 50 | A suspicious powershell script contains COM CLSID command in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
+| 5.0 | 10 | 50 | A suspicious powershell script contains COM CLSID command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ |
 
 
 > :information_source:
@@ -145,6 +153,7 @@ network operrator may use this command.
 #### Reference
 
 * [https://threadreaderapp.com/thread/1423361119926816776.html](https://threadreaderapp.com/thread/1423361119926816776.html)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
 
 
 
@@ -154,7 +163,6 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 * [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/pwh_com_object/windows-powershell-xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.015/pwh_com_object/windows-powershell-xml.log)
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-powershell.log)
 
 
 
diff --git a/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md b/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md
index b800532061..32b10e6e0d 100644
--- a/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md
+++ b/docs/_posts/2022-03-22-powershell_using_memory_as_backing_store.md
@@ -114,9 +114,9 @@ The SPL above uses the following Macros:
 #### Required field
 * _time
 * EventCode
-* Message
-* ComputerName
-* User
+* ScriptBlockText
+* Computer
+* UserID
 
 
 #### How To Implement
@@ -136,7 +136,7 @@ powershell may used this function to store out object into memory.
 
 | Risk Score  | Impact      | Confidence   | Message      |
 | ----------- | ----------- |--------------|--------------|
-| 40.0 | 50 | 80 | A suspicious powershell script contains memorystream command in $Message$ as new object backstore with EventCode $EventCode$ in host $ComputerName$ |
+| 40.0 | 50 | 80 | A suspicious powershell script contains memorystream command in $ScriptBlockText$ as new object backstore with EventCode $EventCode$ in host $Computer$ |
 
 
 > :information_source:
diff --git a/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md b/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md
index 41ca8c1dbb..c9a09b279a 100644
--- a/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md
+++ b/docs/_posts/2022-03-22-recon_avproduct_through_pwh_or_wmi.md
@@ -109,9 +109,9 @@ The SPL above uses the following Macros:
 #### Required field
 * _time
 * EventCode
-* Message
-* ComputerName
-* User
+* ScriptBlockText
+* Computer
+* UserID
 
 
 #### How To Implement
@@ -132,7 +132,7 @@ network administrator may used this command for checking purposes
 
 | Risk Score  | Impact      | Confidence   | Message      |
 | ----------- | ----------- |--------------|--------------|
-| 56.0 | 70 | 80 | A suspicious powershell script contains AV recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
+| 56.0 | 70 | 80 | A suspicious powershell script contains AV recon command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ |
 
 
 > :information_source:
@@ -145,6 +145,7 @@ network administrator may used this command for checking purposes
 * [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
 * [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
 * [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
 
 
 
@@ -154,7 +155,6 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 * [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1592/pwh_av_recon/windows-powershell-xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1592/pwh_av_recon/windows-powershell-xml.log)
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log)
 
 
 
diff --git a/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md b/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md
index e285770d5e..9aff5320c5 100644
--- a/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md
+++ b/docs/_posts/2022-03-22-remote_process_instantiation_via_winrm_and_powershell_script_block.md
@@ -113,10 +113,11 @@ The SPL above uses the following Macros:
 
 #### Required field
 * _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
 * EventCode
-* Message
-* ComputerName
-* User
 
 
 #### How To Implement
@@ -135,7 +136,7 @@ Administrators may leverage WinRM and `Invoke-Command` to start a process on rem
 
 | Risk Score  | Impact      | Confidence   | Message      |
 | ----------- | ----------- |--------------|--------------|
-| 45.0 | 90 | 50 | A process was started on a remote endpoint from $ComputerName by abusing WinRM using PowerShell.exe |
+| 45.0 | 90 | 50 | A process was started on a remote endpoint from $Computer$ by abusing WinRM using PowerShell.exe |
 
 
 > :information_source:
diff --git a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md
index 42ee8d7ce7..424eff1d3a 100644
--- a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md
+++ b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md
@@ -111,8 +111,8 @@ This analytic is to detect a suspicious process terminating Lsass process. Lsass
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **windows_terminating_lsass_process_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md b/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md
index 9ae2aae28d..d6a31df127 100644
--- a/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md
+++ b/docs/_posts/2022-03-29-windows_iso_lnk_file_creation.md
@@ -123,8 +123,8 @@ The following analytic identifies the use of a delivered ISO file that has been
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_iso_lnk_file_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md
index c503983391..f5be1cf051 100644
--- a/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md
+++ b/docs/_posts/2022-03-30-windows_drivers_loaded_by_signature.md
@@ -112,8 +112,8 @@ The following analytic assists with viewing all drivers being loaded by using Sy
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **windows_drivers_loaded_by_signature_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-02-getnettcpconnection_with_powershell_script_block.md b/docs/_posts/2022-04-02-getnettcpconnection_with_powershell_script_block.md
new file mode 100644
index 0000000000..5057a097e8
--- /dev/null
+++ b/docs/_posts/2022-04-02-getnettcpconnection_with_powershell_script_block.md
@@ -0,0 +1,155 @@
+---
+title: "GetNetTcpconnection with PowerShell Script Block"
+excerpt: "System Network Connections Discovery
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-04-02
+toc: true
+toc_label: ""
+tags:
+  - System Network Connections Discovery
+  - Discovery
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-NetTcpconnection ` commandlet. This commandlet is used to return a listing of network connections on a compromised system. Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-04-02
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 091712ff-b02a-4d43-82ed-34765515d95d
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1049](https://attack.mitre.org/techniques/T1049/) | System Network Connections Discovery | Discovery |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 (ScriptBlockText = "*Get-NetTcpconnection*") 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `getnettcpconnection_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **getnettcpconnection_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use this PowerShell commandlet for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | Network Connection discovery on $Computer$ by $user$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1049/](https://attack.mitre.org/techniques/T1049/)
+* [https://docs.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection?view=windowsserver2019-ps](https://docs.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection?view=windowsserver2019-ps)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/nettcpconnection.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/nettcpconnection.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md
index 008e97ef0a..cb85c01f90 100644
--- a/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md
+++ b/docs/_posts/2022-04-04-github_actions_disable_security_workflow.md
@@ -113,8 +113,8 @@ This search detects a disabled security workflow in GitHub Actions. An attacker
 
 #### Macros
 The SPL above uses the following Macros:
-* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
 
 > :information_source:
 > **github_actions_disable_security_workflow_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md b/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md
index 16035560b4..20a44c84b6 100644
--- a/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md
+++ b/docs/_posts/2022-04-05-linux_stdout_redirection_to_dev_null_file.md
@@ -115,8 +115,8 @@ This analytic looks for suspicious commandline that redirect the stdout or possi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_stdout_redirection_to_dev_null_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md
index acd9989556..0393e4c84c 100644
--- a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md
+++ b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_forfiles.md
@@ -107,8 +107,8 @@ The following analytic detects programs that have been started by forfiles.exe.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_indirect_command_execution_via_forfiles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md
index f7e1be5907..89de9e7418 100644
--- a/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md
+++ b/docs/_posts/2022-04-05-windows_indirect_command_execution_via_pcalua.md
@@ -107,8 +107,8 @@ The following analytic detects programs that have been started by pcalua.exe. pc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_indirect_command_execution_via_pcalua_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-07-any_powershell_downloadfile.md b/docs/_posts/2022-04-07-any_powershell_downloadfile.md
index 47abcf6072..30bbaab9f1 100644
--- a/docs/_posts/2022-04-07-any_powershell_downloadfile.md
+++ b/docs/_posts/2022-04-07-any_powershell_downloadfile.md
@@ -117,9 +117,9 @@ The following analytic identifies the use of PowerShell downloading a file using
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **any_powershell_downloadfile_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-07-any_powershell_downloadstring.md b/docs/_posts/2022-04-07-any_powershell_downloadstring.md
index b104cf8b1f..c2f2d33779 100644
--- a/docs/_posts/2022-04-07-any_powershell_downloadstring.md
+++ b/docs/_posts/2022-04-07-any_powershell_downloadstring.md
@@ -112,9 +112,9 @@ The following analytic identifies the use of PowerShell downloading a file using
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 > :information_source:
 > **any_powershell_downloadstring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-07-detect_html_help_renamed.md b/docs/_posts/2022-04-07-detect_html_help_renamed.md
index 2c83977abd..6acb966621 100644
--- a/docs/_posts/2022-04-07-detect_html_help_renamed.md
+++ b/docs/_posts/2022-04-07-detect_html_help_renamed.md
@@ -112,8 +112,8 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_html_help_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-07-detect_mshta_renamed.md b/docs/_posts/2022-04-07-detect_mshta_renamed.md
index bd17b43c17..6c7bb3deb7 100644
--- a/docs/_posts/2022-04-07-detect_mshta_renamed.md
+++ b/docs/_posts/2022-04-07-detect_mshta_renamed.md
@@ -112,8 +112,8 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_mshta_renamed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-07-detect_renamed_psexec.md b/docs/_posts/2022-04-07-detect_renamed_psexec.md
index e8daa0b410..db349684ac 100644
--- a/docs/_posts/2022-04-07-detect_renamed_psexec.md
+++ b/docs/_posts/2022-04-07-detect_renamed_psexec.md
@@ -107,8 +107,8 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **detect_renamed_psexec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md b/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md
index 6787b99a3d..8a944454e2 100644
--- a/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md
+++ b/docs/_posts/2022-04-07-suspicious_microsoft_workflow_compiler_rename.md
@@ -117,8 +117,8 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_microsoft_workflow_compiler_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-07-suspicious_msbuild_rename.md b/docs/_posts/2022-04-07-suspicious_msbuild_rename.md
index 65148f9078..c2a68c2137 100644
--- a/docs/_posts/2022-04-07-suspicious_msbuild_rename.md
+++ b/docs/_posts/2022-04-07-suspicious_msbuild_rename.md
@@ -122,8 +122,8 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_msbuild_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-07-suspicious_rundll32_rename.md b/docs/_posts/2022-04-07-suspicious_rundll32_rename.md
index b4c15fbba6..27def35b42 100644
--- a/docs/_posts/2022-04-07-suspicious_rundll32_rename.md
+++ b/docs/_posts/2022-04-07-suspicious_rundll32_rename.md
@@ -122,8 +122,8 @@ The following hunting analytic identifies renamed instances of rundll32.exe exec
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **suspicious_rundll32_rename_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md b/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md
index 886e74fc2b..12f96affcf 100644
--- a/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md
+++ b/docs/_posts/2022-04-13-windows_registry_delete_task_sd.md
@@ -115,8 +115,8 @@ The following analytic identifies a process attempting to delete a scheduled tas
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_registry_delete_task_sd_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md
index ab77e3461d..2a31c7aba7 100644
--- a/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md
+++ b/docs/_posts/2022-04-18-nltest_domain_trust_discovery.md
@@ -107,9 +107,9 @@ This search looks for the execution of `nltest.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
-* [process_nltest](https://github.com/splunk/security_content/blob/develop/macros/process_nltest.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_nltest](https://github.com/splunk/security_content/blob/develop/macros/process_nltest.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **nltest_domain_trust_discovery_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md b/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md
index 0d89850005..c2a8c673ef 100644
--- a/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md
+++ b/docs/_posts/2022-04-22-linux_adding_crontab_using_list_parameter.md
@@ -117,8 +117,8 @@ The following analytic identifies a suspicious cron jobs modification using cron
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_adding_crontab_using_list_parameter_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md b/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md
index 7df59fa8ee..f5f77d7472 100644
--- a/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md
+++ b/docs/_posts/2022-04-22-linux_deleting_critical_directory_using_rm_command.md
@@ -108,8 +108,8 @@ The following analytic identifies a suspicious deletion of a critical folder in
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_deleting_critical_directory_using_rm_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-22-linux_disable_services.md b/docs/_posts/2022-04-22-linux_disable_services.md
index 511db970ed..d099ecf726 100644
--- a/docs/_posts/2022-04-22-linux_disable_services.md
+++ b/docs/_posts/2022-04-22-linux_disable_services.md
@@ -108,8 +108,8 @@ The following analytic is to detect events that attempts to disable a service. T
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_disable_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-22-linux_shred_overwrite_command.md b/docs/_posts/2022-04-22-linux_shred_overwrite_command.md
index c0e42b6493..f1c6a95dc1 100644
--- a/docs/_posts/2022-04-22-linux_shred_overwrite_command.md
+++ b/docs/_posts/2022-04-22-linux_shred_overwrite_command.md
@@ -108,8 +108,8 @@ This analytic is to detect a shred process to overwrite a files in a linux machi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_shred_overwrite_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-22-linux_stop_services.md b/docs/_posts/2022-04-22-linux_stop_services.md
index 9c2404013c..f9ba9a7b71 100644
--- a/docs/_posts/2022-04-22-linux_stop_services.md
+++ b/docs/_posts/2022-04-22-linux_stop_services.md
@@ -108,8 +108,8 @@ The following analytic is to detect events that attempt to stop or clear a servi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_stop_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md b/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md
index 7249744d4d..b10e220124 100644
--- a/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md
+++ b/docs/_posts/2022-04-22-windows_processes_killed_by_industroyer2_malware.md
@@ -107,8 +107,8 @@ The following analytic is to look for known processes killed by industroyer2 mal
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **windows_processes_killed_by_industroyer2_malware_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-26-powershell_fileless_script_contains_base64_encoded_content.md b/docs/_posts/2022-04-26-powershell_fileless_script_contains_base64_encoded_content.md
new file mode 100644
index 0000000000..b38862bd59
--- /dev/null
+++ b/docs/_posts/2022-04-26-powershell_fileless_script_contains_base64_encoded_content.md
@@ -0,0 +1,172 @@
+---
+title: "Powershell Fileless Script Contains Base64 Encoded Content"
+excerpt: "Command and Scripting Interpreter
+, Obfuscated Files or Information
+, PowerShell
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-04-26
+toc: true
+toc_label: ""
+tags:
+  - Command and Scripting Interpreter
+  - Obfuscated Files or Information
+  - PowerShell
+  - Execution
+  - Defense Evasion
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \
+This analytic identifies `FromBase64String` within the script block. A typical malicious instance will include additional code. \
+Command example - `[Byte[]]$var_code = [System.Convert]::FromBase64String(38uqIyMjQ6rG....` \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-04-26
+- **Author**: Michael Haag, Splunk
+- **ID**: 8acbc04c-c882-11eb-b060-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+| [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText=*frombase64string* 
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `powershell_fileless_script_contains_base64_encoded_content_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **powershell_fileless_script_contains_base64_encoded_content_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCodes
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+False positives should be limited. Filter as needed.
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 56.0 | 70 | 80 | A suspicious powershell script contains base64 command in $Message$ with EventCode $EventCode$ in host $ComputerName$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-04-26-powershell_get_localgroup_discovery_with_script_block_logging.md b/docs/_posts/2022-04-26-powershell_get_localgroup_discovery_with_script_block_logging.md
new file mode 100644
index 0000000000..c95d548153
--- /dev/null
+++ b/docs/_posts/2022-04-26-powershell_get_localgroup_discovery_with_script_block_logging.md
@@ -0,0 +1,167 @@
+---
+title: "Powershell Get LocalGroup Discovery with Script Block Logging"
+excerpt: "Permission Groups Discovery
+, Local Groups
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-04-26
+toc: true
+toc_label: ""
+tags:
+  - Permission Groups Discovery
+  - Local Groups
+  - Discovery
+  - Discovery
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \
+This analytic identifies PowerShell cmdlet - `get-localgroup` being ran. Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-04-26
+- **Author**: Michael Haag, Splunk
+- **ID**: d7c6ad22-155c-11ec-bb64-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery |
+
+| [T1069.001](https://attack.mitre.org/techniques/T1069/001/) | Local Groups | Discovery |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText = "*get-localgroup*" 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `powershell_get_localgroup_discovery_with_script_block_logging_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **powershell_get_localgroup_discovery_with_script_block_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+False positives may be present. Tune as needed.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | Local group discovery on $dest$ by $user$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html](https://www.splunk.com/en_us/blog/security/powershell-detections-threat-research-release-august-2021.html)
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md)
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getlocalgroup.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getlocalgroup.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md b/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md
index 78de749e75..41c9d503c8 100644
--- a/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md
+++ b/docs/_posts/2022-04-26-windows_hidden_schedule_task_settings.md
@@ -111,8 +111,8 @@ The following query utilizes Windows Security EventCode 4698, A scheduled task w
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **windows_hidden_schedule_task_settings_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md b/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md
index 2c0de92432..0716084d03 100644
--- a/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md
+++ b/docs/_posts/2022-04-27-windows_computer_account_created_by_computer_account.md
@@ -107,8 +107,8 @@ The following analytic identifes a Computer Account creating a new Computer Acco
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **windows_computer_account_created_by_computer_account_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md b/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md
index b5599f262c..6508556aaa 100644
--- a/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md
+++ b/docs/_posts/2022-04-27-windows_computer_account_requesting_kerberos_ticket.md
@@ -107,8 +107,8 @@ The following analytic identifies a ComputerAccount requesting a Kerberos Ticket
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **windows_computer_account_requesting_kerberos_ticket_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md b/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md
index 8801b6f266..3d6baf3523 100644
--- a/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md
+++ b/docs/_posts/2022-04-27-windows_kerberos_local_successful_logon.md
@@ -107,8 +107,8 @@ The following analytic identifies a local successful authentication event on a W
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **windows_kerberos_local_successful_logon_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-28-windows_computer_account_with_spn.md b/docs/_posts/2022-04-28-windows_computer_account_with_spn.md
index 82539a9f8d..7c459b8206 100644
--- a/docs/_posts/2022-04-28-windows_computer_account_with_spn.md
+++ b/docs/_posts/2022-04-28-windows_computer_account_with_spn.md
@@ -109,8 +109,8 @@ The following analytic identifies two SPNs, HOST and RestrictedKrbHost, added us
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 
 > :information_source:
 > **windows_computer_account_with_spn_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md b/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md
index 6a402c09d2..81557141a0 100644
--- a/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md
+++ b/docs/_posts/2022-04-30-linux_kworker_process_in_writable_process_path.md
@@ -113,8 +113,8 @@ This analytic looks for suspicious process kworker commandline in a linux machin
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_kworker_process_in_writable_process_path_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-02-delete_shadowcopy_with_powershell.md b/docs/_posts/2022-05-02-delete_shadowcopy_with_powershell.md
new file mode 100644
index 0000000000..f8abf6e8cb
--- /dev/null
+++ b/docs/_posts/2022-05-02-delete_shadowcopy_with_powershell.md
@@ -0,0 +1,159 @@
+---
+title: "Delete ShadowCopy With PowerShell"
+excerpt: "Inhibit System Recovery
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Inhibit System Recovery
+  - Impact
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-05-02
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 5ee2bcd0-b2ff-11eb-bb34-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText= "*ShadowCopy*" (ScriptBlockText = "*Delete*" OR ScriptBlockText = "*Remove*") 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `delete_shadowcopy_with_powershell_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **delete_shadowcopy_with_powershell_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
+
+#### Known False Positives
+unknown
+
+#### Associated Analytic story
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+* [Ransomware](/stories/ransomware)
+* [Revil Ransomware](/stories/revil_ransomware)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 81.0 | 90 | 90 | An attempt to delete ShadowCopy was performed using PowerShell on $Computer$ by $User$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations](https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations)
+* [https://www.techtarget.com/searchwindowsserver/tutorial/Set-up-PowerShell-script-block-logging-for-added-security](https://www.techtarget.com/searchwindowsserver/tutorial/Set-up-PowerShell-script-block-logging-for-added-security)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/delete_shadowcopy_with_powershell.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-exchange_powershell_module_usage.md b/docs/_posts/2022-05-02-exchange_powershell_module_usage.md
new file mode 100644
index 0000000000..805113cb30
--- /dev/null
+++ b/docs/_posts/2022-05-02-exchange_powershell_module_usage.md
@@ -0,0 +1,167 @@
+---
+title: "Exchange PowerShell Module Usage"
+excerpt: "Command and Scripting Interpreter
+, PowerShell
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Command and Scripting Interpreter
+  - PowerShell
+  - Execution
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+### :warning: WARNING THIS IS A EXPERIMENTAL analytic
+We have not been able to test, simulate, or build datasets for this object. Use at your own risk. This analytic is **NOT** supported.
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies the usage of Exchange PowerShell modules that were recently used for a proof of concept related to ProxyShell. Currently, there is no active data shared or data we could re-produce relate to this part of the ProxyShell chain of exploits.  \
+Inherently, the usage of the modules is not malicious, but reviewing parallel processes, and user, of the session will assist with determining the intent. \
+Module - New-MailboxExportRequest will begin the process of exporting contents of a primary mailbox or archive to a .pst file. \
+Module - New-managementroleassignment can assign a management role to a management role group, management role assignment policy, user, or universal security group (USG).
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Michael Haag
+- **ID**: 2d10095e-05ae-11ec-8fdf-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*") 
+| stats count min(_time) as firstTime max(_time) as lastTime by lastTime by Opcode Computer UserID EventCode ScriptBlockText
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `exchange_powershell_module_usage_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **exchange_powershell_module_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use this PowerShell commandlet for troubleshooting.
+
+#### Associated Analytic story
+* [ProxyShell](/stories/proxyshell)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $dest$ by $user$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps](https://docs.microsoft.com/en-us/powershell/module/exchange/new-mailboxexportrequest?view=exchange-ps)
+* [https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps](https://docs.microsoft.com/en-us/powershell/module/exchange/new-managementroleassignment?view=exchange-ps)
+* [https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html](https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html)
+* [https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell](https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell)
+* [https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/](https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/experimental/endpoint/exchange_powershell_module_usage.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-get-domaintrust_with_powershell_script_block.md b/docs/_posts/2022-05-02-get-domaintrust_with_powershell_script_block.md
new file mode 100644
index 0000000000..4900c5466a
--- /dev/null
+++ b/docs/_posts/2022-05-02-get-domaintrust_with_powershell_script_block.md
@@ -0,0 +1,161 @@
+---
+title: "Get-DomainTrust with PowerShell Script Block"
+excerpt: "Domain Trust Discovery
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Domain Trust Discovery
+  - Discovery
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \
+This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Michael Haag, Splunk
+- **ID**: 89275e7e-0548-11ec-bf75-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1482](https://attack.mitre.org/techniques/T1482/) | Domain Trust Discovery | Discovery |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText = "*get-domaintrust*" 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `get_domaintrust_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **get-domaintrust_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+It is possible certain system management frameworks utilize this command to gather trust information.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 12.0 | 30 | 40 | Suspicious PowerShell Get-DomainTrust was identified on endpoint $Computer$ by user $UserID$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/](https://blog.harmj0y.net/redteaming/a-guide-to-attacking-domain-trusts/)
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaintrust.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaintrust.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/get_domaintrust_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-get_aduserresultantpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2022-05-02-get_aduserresultantpasswordpolicy_with_powershell_script_block.md
new file mode 100644
index 0000000000..9372d632c1
--- /dev/null
+++ b/docs/_posts/2022-05-02-get_aduserresultantpasswordpolicy_with_powershell_script_block.md
@@ -0,0 +1,157 @@
+---
+title: "Get ADUserResultantPasswordPolicy with Powershell Script Block"
+excerpt: "Password Policy Discovery
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Password Policy Discovery
+  - Discovery
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADUserResultantPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
+- **ID**: 737e1eb0-065a-11ec-921a-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText="*Get-ADUserResultantPasswordPolicy*" 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **get_aduserresultantpasswordpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+
+#### Known False Positives
+Administrators or power users may use this command for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 9.0 | 30 | 30 | powershell process having commandline $ScriptBlockText$ to query domain user password policy. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet)
+* [https://attack.mitre.org/techniques/T1201/](https://attack.mitre.org/techniques/T1201/)
+* [https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps](https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-get_domainpolicy_with_powershell_script_block.md b/docs/_posts/2022-05-02-get_domainpolicy_with_powershell_script_block.md
new file mode 100644
index 0000000000..d466d8ea96
--- /dev/null
+++ b/docs/_posts/2022-05-02-get_domainpolicy_with_powershell_script_block.md
@@ -0,0 +1,157 @@
+---
+title: "Get DomainPolicy with Powershell Script Block"
+excerpt: "Password Policy Discovery
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Password Policy Discovery
+  - Discovery
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies for situational awareness and Active Directory Discovery.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: a360d2b2-065a-11ec-b0bf-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1201](https://attack.mitre.org/techniques/T1201/) | Password Policy Discovery | Discovery |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText ="*Get-DomainPolicy*" 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `get_domainpolicy_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **get_domainpolicy_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+
+#### Known False Positives
+Administrators or power users may use this command for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 30.0 | 50 | 60 | powershell process having commandline $ScriptBlockText$ to query domain policy. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet](https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet)
+* [https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/)
+* [https://attack.mitre.org/techniques/T1201/](https://attack.mitre.org/techniques/T1201/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domainpolicy.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domainpolicy.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-getadcomputer_with_powershell_script_block.md b/docs/_posts/2022-05-02-getadcomputer_with_powershell_script_block.md
new file mode 100644
index 0000000000..5a645d82a1
--- /dev/null
+++ b/docs/_posts/2022-05-02-getadcomputer_with_powershell_script_block.md
@@ -0,0 +1,155 @@
+---
+title: "GetAdComputer with PowerShell Script Block"
+excerpt: "Remote System Discovery
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Remote System Discovery
+  - Discovery
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: a9a1da02-8e27-4bf7-a348-f4389c9da487
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 (ScriptBlockText = "*Get-AdComputer*") 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `getadcomputer_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **getadcomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use this PowerShell commandlet for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | Remote system discovery enumeration on $Computer$ by $UserID$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
+* [https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps](https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getadcomputer_with_powershell_script_block.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-getdomaincomputer_with_powershell_script_block.md b/docs/_posts/2022-05-02-getdomaincomputer_with_powershell_script_block.md
new file mode 100644
index 0000000000..3639a1b2ca
--- /dev/null
+++ b/docs/_posts/2022-05-02-getdomaincomputer_with_powershell_script_block.md
@@ -0,0 +1,155 @@
+---
+title: "GetDomainComputer with PowerShell Script Block"
+excerpt: "Remote System Discovery
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Remote System Discovery
+  - Discovery
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainComputer` commandlet. `GetDomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: f64da023-b988-4775-8d57-38e512beb56e
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainComputer*") 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `getdomaincomputer_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **getdomaincomputer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use PowerView for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 24.0 | 30 | 80 | Remote system discovery with PowerView on $Computer$ by $user$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
+* [https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainComputer/](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainComputer/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-getdomaincontroller_with_powershell_script_block.md b/docs/_posts/2022-05-02-getdomaincontroller_with_powershell_script_block.md
new file mode 100644
index 0000000000..00262fb378
--- /dev/null
+++ b/docs/_posts/2022-05-02-getdomaincontroller_with_powershell_script_block.md
@@ -0,0 +1,155 @@
+---
+title: "GetDomainController with PowerShell Script Block"
+excerpt: "Remote System Discovery
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Remote System Discovery
+  - Discovery
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainController` commandlet. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain computers for situational awareness and Active Directory Discovery.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 676b600a-a94d-4951-b346-11329431e6c1
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainController*") 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `getdomaincontroller_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **getdomaincontroller_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use this PowerShell commandlet for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 24.0 | 30 | 80 | Remote system discovery with PowerView on $Computer$ by $UserID$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
+* [https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdc.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdc.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-getdomaingroup_with_powershell_script_block.md b/docs/_posts/2022-05-02-getdomaingroup_with_powershell_script_block.md
new file mode 100644
index 0000000000..0e67852ad6
--- /dev/null
+++ b/docs/_posts/2022-05-02-getdomaingroup_with_powershell_script_block.md
@@ -0,0 +1,160 @@
+---
+title: "GetDomainGroup with PowerShell Script Block"
+excerpt: "Permission Groups Discovery
+, Domain Groups
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Permission Groups Discovery
+  - Domain Groups
+  - Discovery
+  - Discovery
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams and adversaries may leverage this function to enumerate domain groups for situational awareness and Active Directory Discovery.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 09725404-a44f-4ed3-9efa-8ed5d69e4c53
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery |
+
+| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainGroup*") 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `getdomaingroup_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **getdomaingroup_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use this PowerView functions for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | Domain group discovery enumeration using PowerView on $Computer$ by $UserID$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/)
+* [https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/](https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaingroup.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaingroup.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getdomaingroup_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-getwmiobject_ds_computer_with_powershell_script_block.md b/docs/_posts/2022-05-02-getwmiobject_ds_computer_with_powershell_script_block.md
new file mode 100644
index 0000000000..ccfb12eb9b
--- /dev/null
+++ b/docs/_posts/2022-05-02-getwmiobject_ds_computer_with_powershell_script_block.md
@@ -0,0 +1,155 @@
+---
+title: "GetWmiObject Ds Computer with PowerShell Script Block"
+excerpt: "Remote System Discovery
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Remote System Discovery
+  - Discovery
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_Computer` class parameter leverages WMI to query for all domain computers. Red Teams and adversaries may leverage this commandlet to enumerate domain computers for situational awareness and Active Directory Discovery.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 29b99201-723c-4118-847a-db2b3d3fb8ea
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace root\\directory\\ldap*" AND ScriptBlockText="*class ds_computer*") 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `getwmiobject_ds_computer_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **getwmiobject_ds_computer_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use this PowerShell commandlet for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | Remote system discovery enumeration on $Computer$ by $UserID$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
+* [https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-getwmiobject_ds_group_with_powershell_script_block.md b/docs/_posts/2022-05-02-getwmiobject_ds_group_with_powershell_script_block.md
new file mode 100644
index 0000000000..49d81886a6
--- /dev/null
+++ b/docs/_posts/2022-05-02-getwmiobject_ds_group_with_powershell_script_block.md
@@ -0,0 +1,160 @@
+---
+title: "GetWmiObject Ds Group with PowerShell Script Block"
+excerpt: "Permission Groups Discovery
+, Domain Groups
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Permission Groups Discovery
+  - Domain Groups
+  - Discovery
+  - Discovery
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 67740bd3-1506-469c-b91d-effc322cc6e5
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1069](https://attack.mitre.org/techniques/T1069/) | Permission Groups Discovery | Discovery |
+
+| [T1069.002](https://attack.mitre.org/techniques/T1069/002/) | Domain Groups | Discovery |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace root\\directory\\ldap*" AND ScriptBlockText="*class ds_group*") 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `getwmiobject_ds_group_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **getwmiobject_ds_group_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use this PowerShell commandlet for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | Domain group discovery enumeration using PowerShell on $Computer$ by $UserID$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1069/002/](https://attack.mitre.org/techniques/T1069/002/)
+* [https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-getwmiobject_ds_user_with_powershell_script_block.md b/docs/_posts/2022-05-02-getwmiobject_ds_user_with_powershell_script_block.md
new file mode 100644
index 0000000000..09b5fbcc7e
--- /dev/null
+++ b/docs/_posts/2022-05-02-getwmiobject_ds_user_with_powershell_script_block.md
@@ -0,0 +1,161 @@
+---
+title: "GetWmiObject DS User with PowerShell Script Block"
+excerpt: "Domain Account
+, Account Discovery
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Domain Account
+  - Account Discovery
+  - Discovery
+  - Discovery
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet. The `DS_User` class parameter leverages WMI to query for all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain users for situational awareness and Active Directory Discovery.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Teoderick Contreras, Mauricio Velazco, Splunk
+- **ID**: fabd364e-04f3-11ec-b34b-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1087.002](https://attack.mitre.org/techniques/T1087/002/) | Domain Account | Discovery |
+
+| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText = "*get-wmiobject*" ScriptBlockText = "*ds_user*" ScriptBlockText = "*-namespace*" ScriptBlockText = "*root\\directory\\ldap*" 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `getwmiobject_ds_user_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **getwmiobject_ds_user_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+he following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+
+#### Known False Positives
+Administrators or power users may use this command for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 25.0 | 50 | 50 | powershell process having commandline $ScriptBlockText$ for user enumeration |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://www.blackhillsinfosec.com/red-blue-purple/](https://www.blackhillsinfosec.com/red-blue-purple/)
+* [https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace](https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-getwmiobject_user_account_with_powershell_script_block.md b/docs/_posts/2022-05-02-getwmiobject_user_account_with_powershell_script_block.md
new file mode 100644
index 0000000000..87d8164f20
--- /dev/null
+++ b/docs/_posts/2022-05-02-getwmiobject_user_account_with_powershell_script_block.md
@@ -0,0 +1,165 @@
+---
+title: "GetWmiObject User Account with PowerShell Script Block"
+excerpt: "Account Discovery
+, Local Account
+, PowerShell
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Account Discovery
+  - Local Account
+  - PowerShell
+  - Discovery
+  - Discovery
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-WmiObject` commandlet used with specific parameters. The `Win32_UserAccount` parameter is used to return a list of all local users. Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 640b0eda-0429-11ec-accd-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1087](https://attack.mitre.org/techniques/T1087/) | Account Discovery | Discovery |
+
+| [T1087.001](https://attack.mitre.org/techniques/T1087/001/) | Local Account | Discovery |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 (ScriptBlockText="*Get-WmiObject*" AND ScriptBlockText="*Win32_UserAccount*") 
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
+| `security_content_ctime(firstTime)` 
+| `getwmiobject_user_account_with_powershell_script_block_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **getwmiobject_user_account_with_powershell_script_block_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* EventCode
+* ScriptBlockText
+* Computer
+* UserID
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use this PowerShell commandlet for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | Local user discovery enumeration using PowerShell on $Computer$ by $UserID$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1087/001/](https://attack.mitre.org/techniques/T1087/001/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-mailsniper_invoke_functions.md b/docs/_posts/2022-05-02-mailsniper_invoke_functions.md
new file mode 100644
index 0000000000..6a6a5d308d
--- /dev/null
+++ b/docs/_posts/2022-05-02-mailsniper_invoke_functions.md
@@ -0,0 +1,161 @@
+---
+title: "Mailsniper Invoke functions"
+excerpt: "Email Collection
+, Local Email Collection
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Email Collection
+  - Local Email Collection
+  - Collection
+  - Collection
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-05-02
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: a36972c8-b894-11eb-9f78-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1114](https://attack.mitre.org/techniques/T1114/) | Email Collection | Collection |
+
+| [T1114.001](https://attack.mitre.org/techniques/T1114/001/) | Local Email Collection | Collection |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText IN ("*Invoke-GlobalO365MailSearch*", "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*", "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*") 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `mailsniper_invoke_functions_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **mailsniper_invoke_functions_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the powershell logs  from your endpoints. make sure you enable needed registry to monitor this event.
+
+#### Known False Positives
+unknown
+
+#### Associated Analytic story
+* [Data Exfiltration](/stories/data_exfiltration)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 72.0 | 90 | 80 | mailsniper.ps1 functions $ScriptBlockText$ executed on a $Computer$ by user $user$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/](https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/mailsniper_invoke_functions.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-powershell_4104_hunting.md b/docs/_posts/2022-05-02-powershell_4104_hunting.md
new file mode 100644
index 0000000000..5cd3577ba1
--- /dev/null
+++ b/docs/_posts/2022-05-02-powershell_4104_hunting.md
@@ -0,0 +1,341 @@
+---
+title: "PowerShell 4104 Hunting"
+excerpt: "Command and Scripting Interpreter
+, PowerShell
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Command and Scripting Interpreter
+  - PowerShell
+  - Execution
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following Hunting analytic assists with identifying suspicious PowerShell execution using Script Block Logging, or EventCode 4104. This analytic is not meant to be ran hourly, but occasionally to identify malicious or suspicious PowerShell. This analytic is a combination of work completed by Alex Teixeira and Splunk Threat Research Team.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Michael Haag, Splunk
+- **ID**: d6f2b006-0041-11ec-8885-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 
+| eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"), "4", 0) 
+| eval enccom=if(match(ScriptBlockText,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}
+|[A-Za-z0-9+\/]{3}=
+|[A-Za-z0-9+\/]{2}==)") OR match(ScriptBlockText, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) 
+| eval suspcmdlet=if(match(ScriptBlockText, "(?i)Add-Exfiltration
+|Add-Persistence
+|Add-RegBackdoor
+|Add-ScrnSaveBackdoor
+|Check-VM
+|Do-Exfiltration
+|Enabled-DuplicateToken
+|Exploit-Jboss
+|Find-Fruit
+|Find-GPOLocation
+|Find-TrustedDocuments
+|Get-ApplicationHost
+|Get-ChromeDump
+|Get-ClipboardContents
+|Get-FoxDump
+|Get-GPPPassword
+|Get-IndexedItem
+|Get-Keystrokes
+|LSASecret
+|Get-PassHash
+|Get-RegAlwaysInstallElevated
+|Get-RegAutoLogon
+|Get-RickAstley
+|Get-Screenshot
+|Get-SecurityPackages
+|Get-ServiceFilePermission
+|Get-ServicePermission
+|Get-ServiceUnquoted
+|Get-SiteListPassword
+|Get-System
+|Get-TimedScreenshot
+|Get-UnattendedInstallFile
+|Get-Unconstrained
+|Get-VaultCredential
+|Get-VulnAutoRun
+|Get-VulnSchTask
+|Gupt-Backdoor
+|HTTP-Login
+|Install-SSP
+|Install-ServiceBinary
+|Invoke-ACLScanner
+|Invoke-ADSBackdoor
+|Invoke-ARPScan
+|Invoke-AllChecks
+|Invoke-BackdoorLNK
+|Invoke-BypassUAC
+|Invoke-CredentialInjection
+|Invoke-DCSync
+|Invoke-DllInjection
+|Invoke-DowngradeAccount
+|Invoke-EgressCheck
+|Invoke-Inveigh
+|Invoke-InveighRelay
+|Invoke-Mimikittenz
+|Invoke-NetRipper
+|Invoke-NinjaCopy
+|Invoke-PSInject
+|Invoke-Paranoia
+|Invoke-PortScan
+|Invoke-PoshRat
+|Invoke-PostExfil
+|Invoke-PowerDump
+|Invoke-PowerShellTCP
+|Invoke-PsExec
+|Invoke-PsUaCme
+|Invoke-ReflectivePEInjection
+|Invoke-ReverseDNSLookup
+|Invoke-RunAs
+|Invoke-SMBScanner
+|Invoke-SSHCommand
+|Invoke-Service
+|Invoke-Shellcode
+|Invoke-Tater
+|Invoke-ThunderStruck
+|Invoke-Token
+|Invoke-UserHunter
+|Invoke-VoiceTroll
+|Invoke-WScriptBypassUAC
+|Invoke-WinEnum
+|MailRaider
+|New-HoneyHash
+|Out-Minidump
+|Port-Scan
+|PowerBreach
+|PowerUp
+|PowerView
+|Remove-Update
+|Set-MacAttribute
+|Set-Wallpaper
+|Show-TargetScreen
+|Start-CaptureServer
+|VolumeShadowCopyTools
+|NEEEEWWW
+|(Computer
+|User)Property
+|CachedRDPConnection
+|get-net\S+
+|invoke-\S+hunter
+|Install-Service
+|get-\S+(credent
+|password)
+|remoteps
+|Kerberos.*(policy
+|ticket)
+|netfirewall
+|Uninstall-Windows
+|Verb\s+Runas
+|AmsiBypass
+|nishang
+|Invoke-Interceptor
+|EXEonRemote
+|NetworkRelay
+|PowerShelludp
+|PowerShellIcmp
+|CreateShortcut
+|copy-vss
+|invoke-dll
+|invoke-mass
+|out-shortcut
+|Invoke-ShellCommand"),1,0) 
+| eval base64 = if(match(lower(ScriptBlockText),"frombase64"), "4", 0) 
+| eval empire=if(match(lower(ScriptBlockText),"system.net.webclient") AND match(lower(ScriptBlockText), "frombase64string") ,5,0) 
+| eval mimikatz=if(match(lower(ScriptBlockText),"mimikatz") OR match(lower(ScriptBlockText), "-dumpcr") OR match(lower(ScriptBlockText), "SEKURLSA::Pth") OR match(lower(ScriptBlockText), "kerberos::ptt") OR match(lower(ScriptBlockText), "kerberos::golden") ,5,0) 
+| eval iex = if(match(lower(ScriptBlockText),"iex"), "2", 0) 
+| eval webclient=if(match(lower(ScriptBlockText),"http") OR match(lower(ScriptBlockText),"web(client
+|request)") OR match(lower(ScriptBlockText),"socket") OR match(lower(ScriptBlockText),"download(file
+|string)") OR match(lower(ScriptBlockText),"bitstransfer") OR match(lower(ScriptBlockText),"internetexplorer.application") OR match(lower(ScriptBlockText),"xmlhttp"),5,0) 
+| eval get = if(match(lower(ScriptBlockText),"get-"), "1", 0) 
+| eval rundll32 = if(match(lower(ScriptBlockText),"rundll32"), "4", 0) 
+| eval suspkeywrd=if(match(ScriptBlockText, "(?i)(bitstransfer
+|mimik
+|metasp
+|AssemblyBuilderAccess
+|Reflection\.Assembly
+|shellcode
+|injection
+|cnvert
+|shell\.application
+|start-process
+|Rc4ByteStream
+|System\.Security\.Cryptography
+|lsass\.exe
+|localadmin
+|LastLoggedOn
+|hijack
+|BackupPrivilege
+|ngrok
+|comsvcs
+|backdoor
+|brute.?force
+|Port.?Scan
+|Exfiltration
+|exploit
+|DisableRealtimeMonitoring
+|beacon)"),1,0) 
+| eval syswow64 = if(match(lower(ScriptBlockText),"syswow64"), "3", 0) 
+| eval httplocal = if(match(lower(ScriptBlockText),"http://127.0.0.1"), "4", 0) 
+| eval reflection = if(match(lower(ScriptBlockText),"reflection"), "1", 0) 
+| eval invokewmi=if(match(lower(ScriptBlockText), "(?i)(wmiobject
+|WMIMethod
+|RemoteWMI
+|PowerShellWmi
+|wmicommand)"),5,0) 
+| eval downgrade=if(match(ScriptBlockText, "(?i)([-]ve*r*s*i*o*n*\s+2)") OR match(lower(ScriptBlockText),"powershell -version"),3,0) 
+| eval compressed=if(match(ScriptBlockText, "(?i)GZipStream
+|::Decompress
+|IO.Compression
+|write-zip
+|(expand
+|compress)-Archive"),5,0) 
+| eval invokecmd = if(match(lower(ScriptBlockText),"invoke-command"), "4", 0) 
+| addtotals fieldname=Score DoIt, enccom, suspcmdlet, suspkeywrd, compressed, downgrade, mimikatz, iex, empire, rundll32, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get 
+| stats values(Score) by DoIt, enccom, compressed, downgrade, iex, mimikatz, rundll32, empire, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get, suspcmdlet, suspkeywrd 
+| `powershell_4104_hunting_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+
+> :information_source:
+> **powershell_4104_hunting_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+
+#### Known False Positives
+Limited false positives. May filter as needed.
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $Computer$ by user $user$ executing suspicious commands. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md](https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md)
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell)
+* [https://github.com/marcurdy/dfir-toolset/blob/master/Powershell%20Blueteam.txt](https://github.com/marcurdy/dfir-toolset/blob/master/Powershell%20Blueteam.txt)
+* [https://devblogs.microsoft.com/powershell/powershell-the-blue-team/](https://devblogs.microsoft.com/powershell/powershell-the-blue-team/)
+* [https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1)
+* [https://www.mandiant.com/resources/greater-visibilityt](https://www.mandiant.com/resources/greater-visibilityt)
+* [https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/](https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/)
+* [https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html](https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_4104_hunting.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-powershell_creating_thread_mutex.md b/docs/_posts/2022-05-02-powershell_creating_thread_mutex.md
new file mode 100644
index 0000000000..814d838666
--- /dev/null
+++ b/docs/_posts/2022-05-02-powershell_creating_thread_mutex.md
@@ -0,0 +1,168 @@
+---
+title: "Powershell Creating Thread Mutex"
+excerpt: "Obfuscated Files or Information
+, Indicator Removal from Tools
+, PowerShell
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Obfuscated Files or Information
+  - Indicator Removal from Tools
+  - PowerShell
+  - Defense Evasion
+  - Defense Evasion
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using the `mutex` function. This function is commonly seen in some obfuscated PowerShell scripts to make sure that only one instance of there process is running on a compromise machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 637557ec-ca08-11eb-bd0a-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1027](https://attack.mitre.org/techniques/T1027/) | Obfuscated Files or Information | Defense Evasion |
+
+| [T1027.005](https://attack.mitre.org/techniques/T1027/005/) | Indicator Removal from Tools | Defense Evasion |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText = "*Threading.Mutex*" 
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `powershell_creating_thread_mutex_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **powershell_creating_thread_mutex_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* EventCode
+* ScriptBlockText
+* Computer
+* UserID
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+powershell developer may used this function in their script for instance checking too.
+
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 40.0 | 50 | 80 | A suspicious powershell script contains Thread Mutex in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/](https://isc.sans.edu/forums/diary/Some+Powershell+Malicious+Code/22988/)
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_creating_thread_mutex.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-powershell_loading_dotnet_into_memory_via_reflection.md b/docs/_posts/2022-05-02-powershell_loading_dotnet_into_memory_via_reflection.md
new file mode 100644
index 0000000000..2f73515400
--- /dev/null
+++ b/docs/_posts/2022-05-02-powershell_loading_dotnet_into_memory_via_reflection.md
@@ -0,0 +1,167 @@
+---
+title: "PowerShell Loading DotNET into Memory via Reflection"
+excerpt: "Command and Scripting Interpreter
+, PowerShell
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Command and Scripting Interpreter
+  - PowerShell
+  - Execution
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+This analytic identifies the use of PowerShell loading .net assembly via reflection. This is commonly found in malicious PowerShell usage, including Empire and Cobalt Strike. In addition, the `load(` value may be modifed by removing `(` and it will identify more events to review. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Michael Haag, Splunk
+- **ID**: 85bc3f30-ca28-11eb-bd21-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*", "*reflection.assembly*") 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `powershell_loading_dotnet_into_memory_via_reflection_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **powershell_loading_dotnet_into_memory_via_reflection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+False positives should be limited as day to day scripts do not use this method.
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 56.0 | 70 | 80 | A suspicious powershell script contains reflective class assembly command in $ScriptBlockText$ to load .net code in memory with EventCode $EventCode$ in host $Computer$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0](https://docs.microsoft.com/en-us/dotnet/api/system.reflection.assembly?view=net-5.0)
+* [https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.](https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.)
+* [https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63](https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63)
+* [https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf](https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf)
+* [https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/](https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-powershell_remove_windows_defender_directory.md b/docs/_posts/2022-05-02-powershell_remove_windows_defender_directory.md
new file mode 100644
index 0000000000..a53b226b49
--- /dev/null
+++ b/docs/_posts/2022-05-02-powershell_remove_windows_defender_directory.md
@@ -0,0 +1,167 @@
+---
+title: "Powershell Remove Windows Defender Directory"
+excerpt: "Disable or Modify Tools
+, Impair Defenses
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Disable or Modify Tools
+  - Impair Defenses
+  - Defense Evasion
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This analytic will identify a suspicious PowerShell command used to delete the Windows Defender folder. This technique was seen used by the WhisperGate malware campaign where it used Nirsofts advancedrun.exe to gain administrative privileges to then execute a PowerShell command to delete the Windows Defender folder. This is a good indicator the offending process is trying corrupt a Windows Defender installation.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-05-02
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: adf47620-79fa-11ec-b248-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
+
+| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText = "*rmdir *" AND ScriptBlockText = "*\\Microsoft\\Windows Defender*" 
+| stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `powershell_remove_windows_defender_directory_filter` 
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **powershell_remove_windows_defender_directory_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+unknown
+
+#### Associated Analytic story
+* [WhisperGate](/stories/whispergate)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 90.0 | 100 | 90 | suspicious powershell script $ScriptBlockText$ was executed on the $Computer$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/](https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-02-wmi_recon_running_process_or_services.md b/docs/_posts/2022-05-02-wmi_recon_running_process_or_services.md
new file mode 100644
index 0000000000..207622e563
--- /dev/null
+++ b/docs/_posts/2022-05-02-wmi_recon_running_process_or_services.md
@@ -0,0 +1,159 @@
+---
+title: "WMI Recon Running Process Or Services"
+excerpt: "Gather Victim Host Information
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-02
+toc: true
+toc_label: ""
+tags:
+  - Gather Victim Host Information
+  - Reconnaissance
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found in malware and APT events where the adversary will map all running security applications or services on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-02
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: b5cd5526-cce7-11eb-b3bd-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1592](https://attack.mitre.org/techniques/T1592/) | Gather Victim Host Information | Reconnaissance |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText= "*SELECT*" AND (ScriptBlockText="*Win32_Process*" OR ScriptBlockText="*Win32_Service*") 
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `wmi_recon_running_process_or_services_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **wmi_recon_running_process_or_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+network administrator may used this command for checking purposes
+
+#### Associated Analytic story
+* [Hermetic Wiper](/stories/hermetic_wiper)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 30.0 | 30 | 100 | Suspicious powerShell script execution by $user$ on $Computer$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/](https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/)
+* [https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/](https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/)
+* [https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/WMI-events.md](https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/WMI-events.md)
+* [https://in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/](https://in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/wmi_recon_running_process_or_services.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-03-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md b/docs/_posts/2022-05-03-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md
new file mode 100644
index 0000000000..f483a96387
--- /dev/null
+++ b/docs/_posts/2022-05-03-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md
@@ -0,0 +1,161 @@
+---
+title: "Disabled Kerberos Pre-Authentication Discovery With Get-ADUser"
+excerpt: "Steal or Forge Kerberos Tickets
+, AS-REP Roasting
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-03
+toc: true
+toc_label: ""
+tags:
+  - Steal or Forge Kerberos Tickets
+  - AS-REP Roasting
+  - Credential Access
+  - Credential Access
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-ADUser` commandlet with specific parameters. `Get-ADUser` is part of the Active Directory PowerShell module used to manage Windows Active Directory networks. As the name suggests, `Get-ADUser` is used to query for domain users. With the appropiate parameters, Get-ADUser allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-03
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 114c6bfe-9406-11ec-bcce-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1558](https://attack.mitre.org/techniques/T1558/) | Steal or Forge Kerberos Tickets | Credential Access |
+
+| [T1558.004](https://attack.mitre.org/techniques/T1558/004/) | AS-REP Roasting | Credential Access |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+ `powershell` EventCode=4104 (ScriptBlockText = "*Get-ADUser*" AND ScriptBlockText="*4194304*") 
+| stats count min(_time)  as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **disabled_kerberos_pre-authentication_discovery_with_get-aduser_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use search for accounts with Kerberos Pre Authentication disabled for legitimate purposes.
+
+#### Associated Analytic story
+* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 54.0 | 60 | 90 | Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1558/004/](https://attack.mitre.org/techniques/T1558/004/)
+* [https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html](https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html)
+* [https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/](https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-03-disabled_kerberos_pre-authentication_discovery_with_powerview.md b/docs/_posts/2022-05-03-disabled_kerberos_pre-authentication_discovery_with_powerview.md
new file mode 100644
index 0000000000..e00de9eaed
--- /dev/null
+++ b/docs/_posts/2022-05-03-disabled_kerberos_pre-authentication_discovery_with_powerview.md
@@ -0,0 +1,161 @@
+---
+title: "Disabled Kerberos Pre-Authentication Discovery With PowerView"
+excerpt: "Steal or Forge Kerberos Tickets
+, AS-REP Roasting
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-05-03
+toc: true
+toc_label: ""
+tags:
+  - Steal or Forge Kerberos Tickets
+  - AS-REP Roasting
+  - Credential Access
+  - Credential Access
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet with specific parameters. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows Active Directory networks. As the name suggests, `Get-DomainUser` is used to identify domain users and combining it with `-PreauthNotRequired` allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-05-03
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: b0b34e2c-90de-11ec-baeb-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1558](https://attack.mitre.org/techniques/T1558/) | Steal or Forge Kerberos Tickets | Credential Access |
+
+| [T1558.004](https://attack.mitre.org/techniques/T1558/004/) | AS-REP Roasting | Credential Access |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+ `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainUser*" AND ScriptBlockText="*PreauthNotRequired*") 
+| stats count min(_time)  as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText 
+| `security_content_ctime(firstTime)` 
+| `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **disabled_kerberos_pre-authentication_discovery_with_powerview_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Opcode
+* Computer
+* UserID
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use PowerView for troubleshooting
+
+#### Associated Analytic story
+* [Active Directory Kerberos Attacks](/stories/active_directory_kerberos_attacks)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 54.0 | 60 | 90 | Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1558/004/](https://attack.mitre.org/techniques/T1558/004/)
+* [https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html](https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html)
+* [https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/](https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md b/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md
index f52fd0bab9..7127c9061b 100644
--- a/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md
+++ b/docs/_posts/2022-05-05-windows_service_create_kernel_mode_driver.md
@@ -120,8 +120,8 @@ The following analytic identifes a new kernel driver being added to Windows usin
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_service_create_kernel_mode_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md b/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md
index 0b8b7e8e93..2f657018cd 100644
--- a/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md
+++ b/docs/_posts/2022-05-16-cobalt_strike_named_pipes.md
@@ -108,8 +108,8 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **cobalt_strike_named_pipes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-16-windows_system_file_on_disk.md b/docs/_posts/2022-05-16-windows_system_file_on_disk.md
index 10dde422ad..a4469a0c63 100644
--- a/docs/_posts/2022-05-16-windows_system_file_on_disk.md
+++ b/docs/_posts/2022-05-16-windows_system_file_on_disk.md
@@ -108,8 +108,8 @@ The following hunting analytic will assist with identifying new .sys files intro
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_system_file_on_disk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md b/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md
index 861526d197..a393a209b4 100644
--- a/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md
+++ b/docs/_posts/2022-05-17-aws_create_policy_version_to_allow_all_resources.md
@@ -121,8 +121,8 @@ This search looks for AWS CloudTrail events where a user created a policy versio
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_create_policy_version_to_allow_all_resources_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md b/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md
index e14e37df10..faa65f5472 100644
--- a/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md
+++ b/docs/_posts/2022-05-23-schtasks_scheduling_job_on_remote_system.md
@@ -115,8 +115,8 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **schtasks_scheduling_job_on_remote_system_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md b/docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md
index ce1a1bab2a..c0228632f6 100644
--- a/docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md
+++ b/docs/_posts/2022-05-23-splunk_command_and_scripting_interpreter_risky_commands.md
@@ -124,8 +124,8 @@ The Splunk platform contains built-in search processing language (SPL) safeguard
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **splunk_command_and_scripting_interpreter_risky_commands_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-26-linux_at_application_execution.md b/docs/_posts/2022-05-26-linux_at_application_execution.md
index d4d3ae7e0d..6ab7c3618b 100644
--- a/docs/_posts/2022-05-26-linux_at_application_execution.md
+++ b/docs/_posts/2022-05-26-linux_at_application_execution.md
@@ -117,8 +117,8 @@ The following analytic identifies a suspicious process creation of At applicatio
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_at_application_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md b/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md
index 225f6cd674..460b2cc15f 100644
--- a/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md
+++ b/docs/_posts/2022-05-26-linux_possible_append_command_to_at_allow_config_file.md
@@ -117,8 +117,8 @@ This analytic looks for suspicious commandline that may use to append user entry
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_possible_append_command_to_at_allow_config_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md b/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md
index 2257853953..d75ccf9983 100644
--- a/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md
+++ b/docs/_posts/2022-05-27-splunk_command_and_scripting_interpreter_delete_usage.md
@@ -114,8 +114,8 @@ The following analytic identifies the use of the risky command - Delete - that m
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **splunk_command_and_scripting_interpreter_delete_usage_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-05-30-windows_office_product_spawning_msdt.md b/docs/_posts/2022-05-30-windows_office_product_spawning_msdt.md
index 478360f8bf..d88c00db39 100644
--- a/docs/_posts/2022-05-30-windows_office_product_spawning_msdt.md
+++ b/docs/_posts/2022-05-30-windows_office_product_spawning_msdt.md
@@ -118,8 +118,8 @@ The following analytic identifies a Microsoft Office product spawning the Window
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_office_product_spawning_msdt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md b/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md
index 174eac3cf3..b18ce4fe3e 100644
--- a/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md
+++ b/docs/_posts/2022-06-01-mshtml_module_load_in_office_product.md
@@ -112,8 +112,8 @@ The following detection identifies the module load of mshtml.dll into an Office
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **mshtml_module_load_in_office_product_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md b/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md
index a841bd35e8..d62428fbc2 100644
--- a/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md
+++ b/docs/_posts/2022-06-01-suspicious_process_with_discord_dns_query.md
@@ -112,8 +112,8 @@ This analytic identifies a process making a DNS query to Discord, a well known i
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **suspicious_process_with_discord_dns_query_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-01-unload_sysmon_filter_driver.md b/docs/_posts/2022-06-01-unload_sysmon_filter_driver.md
index d9e39f36c3..4678bd2d68 100644
--- a/docs/_posts/2022-06-01-unload_sysmon_filter_driver.md
+++ b/docs/_posts/2022-06-01-unload_sysmon_filter_driver.md
@@ -112,8 +112,8 @@ Attackers often disable security tools to avoid detection. This search looks for
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **unload_sysmon_filter_driver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md
index 2a5120831a..e4ce581afd 100644
--- a/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md
+++ b/docs/_posts/2022-06-01-wermgr_process_connecting_to_ip_check_web_services.md
@@ -106,8 +106,8 @@ this search is designed to detect suspicious wermgr.exe process that tries to co
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **wermgr_process_connecting_to_ip_check_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_hunting_path_traversal.md b/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_hunting_path_traversal.md
index 5cf67ffda2..45e5636f24 100644
--- a/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_hunting_path_traversal.md
+++ b/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_hunting_path_traversal.md
@@ -113,8 +113,8 @@ The following analytic identifies path traversal command-line execution and shou
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_command_and_scripting_interpreter_hunting_path_traversal_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_path_traversal_exec.md b/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_path_traversal_exec.md
index 2fc3ac0770..7d1376be5b 100644
--- a/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_path_traversal_exec.md
+++ b/docs/_posts/2022-06-01-windows_command_and_scripting_interpreter_path_traversal_exec.md
@@ -108,8 +108,8 @@ The following analytic identifies path traversal command-line execution. This te
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_command_and_scripting_interpreter_path_traversal_exec_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-01-windows_installutil_credential_theft.md b/docs/_posts/2022-06-01-windows_installutil_credential_theft.md
index 08612d4668..41f5193809 100644
--- a/docs/_posts/2022-06-01-windows_installutil_credential_theft.md
+++ b/docs/_posts/2022-06-01-windows_installutil_credential_theft.md
@@ -110,8 +110,8 @@ During triage review resulting network connections, file modifications, and para
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **windows_installutil_credential_theft_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md b/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md
index 1b2f7f7471..dfadb5ea68 100644
--- a/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md
+++ b/docs/_posts/2022-06-03-excessive_usage_of_nslookup_app.md
@@ -106,8 +106,8 @@ This search is to detect potential DNS exfiltration using nslookup application.
 
 #### Macros
 The SPL above uses the following Macros:
-* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
 
 > :information_source:
 > **excessive_usage_of_nslookup_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-03-java_writing_jsp_file.md b/docs/_posts/2022-06-03-java_writing_jsp_file.md
index d3e2e2bd8d..2179360efe 100644
--- a/docs/_posts/2022-06-03-java_writing_jsp_file.md
+++ b/docs/_posts/2022-06-03-java_writing_jsp_file.md
@@ -118,8 +118,8 @@ The following analytic identifies the process java writing a .jsp to disk. This
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **java_writing_jsp_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-03-linux_iptables_firewall_modification.md b/docs/_posts/2022-06-03-linux_iptables_firewall_modification.md
index c8c2e104f4..8712816018 100644
--- a/docs/_posts/2022-06-03-linux_iptables_firewall_modification.md
+++ b/docs/_posts/2022-06-03-linux_iptables_firewall_modification.md
@@ -121,8 +121,8 @@ This analytic looks for suspicious commandline that modify the iptables firewall
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **linux_iptables_firewall_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_context_menu.md b/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_context_menu.md
index 62bf07e929..055066a576 100644
--- a/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_context_menu.md
+++ b/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_context_menu.md
@@ -112,8 +112,8 @@ The search looks for the deletion of Windows Defender context menu within the re
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_impair_defense_delete_win_defender_context_menu_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_profile_registry.md b/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_profile_registry.md
index 2ee02c8b43..13f5c42b38 100644
--- a/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_profile_registry.md
+++ b/docs/_posts/2022-06-07-windows_impair_defense_delete_win_defender_profile_registry.md
@@ -112,8 +112,8 @@ The search looks for the deletion of Windows Defender main profile within the re
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_impair_defense_delete_win_defender_profile_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-07-windows_impair_defenses_disable_win_defender_auto_logging.md b/docs/_posts/2022-06-07-windows_impair_defenses_disable_win_defender_auto_logging.md
index d1dc25d726..1dc2c0cb10 100644
--- a/docs/_posts/2022-06-07-windows_impair_defenses_disable_win_defender_auto_logging.md
+++ b/docs/_posts/2022-06-07-windows_impair_defenses_disable_win_defender_auto_logging.md
@@ -112,8 +112,8 @@ The search looks for the Registry Key DefenderApiLogger or DefenderAuditLogger s
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_impair_defenses_disable_win_defender_auto_logging_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-13-windows_msiexec_spawn_discovery_command.md b/docs/_posts/2022-06-13-windows_msiexec_spawn_discovery_command.md
index bf1f48f10d..13556e097f 100644
--- a/docs/_posts/2022-06-13-windows_msiexec_spawn_discovery_command.md
+++ b/docs/_posts/2022-06-13-windows_msiexec_spawn_discovery_command.md
@@ -108,8 +108,8 @@ The following analytic identifies MSIExec spawning multiple discovery commands,
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_msiexec_spawn_discovery_command_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-14-windows_msiexec_dllregisterserver.md b/docs/_posts/2022-06-14-windows_msiexec_dllregisterserver.md
index dbe69e5b23..3ad5ce4a1d 100644
--- a/docs/_posts/2022-06-14-windows_msiexec_dllregisterserver.md
+++ b/docs/_posts/2022-06-14-windows_msiexec_dllregisterserver.md
@@ -108,9 +108,9 @@ The following analytic identifies the usage of msiexec.exe using the /y switch p
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_msiexec](https://github.com/splunk/security_content/blob/develop/macros/process_msiexec.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_msiexec_dllregisterserver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-14-windows_msiexec_unregister_dllregisterserver.md b/docs/_posts/2022-06-14-windows_msiexec_unregister_dllregisterserver.md
index e326fbba0b..cbeb3d8cca 100644
--- a/docs/_posts/2022-06-14-windows_msiexec_unregister_dllregisterserver.md
+++ b/docs/_posts/2022-06-14-windows_msiexec_unregister_dllregisterserver.md
@@ -108,9 +108,9 @@ The following analytic identifies the usage of msiexec.exe using the /z switch p
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_msiexec](https://github.com/splunk/security_content/blob/develop/macros/process_msiexec.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_msiexec_unregister_dllregisterserver_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-16-detect_risky_spl_using_pretrained_ml_model.md b/docs/_posts/2022-06-16-detect_risky_spl_using_pretrained_ml_model.md
new file mode 100644
index 0000000000..6bc96fbb5e
--- /dev/null
+++ b/docs/_posts/2022-06-16-detect_risky_spl_using_pretrained_ml_model.md
@@ -0,0 +1,167 @@
+---
+title: "Detect Risky SPL using Pretrained ML Model"
+excerpt: "Command and Scripting Interpreter
+"
+categories:
+  - Application
+last_modified_at: 2022-06-16
+toc: true
+toc_label: ""
+tags:
+  - Command and Scripting Interpreter
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - CVE-2022-32154
+  - Splunk_Audit
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic uses a pretrained machine learning text classifier to detect potentially risky commands. The model is trained independently and then the model file is packaged within ESCU for usage. A command is deemed risky based on the presence of certain trigger keywords, along with the context and the role of the user (please see references). The model uses custom features to predict whether a SPL is risky using text classification. The model takes as input the command text, user and search type and outputs a risk score between [0,1]. A high score indicates higher likelihood of a command being risky. This model is on-prem only.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Splunk_Audit](https://docs.splunk.com/Documentation/CIM/latest/User/SplunkAudit)
+- **Last Updated**: 2022-06-16
+- **Author**: Abhinav Mishra, Kumar Sharad, Namratha Sreekanta and Xiao Lin, Splunk
+- **ID**: b4aefb5f-1037-410d-a149-1e091288ba33
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Actions on Objectives
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.AE
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 6
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+| ID          | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2022-32154](https://nvd.nist.gov/vuln/detail/CVE-2022-32154) | Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities can limit access to some custom and potentially risky commands (https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/SPLsafeguards#New_capabilities_can_limit_access_to_some_custom_and_potentially_risky_commands) for more information. Note that the attack is browser-based and an attacker cannot exploit it at will. | 4.0 |
+
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Splunk_Audit.Search_Activity where Search_Activity.search_type=adhoc Search_Activity.user!=splunk-system-user by Search_Activity.search Search_Activity.user Search_Activity.search_type 
+| eval spl_text = 'Search_Activity.search'. " " .'Search_Activity.user'. " " .'Search_Activity.search_type'
+| dedup spl_text 
+| apply risky_spl_pre_trained_model 
+| where risk_score > 0.5 
+| `drop_dm_object_name(Search_Activity)` 
+| table search, user, search_type, risk_score 
+| `detect_risky_spl_using_pretrained_ml_model_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **detect_risky_spl_using_pretrained_ml_model_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Search_Activity.search
+* Search_Activity.user
+* Search_Activity.search_type
+
+
+#### How To Implement
+This detection depends on the MLTK app which can be found here - https://splunkbase.splunk.com/app/2890/ and the Splunk Audit datamodel which can be found here - https://splunkbase.splunk.com/app/1621/. Additionally, you need to be ingesting logs which include Search_Activity.search, Search_Activity.user, Search_Activity.search_type from your endpoints. The risk score threshold should be adjusted based on the environment. The detection uses a custom MLTK model hence we need a few more steps for deployment, as outlined here - https://gist.github.com/ksharad-splunk/be2a62227966049047f5e5c4f2adcabb.
+
+#### Known False Positives
+False positives may be present if suspicious behavior is observed, as determined by frequent usage of risky keywords.
+
+#### Associated Analytic story
+* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 20.0 | 50 | 40 | A potentially risky Splunk command has been run by $user$, kindly review. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning](https://docs.splunk.com/Documentation/Splunk/latest/Security/SPLsafeguards#Commands_that_trigger_the_warning)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt](https://github.com/splunk/attack_data/raw/master/datasets/attack_techniques/T1203/search_activity.txt)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/application/detect_risky_spl_using_pretrained_ml_model.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-16-windows_msiexec_remote_download.md b/docs/_posts/2022-06-16-windows_msiexec_remote_download.md
index 9eb65b46da..42ead5cf1b 100644
--- a/docs/_posts/2022-06-16-windows_msiexec_remote_download.md
+++ b/docs/_posts/2022-06-16-windows_msiexec_remote_download.md
@@ -108,9 +108,9 @@ The following analytic identifies msiexec.exe with http in the command-line. Thi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_msiexec](https://github.com/splunk/security_content/blob/develop/macros/process_msiexec.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_msiexec_remote_download_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-16-windows_msiexec_with_network_connections.md b/docs/_posts/2022-06-16-windows_msiexec_with_network_connections.md
index 564457c1da..d0b36e3649 100644
--- a/docs/_posts/2022-06-16-windows_msiexec_with_network_connections.md
+++ b/docs/_posts/2022-06-16-windows_msiexec_with_network_connections.md
@@ -112,9 +112,9 @@ The following analytic identifies MSIExec with any network connection over port
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_msiexec](https://github.com/splunk/security_content/blob/develop/macros/process_msiexec.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **windows_msiexec_with_network_connections_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-21-aws_ecr_container_scanning_findings_high.md b/docs/_posts/2022-06-21-aws_ecr_container_scanning_findings_high.md
index 0fff8fa536..68334536f8 100644
--- a/docs/_posts/2022-06-21-aws_ecr_container_scanning_findings_high.md
+++ b/docs/_posts/2022-06-21-aws_ecr_container_scanning_findings_high.md
@@ -119,8 +119,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 > :information_source:
 > **aws_ecr_container_scanning_findings_high_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-21-windows_gather_victim_network_info_through_ip_check_web_services.md b/docs/_posts/2022-06-21-windows_gather_victim_network_info_through_ip_check_web_services.md
new file mode 100644
index 0000000000..44652880cc
--- /dev/null
+++ b/docs/_posts/2022-06-21-windows_gather_victim_network_info_through_ip_check_web_services.md
@@ -0,0 +1,169 @@
+---
+title: "Windows Gather Victim Network Info Through Ip Check Web Services"
+excerpt: "IP Addresses
+, Gather Victim Network Information
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-21
+toc: true
+toc_label: ""
+tags:
+  - IP Addresses
+  - Gather Victim Network Information
+  - Reconnaissance
+  - Reconnaissance
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies process that attempts to connect to a known IP web services. This technique is commonly used by trickbot and other malware to perform reconnaissance against the infected machine and look for its IP address.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-21
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 70f7c952-0758-46d6-9148-d8969c4481d1
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1590.005](https://attack.mitre.org/techniques/T1590/005/) | IP Addresses | Reconnaissance |
+
+| [T1590](https://attack.mitre.org/techniques/T1590/) | Gather Victim Network Information | Reconnaissance |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`sysmon` EventCode=22  QueryName IN ("*wtfismyip.com", "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com", "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org", "*cbl.abuseat.org", "*b.barracudacentral.org", "*dnsbl-1.uceprotect.net", "*spam.dnsbl.sorbs.net", "*iplogger.org*", "*ip-api.com*") 
+|  stats  min(_time) as firstTime max(_time) as lastTime count by  Image ProcessId QueryName QueryStatus QueryResults Computer EventCode 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_gather_victim_network_info_through_ip_check_web_services_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+
+> :information_source:
+> **windows_gather_victim_network_info_through_ip_check_web_services_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Image
+* ProcessId
+* QueryName
+* QueryStatus
+* QueryResults
+* Computer
+* EventCode
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name, dns query name process path , and query ststus from your endpoints like EventCode 22. If you are using Sysmon, you must have at least version 12 of the Sysmon TA.
+
+#### Known False Positives
+Filter internet browser application to minimize the false positive of this detection.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 25.0 | 50 | 50 | process connecting IP location web services on $Computer$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-21-windows_remote_services_allow_rdp_in_firewall.md b/docs/_posts/2022-06-21-windows_remote_services_allow_rdp_in_firewall.md
new file mode 100644
index 0000000000..9f289eb00b
--- /dev/null
+++ b/docs/_posts/2022-06-21-windows_remote_services_allow_rdp_in_firewall.md
@@ -0,0 +1,171 @@
+---
+title: "Windows Remote Services Allow Rdp In Firewall"
+excerpt: "Remote Desktop Protocol
+, Remote Services
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-21
+toc: true
+toc_label: ""
+tags:
+  - Remote Desktop Protocol
+  - Remote Services
+  - Lateral Movement
+  - Lateral Movement
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is to identify a modification in the Windows firewall to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer to remotely access the compromised or targeted host by allowing this protocol in firewall. Even this protocol might be allowed in some production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through firewall which is also common traits of attack to start lateral movement.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-21
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 9170cb54-ea15-41e1-9dfc-9f3363ce9b02
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement |
+
+| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "netsh.exe" OR Processes.original_file_name= "netsh.exe") AND Processes.process = "*firewall*" AND Processes.process = "*add*" AND Processes.process = "*protocol=TCP*" AND Processes.process = "*localport=3389*" AND Processes.process = "*action=allow*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_remote_services_allow_rdp_in_firewall_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_remote_services_allow_rdp_in_firewall_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.process_name
+* Processes.process
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.process_id
+* Processes.parent_process_id
+* Processes.dest
+* Processes.user
+
+
+#### How To Implement
+To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+#### Known False Positives
+administrators may enable or disable this feature that may cause some false positive.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | new firewall rules was added to allow rdp connection to $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-21-windows_remote_services_allow_remote_assistance.md b/docs/_posts/2022-06-21-windows_remote_services_allow_remote_assistance.md
new file mode 100644
index 0000000000..1467125892
--- /dev/null
+++ b/docs/_posts/2022-06-21-windows_remote_services_allow_remote_assistance.md
@@ -0,0 +1,170 @@
+---
+title: "Windows Remote Services Allow Remote Assistance"
+excerpt: "Remote Desktop Protocol
+, Remote Services
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-21
+toc: true
+toc_label: ""
+tags:
+  - Remote Desktop Protocol
+  - Remote Services
+  - Lateral Movement
+  - Lateral Movement
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is to identify a modification in the Windows registry to enable remote desktop assistance on a targeted machine. This technique was seen in several adversaries, malware or red teamer like azorult to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This Anomaly behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common. And as per stated in microsoft documentation the default value of this registry is false that makes this a good indicator of suspicious behavior.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-21
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 9bce3a97-bc97-4e89-a1aa-ead151c82fbb
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement |
+
+| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal Server\\fAllowToGetHelp*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+| `drop_dm_object_name(Registry)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_remote_services_allow_remote_assistance_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_remote_services_allow_remote_assistance_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+administrators may enable or disable this feature that may cause some false positive.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | the registry for rdp protocol was modified to enable in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp](https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp)
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_remote_services_allow_remote_assistance.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-21-windows_remote_services_rdp_enable.md b/docs/_posts/2022-06-21-windows_remote_services_rdp_enable.md
new file mode 100644
index 0000000000..ffd7f8fac5
--- /dev/null
+++ b/docs/_posts/2022-06-21-windows_remote_services_rdp_enable.md
@@ -0,0 +1,169 @@
+---
+title: "Windows Remote Services Rdp Enable"
+excerpt: "Remote Desktop Protocol
+, Remote Services
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-21
+toc: true
+toc_label: ""
+tags:
+  - Remote Desktop Protocol
+  - Remote Services
+  - Lateral Movement
+  - Lateral Movement
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is to identify a modification in the Windows registry to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-21
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 8fbd2e88-4ea5-40b9-9217-fd0855e08cc0
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement |
+
+| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Control\\Terminal Server\\fDenyTSConnections*" Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+| `drop_dm_object_name(Registry)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_remote_services_rdp_enable_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_remote_services_rdp_enable_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+administrators may enable or disable this feature that may cause some false positive.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | the registry for rdp protocol was modified to enable in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://www.hybrid-analysis.com/sample/9d6611c2779316f1ef4b4a6edcfdfb5e770fe32b31ec2200df268c3bd236ed75?environmentId=100](https://www.hybrid-analysis.com/sample/9d6611c2779316f1ef4b4a6edcfdfb5e770fe32b31ec2200df268c3bd236ed75?environmentId=100)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_remote_services_rdp_enable.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-21-windows_service_stop_by_deletion.md b/docs/_posts/2022-06-21-windows_service_stop_by_deletion.md
new file mode 100644
index 0000000000..fe4e2a8944
--- /dev/null
+++ b/docs/_posts/2022-06-21-windows_service_stop_by_deletion.md
@@ -0,0 +1,168 @@
+---
+title: "Windows Service Stop By Deletion"
+excerpt: "Service Stop
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-21
+toc: true
+toc_label: ""
+tags:
+  - Service Stop
+  - Impact
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue there objective and evade detections.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-21
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 196ff536-58d9-4d1b-9686-b176b04e430b
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = sc.exe OR Processes.original_file_name = sc.exe) Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_service_stop_by_deletion_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_service_stop_by_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.process_name
+* Processes.process
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.process_id
+* Processes.parent_process_id
+* Processes.dest
+* Processes.user
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+#### Known False Positives
+It is possible administrative scripts may start/stop/delete services. Filter as needed.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to delete a service. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_service_stop_by_deletion.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-22-windows_modify_registry_disable_toast_notifications.md b/docs/_posts/2022-06-22-windows_modify_registry_disable_toast_notifications.md
new file mode 100644
index 0000000000..d49d990792
--- /dev/null
+++ b/docs/_posts/2022-06-22-windows_modify_registry_disable_toast_notifications.md
@@ -0,0 +1,165 @@
+---
+title: "Windows Modify Registry Disable Toast Notifications"
+excerpt: "Modify Registry
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-22
+toc: true
+toc_label: ""
+tags:
+  - Modify Registry
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is to identify a modification in the Windows registry to disable toast notifications. This Windows Operating System feature is responsible for alerting or notifying user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion and execution.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-22
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: ed4eeacb-8d5a-488e-bc97-1ce6ded63b84
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\\ToastEnabled*" Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+| `drop_dm_object_name(Registry)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_modify_registry_disable_toast_notifications_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_modify_registry_disable_toast_notifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+administrators may enable or disable this feature that may cause some false positive.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | the registry for DisallowRun settings was modified to enable in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp](https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp)
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-22-windows_modify_registry_disable_windows_security_center_notif.md b/docs/_posts/2022-06-22-windows_modify_registry_disable_windows_security_center_notif.md
new file mode 100644
index 0000000000..7c5be7d25a
--- /dev/null
+++ b/docs/_posts/2022-06-22-windows_modify_registry_disable_windows_security_center_notif.md
@@ -0,0 +1,165 @@
+---
+title: "Windows Modify Registry Disable Windows Security Center Notif"
+excerpt: "Modify Registry
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-22
+toc: true
+toc_label: ""
+tags:
+  - Modify Registry
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is to identify a modification in the Windows registry to disable windows center notifications. This Windows Operating System feature is responsible for alerting or notifying user if application or OS need some updates. Adversaries and malwares like Azorult abuse this technique to disable important update notification in compromised host. This anomaly detection is a good pivot to look for further events related to defense evasion and execution.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-22
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 27ed3e79-6d86-44dd-b9ab-524451c97a7b
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows\\CurrentVersion\\ImmersiveShell\\UseActionCenterExperience*" Registry.registry_value_data="0x00000000" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+| `drop_dm_object_name(Registry)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_modify_registry_disable_windows_security_center_notif_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_modify_registry_disable_windows_security_center_notif_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+administrators may enable or disable this feature that may cause some false positive.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | the registry for security center notification settings was modified to disable mode in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp](https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp)
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-22-windows_modify_registry_disabling_wer_settings.md b/docs/_posts/2022-06-22-windows_modify_registry_disabling_wer_settings.md
new file mode 100644
index 0000000000..0539f5fe14
--- /dev/null
+++ b/docs/_posts/2022-06-22-windows_modify_registry_disabling_wer_settings.md
@@ -0,0 +1,165 @@
+---
+title: "Windows Modify Registry Disabling WER Settings"
+excerpt: "Modify Registry
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-22
+toc: true
+toc_label: ""
+tags:
+  - Modify Registry
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies a modification in the Windows registry to disable Windows error reporting settings. This Windows feature allows the user to report bugs, errors, failure or problems encountered in specific application or processes. Adversaries use this technique to hide any error or failure that some of its malicious components trigger.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-22
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 21cbcaf1-b51f-496d-a0c1-858ff3070452
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\disable*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+| `drop_dm_object_name(Registry)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_modify_registry_disabling_wer_settings_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_modify_registry_disabling_wer_settings_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+Administrators may enable or disable this feature that may cause some false positive, however is not common. Filter as needed.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | the registry for WER settings was modified to be disabled on $dest$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp](https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp)
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-22-windows_modify_registry_disallow_windows_app.md b/docs/_posts/2022-06-22-windows_modify_registry_disallow_windows_app.md
new file mode 100644
index 0000000000..aaef9baf7c
--- /dev/null
+++ b/docs/_posts/2022-06-22-windows_modify_registry_disallow_windows_app.md
@@ -0,0 +1,164 @@
+---
+title: "Windows Modify Registry DisAllow Windows App"
+excerpt: "Modify Registry
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-22
+toc: true
+toc_label: ""
+tags:
+  - Modify Registry
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies modification in the Windows registry to prevent user running specific computer programs that could aid them in manually removing malware or detecting it using security products. This technique was recently identified in Azorult malware where it uses this registry value to prevent several AV products to execute on the compromised host machine.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-22
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 4bc788d3-c83a-48c5-a4e2-e0c6dba57889
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DisallowRun*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+| `drop_dm_object_name(Registry)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_modify_registry_disallow_windows_app_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_modify_registry_disallow_windows_app_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+Administrators may enable or disable this feature that may cause some false positive. Filter as needed.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | The registry for DisallowRun settings was modified to enable in $dest$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_modify_registry_disallow_windows_app.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-22-windows_modify_registry_suppress_win_defender_notif.md b/docs/_posts/2022-06-22-windows_modify_registry_suppress_win_defender_notif.md
new file mode 100644
index 0000000000..6607e67ca9
--- /dev/null
+++ b/docs/_posts/2022-06-22-windows_modify_registry_suppress_win_defender_notif.md
@@ -0,0 +1,165 @@
+---
+title: "Windows Modify Registry Suppress Win Defender Notif"
+excerpt: "Modify Registry
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-22
+toc: true
+toc_label: ""
+tags:
+  - Modify Registry
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is to identify a modification in the Windows registry to suppress windows defender notification. This technique was abuse by adversaries and threat actor to bypassed windows defender on the targeted host. Azorult malware is one of the malware use this technique that also disable toast notification and other windows features as part of its malicious behavior.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-22
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: e3b42daf-fff4-429d-bec8-2a199468cea9
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\UX Configuration\\Notification_Suppress*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+| `drop_dm_object_name(Registry)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_modify_registry_suppress_win_defender_notif_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_modify_registry_suppress_win_defender_notif_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+administrators may enable or disable this feature that may cause some false positive.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | the registry for suppresing windows fdefender notification settings was modified to disabled in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp](https://docs.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-remoteassistance-exe-fallowtogethelp)
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-22-windows_powerview_kerberos_service_ticket_request.md b/docs/_posts/2022-06-22-windows_powerview_kerberos_service_ticket_request.md
index fb91675dfa..60344e0f16 100644
--- a/docs/_posts/2022-06-22-windows_powerview_kerberos_service_ticket_request.md
+++ b/docs/_posts/2022-06-22-windows_powerview_kerberos_service_ticket_request.md
@@ -102,8 +102,8 @@ The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
 #### Search 
 
 ```
-`powershell` EventCode=4104 Message=*Get-DomainSPNTicket* 
-| stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
+`powershell` EventCode=4104 ScriptBlockText=*Get-DomainSPNTicket* 
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer 
 | `security_content_ctime(firstTime)` 
 | `security_content_ctime(lastTime)` 
 | `windows_powerview_kerberos_service_ticket_request_filter`
@@ -120,9 +120,8 @@ The SPL above uses the following Macros:
 #### Required field
 * _time
 * EventCode
-* Result_Code
-* Account_Name
-* Client_Address
+* Computer
+* ScriptBlockText
 
 
 #### How To Implement
@@ -141,7 +140,7 @@ False positive may include Administrators using PowerView for troubleshooting an
 
 | Risk Score  | Impact      | Confidence   | Message      |
 | ----------- | ----------- |--------------|--------------|
-| 27.0 | 30 | 90 | PowerView commandlets used for requesting SPN service ticket executed on $Computer_Name$ |
+| 27.0 | 30 | 90 | PowerView commandlets used for requesting SPN service ticket executed on $Computer$ |
 
 
 > :information_source:
@@ -162,7 +161,7 @@ Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.
 Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
 
 
-* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/powerview/windows-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/powerview/windows-powershell.log)
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/powerview/windows-powershell-xml.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/powerview/windows-powershell-xml.log)
 
 
 
diff --git a/docs/_posts/2022-06-22-windows_powerview_spn_discovery.md b/docs/_posts/2022-06-22-windows_powerview_spn_discovery.md
index 0e9505a207..5349d48409 100644
--- a/docs/_posts/2022-06-22-windows_powerview_spn_discovery.md
+++ b/docs/_posts/2022-06-22-windows_powerview_spn_discovery.md
@@ -121,9 +121,8 @@ The SPL above uses the following Macros:
 #### Required field
 * _time
 * EventCode
-* Result_Code
-* Account_Name
-* Client_Address
+* Computer
+* ScriptBlockText
 
 
 #### How To Implement
@@ -142,7 +141,7 @@ False positive may include Administrators using PowerView for troubleshooting an
 
 | Risk Score  | Impact      | Confidence   | Message      |
 | ----------- | ----------- |--------------|--------------|
-| 27.0 | 30 | 90 | PowerView commandlets used for SPN discovery executed on $Computer_Name$ |
+| 27.0 | 30 | 90 | PowerView commandlets used for SPN discovery executed on $Computer$ |
 
 
 > :information_source:
diff --git a/docs/_posts/2022-06-22-windows_remote_access_software_rms_registry.md b/docs/_posts/2022-06-22-windows_remote_access_software_rms_registry.md
new file mode 100644
index 0000000000..0f11829f51
--- /dev/null
+++ b/docs/_posts/2022-06-22-windows_remote_access_software_rms_registry.md
@@ -0,0 +1,165 @@
+---
+title: "Windows Remote Access Software RMS Registry"
+excerpt: "Remote Access Software
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-22
+toc: true
+toc_label: ""
+tags:
+  - Remote Access Software
+  - Command And Control
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is to identify a modification or creation of Windows registry related to the Remote Manipulator System (RMS) Remote Admin tool. RMS is a legitimate tool developed by russian organization TektonIT and has been observed being abused by adversaries to gain remote access to the targeted host. Azorult malware utilized RMS to gain remote access.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-22
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: e5b7b5a9-e471-4be8-8c5d-4083983ba329
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1219](https://attack.mitre.org/techniques/T1219/) | Remote Access Software | Command And Control |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SYSTEM\\Remote Manipulator System*" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+| `drop_dm_object_name(Registry)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_remote_access_software_rms_registry_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_remote_access_software_rms_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+administrators may enable or disable this feature that may cause some false positive.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 90.0 | 100 | 90 | the registry related to RMS tool is created in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+* [https://malpedia.caad.fkie.fraunhofer.de/details/win.rms](https://malpedia.caad.fkie.fraunhofer.de/details/win.rms)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_remote_access_software_rms_registry.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-23-windows_modify_registry_disable_win_defender_raw_write_notif.md b/docs/_posts/2022-06-23-windows_modify_registry_disable_win_defender_raw_write_notif.md
new file mode 100644
index 0000000000..ebc12480cd
--- /dev/null
+++ b/docs/_posts/2022-06-23-windows_modify_registry_disable_win_defender_raw_write_notif.md
@@ -0,0 +1,165 @@
+---
+title: "Windows Modify Registry Disable Win Defender Raw Write Notif"
+excerpt: "Modify Registry
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-23
+toc: true
+toc_label: ""
+tags:
+  - Modify Registry
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies a modification in the Windows registry to disable Windows Defender raw write notification feature. This policy controls whether raw volume write notifications are sent to behavior monitoring or not. This registry was recently identified in Azorult malware to bypass Windows Defender detections or behavior monitoring in terms of volume write.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-23
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 0e5e25c3-32f4-46f7-ba4a-5b95c3b90f5b
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\Windows Defender\\Real-Time Protection\\DisableRawWriteNotification*" Registry.registry_value_data="0x00000001" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest 
+| `drop_dm_object_name(Registry)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_modify_registry_disable_win_defender_raw_write_notif_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_modify_registry_disable_win_defender_raw_write_notif_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+Administrators may enable or disable this feature that may cause some false positive. Filter as needed.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | The registry for raw write notification settings was modified to disable in $dest$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://admx.help/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::real-time_protection_disablerawwritenotification](https://admx.help/?Category=SystemCenterEndpointProtection&Policy=Microsoft.Policies.Antimalware::real-time_protection_disablerawwritenotification)
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-23-windows_valid_account_with_never_expires_password.md b/docs/_posts/2022-06-23-windows_valid_account_with_never_expires_password.md
new file mode 100644
index 0000000000..1cd8558d2c
--- /dev/null
+++ b/docs/_posts/2022-06-23-windows_valid_account_with_never_expires_password.md
@@ -0,0 +1,171 @@
+---
+title: "Windows Valid Account With Never Expires Password"
+excerpt: "Service Stop
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-23
+toc: true
+toc_label: ""
+tags:
+  - Service Stop
+  - Impact
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies net.exe updating user account policies for password requirement with non-expiring password. This technique was seen in several adversaries and malware like Azorult to maintain the foothold (persistence), gaining privilege escalation, defense evasion and possible for lateral movement for specific users or created user account on the targeted host. This TTP detections is a good pivot to see further what other events that users executes on the machines.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-23
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 73a931db-1830-48b3-8296-cd9cfa09c3c8
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1489](https://attack.mitre.org/techniques/T1489/) | Service Stop | Impact |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="* accounts *" AND Processes.process="* /maxpwage:unlimited" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_valid_account_with_never_expires_password_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_valid_account_with_never_expires_password_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+#### Known False Positives
+This behavior is not commonly seen in production environment and not advisable, filter as needed.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 100.0 | 100 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to make non-expiring password on host user accounts. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+* [https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/net-commands-on-operating-systems](https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/net-commands-on-operating-systems)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_valid_account_with_never_expires_password.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-24-windows_application_layer_protocol_rms_radmin_tool_namedpipe.md b/docs/_posts/2022-06-24-windows_application_layer_protocol_rms_radmin_tool_namedpipe.md
new file mode 100644
index 0000000000..d7f5b149ab
--- /dev/null
+++ b/docs/_posts/2022-06-24-windows_application_layer_protocol_rms_radmin_tool_namedpipe.md
@@ -0,0 +1,164 @@
+---
+title: "Windows Application Layer Protocol RMS Radmin Tool Namedpipe"
+excerpt: "Application Layer Protocol
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-24
+toc: true
+toc_label: ""
+tags:
+  - Application Layer Protocol
+  - Command And Control
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies the use of default or publicly known named pipes used by RMX remote admin tool. A named pipe is a named, one-way or duplex pipe for communication between the pipe server and one or more pipe clients. RMX Tool uses named pipes in many way as part of its communication for its server and client component. This tool was abuse by several adversaries and malware like Azorult to collect data to the targeted host. This TTP is a good indicator that this tool was install in production premise and need to check if the user has a valid reason why it need to install this legitimate application.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-24
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: b62a6040-49f4-47c8-b3f6-fc1adb952a33
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1071](https://attack.mitre.org/techniques/T1071/) | Application Layer Protocol | Command And Control |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`sysmon` EventCode IN (17, 18) EventType IN ( "CreatePipe", "ConnectPipe") PipeName IN ("\\RManFUSServerNotify32", "\\RManFUSCallbackNotify32", "\\RMSPrint*") 
+| stats  min(_time) as firstTime max(_time) as lastTime count by Image EventType ProcessId PipeName Computer UserID 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_application_layer_protocol_rms_radmin_tool_namedpipe_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+
+> :information_source:
+> **windows_application_layer_protocol_rms_radmin_tool_namedpipe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Image
+* EventType
+* ProcessId
+* PipeName
+* Computer
+* UserID
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+#### Known False Positives
+False positives may be present. Filter based on pipe name or process.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 81.0 | 90 | 90 | possible RMS admin tool named pipe was created in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+* [https://attack.mitre.org/techniques/T1071/](https://attack.mitre.org/techniques/T1071/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-24-windows_impair_defense_add_xml_applocker_rules.md b/docs/_posts/2022-06-24-windows_impair_defense_add_xml_applocker_rules.md
new file mode 100644
index 0000000000..cc408d6a95
--- /dev/null
+++ b/docs/_posts/2022-06-24-windows_impair_defense_add_xml_applocker_rules.md
@@ -0,0 +1,170 @@
+---
+title: "Windows Impair Defense Add Xml Applocker Rules"
+excerpt: "Disable or Modify Tools
+, Impair Defenses
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-24
+toc: true
+toc_label: ""
+tags:
+  - Disable or Modify Tools
+  - Impair Defenses
+  - Defense Evasion
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is to identify a process that imports applocker xml policy using PowerShell commandlet. This technique was seen in Azorult malware where it drop an xml Applocker policy that will deny several AV products and further executed the PowerShell Applocker commandlet.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-24
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 467ed9d9-8035-470e-ad5e-ae5189283033
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
+
+| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` AND Processes.process="*Import-Module Applocker*" AND Processes.process="*Set-AppLockerPolicy *"  AND Processes.process="* -XMLPolicy *" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_impair_defense_add_xml_applocker_rules_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_impair_defense_add_xml_applocker_rules_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.user
+* Registry.dest
+* Registry.registry_value_name
+* Registry.action
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+Administrators may execute this command that may cause some false positive.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 25.0 | 50 | 50 | Applocker importing xml policy command was executed in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-24-windows_impair_defense_deny_security_software_with_applocker.md b/docs/_posts/2022-06-24-windows_impair_defense_deny_security_software_with_applocker.md
new file mode 100644
index 0000000000..adda0f0a97
--- /dev/null
+++ b/docs/_posts/2022-06-24-windows_impair_defense_deny_security_software_with_applocker.md
@@ -0,0 +1,175 @@
+---
+title: "Windows Impair Defense Deny Security Software With Applocker"
+excerpt: "Disable or Modify Tools
+, Impair Defenses
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-24
+toc: true
+toc_label: ""
+tags:
+  - Disable or Modify Tools
+  - Impair Defenses
+  - Defense Evasion
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies a modification in the Windows registry by the Applocker utility that contains details or registry data values related to denying the execution of several security products. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV products and then loaded by using PowerShell Applocker commandlet.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-24
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: e0b6ca60-9e29-4450-b51a-bba0abae2313
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
+
+| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy Objects\\*" AND Registry.registry_path= "*}Machine\\Software\\Policies\\Microsoft\\Windows\\SrpV2*") OR Registry.registry_path="*\\Software\\Policies\\Microsoft\\Windows\\SrpV2*" AND Registry.registry_value_data = "*Action\=\"Deny\"*" AND Registry.registry_value_data IN("*O=SYMANTEC*","*O=MCAFEE*","*O=KASPERSKY*","*O=BLEEPING COMPUTER*", "*O=PANDA SECURITY*","*O=SYSTWEAK SOFTWARE*", "*O=TREND MICRO*", "*O=AVAST*", "*O=GRIDINSOFT*", "*O=MICROSOFT*", "*O=NANO SECURITY*", "*O=SUPERANTISPYWARE.COM*", "*O=DOCTOR WEB*", "*O=MALWAREBYTES*", "*O=ESET*", "*O=AVIRA*", "*O=WEBROOT*") by  Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.registry_key_name Registry.dest 
+| `drop_dm_object_name(Registry)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_impair_defense_deny_security_software_with_applocker_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_impair_defense_deny_security_software_with_applocker_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+False positives may be present based on organization use of Applocker. Filter as needed.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 100.0 | 100 | 100 | Applocker registry modification to deny the action of several AV products on $dest$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+* [https://www.microsoftpressstore.com/articles/article.aspx?p=2228450&seqNum=11](https://www.microsoftpressstore.com/articles/article.aspx?p=2228450&seqNum=11)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-24-windows_modify_registry_regedit_silent_reg_import.md b/docs/_posts/2022-06-24-windows_modify_registry_regedit_silent_reg_import.md
new file mode 100644
index 0000000000..37d6241173
--- /dev/null
+++ b/docs/_posts/2022-06-24-windows_modify_registry_regedit_silent_reg_import.md
@@ -0,0 +1,170 @@
+---
+title: "Windows Modify Registry Regedit Silent Reg Import"
+excerpt: "Modify Registry
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-24
+toc: true
+toc_label: ""
+tags:
+  - Modify Registry
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies modification of Windows registry using regedit.exe application with silent mode parameter. regedit.exe windows application is commonly used as GUI app to check or modify registry. This application is also has undocumented command-line parameter and one of those are silent mode parameter that performs action without stopping for confirmation with dialog box. Importing registry from .reg files need to monitor in a production environment since it can be used adversaries to import RMS registry in compromised host.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-24
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 824dd598-71be-4203-bc3b-024f4cda340e
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="regedit.exe" OR Processes.original_file_name="regedit.exe") AND Processes.process="* /s *" AND Processes.process="*.reg*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_modify_registry_regedit_silent_reg_import_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_modify_registry_regedit_silent_reg_import_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+Administrators may execute this command that may cause some false positive. Filter as needed.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | The regedit app was executed with silet mode parameter to import .reg file on $dest$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+* [https://www.techtarget.com/searchwindowsserver/tip/Command-line-options-for-Regeditexe](https://www.techtarget.com/searchwindowsserver/tip/Command-line-options-for-Regeditexe)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-24-windows_remote_service_rdpwinst_tool_execution.md b/docs/_posts/2022-06-24-windows_remote_service_rdpwinst_tool_execution.md
new file mode 100644
index 0000000000..7c0dcff0eb
--- /dev/null
+++ b/docs/_posts/2022-06-24-windows_remote_service_rdpwinst_tool_execution.md
@@ -0,0 +1,174 @@
+---
+title: "Windows Remote Service Rdpwinst Tool Execution"
+excerpt: "Remote Desktop Protocol
+, Remote Services
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-24
+toc: true
+toc_label: ""
+tags:
+  - Remote Desktop Protocol
+  - Remote Services
+  - Lateral Movement
+  - Lateral Movement
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies RDPWInst.exe tool, which is a RDP wrapper library tool designed to enable remote desktop host support and concurrent RDP session on reduced functionality system. Unfortunately, this open project was abused by adversaries to enable RDP connection to the targeted host for remote access and potentially be for lateral movement.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-24
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: c8127f87-c7c9-4036-89ed-8fe4b30e678c
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement |
+
+| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="RDPWInst.exe" OR Processes.original_file_name="RDPWInst.exe") AND Processes.process IN ("* -i*", "* -s*", "* -o*", "* -w*", "* -r*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_remote_service_rdpwinst_tool_execution_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_remote_service_rdpwinst_tool_execution_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+This tool was designed for home usage and not commonly seen in production environment. Filter as needed.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 81.0 | 90 | 90 | Rdpwinst.exe executed on $dest$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-28-outbound_network_connection_from_java_using_default_ports.md b/docs/_posts/2022-06-28-outbound_network_connection_from_java_using_default_ports.md
index f615c98d58..94f1061cf6 100644
--- a/docs/_posts/2022-06-28-outbound_network_connection_from_java_using_default_ports.md
+++ b/docs/_posts/2022-06-28-outbound_network_connection_from_java_using_default_ports.md
@@ -113,8 +113,8 @@ A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 > :information_source:
 > **outbound_network_connection_from_java_using_default_ports_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2022-06-28-windows_odbcconf_load_dll.md b/docs/_posts/2022-06-28-windows_odbcconf_load_dll.md
new file mode 100644
index 0000000000..c2c36b461e
--- /dev/null
+++ b/docs/_posts/2022-06-28-windows_odbcconf_load_dll.md
@@ -0,0 +1,170 @@
+---
+title: "Windows Odbcconf Load DLL"
+excerpt: "Odbcconf
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-28
+toc: true
+toc_label: ""
+tags:
+  - Odbcconf
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies odbcconf.exe, Windows Open Database Connectivity utility, utilizing the action function of regsvr to load a DLL. An example will look like - odbcconf.exe /A { REGSVR T1218-2.dll }. During triage, review parent process, parallel procesess and file modifications.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-28
+- **Author**: Michael Haag, Splunk
+- **ID**: 141e7fca-a9f0-40fd-a539-9aac8be41f1b
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1218.008](https://attack.mitre.org/techniques/T1218/008/) | Odbcconf | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe Processes.process IN ("*/a *",  "*-a*") Processes.process="*regsvr*"  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_odbcconf_load_dll_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_odbcconf_load_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed.
+
+#### Associated Analytic story
+* [Living Off The Land](/stories/living_off_the_land)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 42.0 | 60 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html](https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html)
+* [https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw](https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_odbcconf_load_dll.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-29-remote_system_discovery_with_adsisearcher.md b/docs/_posts/2022-06-29-remote_system_discovery_with_adsisearcher.md
new file mode 100644
index 0000000000..1850a59000
--- /dev/null
+++ b/docs/_posts/2022-06-29-remote_system_discovery_with_adsisearcher.md
@@ -0,0 +1,154 @@
+---
+title: "Remote System Discovery with Adsisearcher"
+excerpt: "Remote System Discovery
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-29
+toc: true
+toc_label: ""
+tags:
+  - Remote System Discovery
+  - Discovery
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain computers for situational awareness and Active Directory Discovery.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+- **Last Updated**: 2022-06-29
+- **Author**: Mauricio Velazco, Splunk
+- **ID**: 70803451-0047-4e12-9d63-77fa7eb8649c
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1018](https://attack.mitre.org/techniques/T1018/) | Remote System Discovery | Discovery |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText = "*adsisearcher*" AND ScriptBlockText = "*objectcategory=computer*" AND ScriptBlockText IN ("*findAll()*","*findOne()*") 
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
+| `security_content_ctime(firstTime)` 
+| `remote_system_discovery_with_adsisearcher_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **remote_system_discovery_with_adsisearcher_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* EventCode
+* ScriptBlockText
+* Computer
+* UserID
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+Administrators or power users may use Adsisearcher for troubleshooting.
+
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 15.0 | 30 | 50 | Remote system discovery enumeration on $Computer$ by $user$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1018/](https://attack.mitre.org/techniques/T1018/)
+* [https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/](https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/remote_system_discovery_with_adsisearcher.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-29-windows_execute_arbitrary_commands_with_msdt.md b/docs/_posts/2022-06-29-windows_execute_arbitrary_commands_with_msdt.md
new file mode 100644
index 0000000000..8e2345bdb3
--- /dev/null
+++ b/docs/_posts/2022-06-29-windows_execute_arbitrary_commands_with_msdt.md
@@ -0,0 +1,179 @@
+---
+title: "Windows Execute Arbitrary Commands with MSDT"
+excerpt: "System Binary Proxy Execution
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-29
+toc: true
+toc_label: ""
+tags:
+  - System Binary Proxy Execution
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - CVE-2022-30190
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies a recently disclosed arbitraty command execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve a remote payload. During triage, review file modifications for html. Identify parallel process execution that may be related, including an Office Product.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-29
+- **Author**: Michael Haag, Teoderick Contreras, Splunk
+- **ID**: e1d5145f-38fe-42b9-a5d5-457796715f97
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+| ID          | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2022-30190](https://nvd.nist.gov/vuln/detail/CVE-2022-30190) | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability. | 9.3 |
+
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msdt.exe Processes.process IN ("*msdt*","*ms-msdt:*","*ms-msdt:/id*","*ms-msdt:-id*","*/id*") AND (Processes.process="*IT_BrowseForFile=*" OR Processes.process="*IT_RebrowseForFile=*" OR Processes.process="*.xml*") AND Processes.process="*PCWDiagnostic*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`
+| `windows_execute_arbitrary_commands_with_msdt_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_execute_arbitrary_commands_with_msdt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives may be present, filter as needed. Added .xml to potentially capture any answer file usage. Remove as needed.
+
+#### Associated Analytic story
+* [Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190](/stories/microsoft_support_diagnostic_tool_vulnerability_cve-2022-30190)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 100.0 | 100 | 100 | A parent process $parent_process_name$ has spawned a child process $process_name$ on host $dest$ possibly indicative of indirect command execution. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://isc.sans.edu/diary/rss/28694](https://isc.sans.edu/diary/rss/28694)
+* [https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e](https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e)
+* [https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A](https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A)
+* [https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/](https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/)
+* [https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection](https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection)
+* [https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html](https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-30-windows_odbcconf_hunting.md b/docs/_posts/2022-06-30-windows_odbcconf_hunting.md
new file mode 100644
index 0000000000..f8fde50f98
--- /dev/null
+++ b/docs/_posts/2022-06-30-windows_odbcconf_hunting.md
@@ -0,0 +1,170 @@
+---
+title: "Windows Odbcconf Hunting"
+excerpt: "Odbcconf
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-30
+toc: true
+toc_label: ""
+tags:
+  - Odbcconf
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies Odbcconf.exe running in the environment to assist with identifying tuning higher fidelity analytics related to Odbcconf.exe.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-30
+- **Author**: Michael Haag, Splunk
+- **ID**: 0562ad4b-fdaa-4882-b12f-7b8e0034cd72
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1218.008](https://attack.mitre.org/techniques/T1218/008/) | Odbcconf | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_odbcconf_hunting_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_odbcconf_hunting_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives will be present as this is meant to assist with filtering and tuning.
+
+#### Associated Analytic story
+* [Living Off The Land](/stories/living_off_the_land)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 6.0 | 30 | 20 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html](https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html)
+* [https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw](https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-regsvr.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_odbcconf_hunting.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-30-windows_odbcconf_load_response_file.md b/docs/_posts/2022-06-30-windows_odbcconf_load_response_file.md
new file mode 100644
index 0000000000..cf4d7d60ee
--- /dev/null
+++ b/docs/_posts/2022-06-30-windows_odbcconf_load_response_file.md
@@ -0,0 +1,170 @@
+---
+title: "Windows Odbcconf Load Response File"
+excerpt: "Odbcconf
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-30
+toc: true
+toc_label: ""
+tags:
+  - Odbcconf
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies the odbcconf.exe, Windows Open Database Connectivity utility, loading up a resource file. The file extension is arbitrary and may be named anything. The resource file itself may have different commands supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands. During triage, review file modifications and parallel processes.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-30
+- **Author**: Michael Haag, Splunk
+- **ID**: 1acafff9-1347-4b40-abae-f35aa4ba85c1
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1218.008](https://attack.mitre.org/techniques/T1218/008/) | Odbcconf | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=odbcconf.exe Processes.process IN ("*-f *","*/f *") Processes.process="*.rsp*"  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_odbcconf_load_response_file_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_odbcconf_load_response_file_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives may be present and filtering may need to occur based on legitimate application usage. Filter as needed.
+
+#### Associated Analytic story
+* [Living Off The Land](/stories/living_off_the_land)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 42.0 | 60 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to circumvent controls. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html](https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html)
+* [https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw](https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-rsp.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/windows-sysmon-odbc-rsp.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_odbcconf_load_response_file.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-06-30-windows_powershell_import_applocker_policy.md b/docs/_posts/2022-06-30-windows_powershell_import_applocker_policy.md
new file mode 100644
index 0000000000..f569b01de2
--- /dev/null
+++ b/docs/_posts/2022-06-30-windows_powershell_import_applocker_policy.md
@@ -0,0 +1,160 @@
+---
+title: "Windows Powershell Import Applocker Policy"
+excerpt: "PowerShell
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-06-30
+toc: true
+toc_label: ""
+tags:
+  - PowerShell
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is to identify the imports of Windows PowerShell Applocker commandlets. This technique was seen in Azorult malware where it drops an xml Applocker policy that will deny several AV product and then loaded using PowerShell Applocker commandlet.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-30
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 102af98d-0ca3-4aa4-98d6-7ab2b98b955a
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1059.001](https://attack.mitre.org/techniques/T1059/001/) | PowerShell | Execution |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+`powershell` EventCode=4104 ScriptBlockText="*Import-Module Applocker*" ScriptBlockText="*Set-AppLockerPolicy *" ScriptBlockText="* -XMLPolicy *" 
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_powershell_import_applocker_policy_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [powershell](https://github.com/splunk/security_content/blob/develop/macros/powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **windows_powershell_import_applocker_policy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* ScriptBlockText
+* Computer
+* EventCode
+
+
+#### How To Implement
+To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+
+#### Known False Positives
+administrators may execute this command that may cause some false positive.
+
+#### Associated Analytic story
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | A PowerShell script contains Import Applocker Policy command $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/import_applocker_policy/windows-powershell-xml2.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/import_applocker_policy/windows-powershell-xml2.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_powershell_import_applocker_policy.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-07-office_product_writing_cab_or_inf.md b/docs/_posts/2022-07-07-office_product_writing_cab_or_inf.md
new file mode 100644
index 0000000000..e83936c782
--- /dev/null
+++ b/docs/_posts/2022-07-07-office_product_writing_cab_or_inf.md
@@ -0,0 +1,177 @@
+---
+title: "Office Product Writing cab or inf"
+excerpt: "Phishing
+, Spearphishing Attachment
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-07-07
+toc: true
+toc_label: ""
+tags:
+  - Phishing
+  - Spearphishing Attachment
+  - Initial Access
+  - Initial Access
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - CVE-2021-40444
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies behavior related to CVE-2021-40444. Whereas the malicious document will load ActiveX and download the remote payload (.inf, .cab). During triage, review parallel processes and further activity on endpoint to identify additional patterns. Retrieve the file modifications and analyze further.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-07-07
+- **Author**: Michael Haag, Splunk
+- **ID**: f48cd1d4-125a-11ec-a447-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1566](https://attack.mitre.org/techniques/T1566/) | Phishing | Initial Access |
+
+| [T1566.001](https://attack.mitre.org/techniques/T1566/001/) | Spearphishing Attachment | Initial Access |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+| ID          | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2021-40444](https://nvd.nist.gov/vuln/detail/CVE-2021-40444) | Microsoft MSHTML Remote Code Execution Vulnerability | 6.8 |
+
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe") by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| join proc_guid, _time [ 
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.inf","*.cab") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid 
+| `drop_dm_object_name(Filesystem)` 
+|rename process_guid as proc_guid 
+| fields _time dest file_create_time file_name file_path process_name process_path process proc_guid] 
+| dedup file_create_time 
+| table dest, process_name, process, file_create_time, file_name, file_path, proc_guid 
+| `office_product_writing_cab_or_inf_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **office_product_writing_cab_or_inf_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* dest
+* process_name
+* process
+* file_create_time
+* file_name
+* file_path
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node.
+
+#### Known False Positives
+The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
+
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+* [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 80.0 | 80 | 100 | An instance of $process_name$ was identified on $dest$ writing an inf or cab file to this. This is not typical of $process_name$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://twitter.com/vxunderground/status/1436326057179860992?s=20](https://twitter.com/vxunderground/status/1436326057179860992?s=20)
+* [https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/](https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/)
+* [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444)
+* [https://twitter.com/RonnyTNL/status/1436334640617373699?s=20](https://twitter.com/RonnyTNL/status/1436334640617373699?s=20)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/office_product_writing_cab_or_inf.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-07-suspicious_image_creation_in_appdata_folder.md b/docs/_posts/2022-07-07-suspicious_image_creation_in_appdata_folder.md
new file mode 100644
index 0000000000..0fae19c71b
--- /dev/null
+++ b/docs/_posts/2022-07-07-suspicious_image_creation_in_appdata_folder.md
@@ -0,0 +1,163 @@
+---
+title: "Suspicious Image Creation In Appdata Folder"
+excerpt: "Screen Capture
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-07-07
+toc: true
+toc_label: ""
+tags:
+  - Screen Capture
+  - Collection
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search is to detect a suspicious creation of image in appdata folder made by process that also has a file reference in appdata folder. This technique was seen in remcos rat that capture screenshot of the compromised machine and place it in the appdata and will be send to its C2 server. This TTP is really a good indicator to check that process because it is in suspicious folder path and image files are not commonly created by user in this folder path.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-07-07
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: f6f904c4-1ac0-11ec-806b-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path= "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid 
+| `drop_dm_object_name(Filesystem)` 
+|rename process_guid as proc_guid 
+| fields _time dest file_create_time file_name file_path process_name process_path process proc_guid] 
+| `suspicious_image_creation_in_appdata_folder_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **suspicious_image_creation_in_appdata_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* dest
+* file_create_time
+* file_name
+* file_path
+* process_name
+* process_path
+* process
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+#### Known False Positives
+unknown
+
+#### Associated Analytic story
+* [Remcos](/stories/remcos)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | process $process_name$ creating image file $file_path$ in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://success.trendmicro.com/dcx/s/solution/1123281-remcos-malware-information?language=en_US](https://success.trendmicro.com/dcx/s/solution/1123281-remcos-malware-information?language=en_US)
+* [https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/](https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-07-suspicious_wav_file_in_appdata_folder.md b/docs/_posts/2022-07-07-suspicious_wav_file_in_appdata_folder.md
new file mode 100644
index 0000000000..4c596a0e71
--- /dev/null
+++ b/docs/_posts/2022-07-07-suspicious_wav_file_in_appdata_folder.md
@@ -0,0 +1,163 @@
+---
+title: "Suspicious WAV file in Appdata Folder"
+excerpt: "Screen Capture
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-07-07
+toc: true
+toc_label: ""
+tags:
+  - Screen Capture
+  - Collection
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This analytic is to detect a suspicious creation of .wav file in appdata folder. This behavior was seen in Remcos RAT malware where it put the audio recording in the appdata\audio folde as part of data collection. this recording can be send to its C2 server as part of its exfiltration to the compromised machine. creation of wav files in this folder path is not a ussual disk place used by user to save audio format file.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-07-07
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 5be109e6-1ac5-11ec-b421-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1113](https://attack.mitre.org/techniques/T1113/) | Screen Capture | Collection |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*" by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| join proc_guid, _time [ 
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.wav") Filesystem.file_path = "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid 
+| `drop_dm_object_name(Filesystem)` 
+|rename process_guid as proc_guid 
+| fields file_name file_path process_name process_path process dest file_create_time _time proc_guid] 
+| `suspicious_wav_file_in_appdata_folder_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **suspicious_wav_file_in_appdata_folder_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* dest
+* file_create_time
+* file_name
+* file_path
+* process_name
+* process_path
+* process
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, file_name, file_path and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+#### Known False Positives
+unknown
+
+#### Associated Analytic story
+* [Remcos](/stories/remcos)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | process $process_name$ creating image file $file_path$ in $dest$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://success.trendmicro.com/dcx/s/solution/1123281-remcos-malware-information?language=en_US](https://success.trendmicro.com/dcx/s/solution/1123281-remcos-malware-information?language=en_US)
+* [https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/](https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon_wav.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_agent/sysmon_wav.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-07-windows_binary_proxy_execution_mavinject_dll_injection.md b/docs/_posts/2022-07-07-windows_binary_proxy_execution_mavinject_dll_injection.md
new file mode 100644
index 0000000000..69a4b75aec
--- /dev/null
+++ b/docs/_posts/2022-07-07-windows_binary_proxy_execution_mavinject_dll_injection.md
@@ -0,0 +1,176 @@
+---
+title: "Windows Binary Proxy Execution Mavinject DLL Injection"
+excerpt: "Mavinject
+, System Binary Proxy Execution
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-07-07
+toc: true
+toc_label: ""
+tags:
+  - Mavinject
+  - System Binary Proxy Execution
+  - Defense Evasion
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution (ex. C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL). In addition to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import descriptor injection via its /HMODULE command-line parameter (ex. mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an import table entry consisting of the specified DLL into the module at the given base address. During triage, review file modifcations and parallel processes.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-07-07
+- **Author**: Michael Haag, Splunk
+- **ID**: ccf4b61b-1b26-4f2e-a089-f2009c569c57
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1218.013](https://attack.mitre.org/techniques/T1218/013/) | Mavinject | Defense Evasion |
+
+| [T1218](https://attack.mitre.org/techniques/T1218/) | System Binary Proxy Execution | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=mavinject.exe Processes.process IN ("*injectrunning*", "*hmodule=0x*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_binary_proxy_execution_mavinject_dll_injection_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_binary_proxy_execution_mavinject_dll_injection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives may be present, filter on DLL name or parent process.
+
+#### Associated Analytic story
+* [Living Off The Land](/stories/living_off_the_land)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting load a DLL. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1218/013/](https://attack.mitre.org/techniques/T1218/013/)
+* [https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e](https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e)
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-1---mavinject---inject-dll-into-running-process](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-1---mavinject---inject-dll-into-running-process)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.013/atomic_red_team/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.013/atomic_red_team/windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-08-living_off_the_land.md b/docs/_posts/2022-07-08-living_off_the_land.md
new file mode 100644
index 0000000000..134210e727
--- /dev/null
+++ b/docs/_posts/2022-07-08-living_off_the_land.md
@@ -0,0 +1,177 @@
+---
+title: "Living Off The Land"
+excerpt: "Ingress Tool Transfer
+, Exploit Public-Facing Application
+, Command and Scripting Interpreter
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-07-08
+toc: true
+toc_label: ""
+tags:
+  - Ingress Tool Transfer
+  - Exploit Public-Facing Application
+  - Command and Scripting Interpreter
+  - Command And Control
+  - Initial Access
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Risk
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following correlation identifies a distinct amount of analytics associated with the Living Off The Land analytic story that identify potentially suspicious behavior.
+
+- **Type**: [Correlation](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Risk](https://docs.splunk.com/Documentation/CIM/latest/User/Risk)
+- **Last Updated**: 2022-07-08
+- **Author**: Michael Haag, Splunk
+- **ID**: 1be30d80-3a39-4df9-9102-64a467b24abc
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1105](https://attack.mitre.org/techniques/T1105/) | Ingress Tool Transfer | Command And Control |
+
+| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Reconnaissance
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Risk.All_Risk where All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.annotations.mitre_attack.mitre_tactic source 
+| `drop_dm_object_name(All_Risk)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| stats  values(source) as detection_name values(annotations.mitre_attack.mitre_tactic) as tactics values(firstTime) as firstTime values(lastTime) as lastTime dc(annotations.mitre_attack.mitre_tactic) as distinct_tactics dc(source) as distinct_detection_name by risk_object 
+| where distinct_detection_name >= 2 
+| `living_off_the_land_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **living_off_the_land_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* All_Risk.analyticstories
+* All_Risk.risk_object_type
+* All_Risk.risk_object
+* All_Risk.annotations.mitre_attack.mitre_tactic
+* source
+
+
+#### How To Implement
+To implement this correlation search a user needs to enable all detections in the Living Off The Land Analytic Story and confirm it is generating risk events. A simple search `index=risk analyticstories="Living Off The Land"` should contain events.
+
+#### Known False Positives
+There are no known false positive for this search, but it could contain false positives as multiple detections can trigger and not have successful exploitation. Modify the static value distinct_detection_name to a higher value. It is also required to tune analytics that are also tagged to ensure volume is never too much.
+
+#### Associated Analytic story
+* [Living Off The Land](/stories/living_off_the_land)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 63.0 | 90 | 70 | An increase of Living Off The Land behavior has been detected on $affected_systems$ |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://www.splunk.com/en_us/blog/security/living-off-the-land-threat-research-february-2022-release.html](https://www.splunk.com/en_us/blog/security/living-off-the-land-threat-research-february-2022-release.html)
+* [https://research.splunk.com/stories/living_off_the_land/](https://research.splunk.com/stories/living_off_the_land/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1218/living_off_the_land/lolbinrisk.log](https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1218/living_off_the_land/lolbinrisk.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/living_off_the_land.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-11-windows_identify_protocol_handlers.md b/docs/_posts/2022-07-11-windows_identify_protocol_handlers.md
new file mode 100644
index 0000000000..99444ee6e1
--- /dev/null
+++ b/docs/_posts/2022-07-11-windows_identify_protocol_handlers.md
@@ -0,0 +1,183 @@
+---
+title: "Windows Identify Protocol Handlers"
+excerpt: "Command and Scripting Interpreter
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-07-11
+toc: true
+toc_label: ""
+tags:
+  - Command and Scripting Interpreter
+  - Execution
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings). To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL in the property to limit the scope of this query to similar handlers as ms-msdt.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-07-11
+- **Author**: Michael Haag, Splunk
+- **ID**: bd5c311e-a6ea-48ae-a289-19a3398e3648
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes  by Processes.dest Processes.user Processes.process_name Processes.process 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `drop_dm_object_name(Processes)` 
+| lookup windows_protocol_handlers handler AS process OUTPUT handler ishandler 
+| where ishandler="TRUE" 
+| `windows_identify_protocol_handlers_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_identify_protocol_handlers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Lookups
+The SPL above uses the following Lookups:
+
+* [windows_protocol_handlers](https://github.com/splunk/security_content/blob/develop/lookups/windows_protocol_handlers.yml) with [data](https://github.com/splunk/security_content/tree/develop/lookups/windows_protocol_handlers.csv)
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives will be found. https and http is a URL Protocol handler that will trigger this analytic. Tune based on process or command-line.
+
+#### Associated Analytic story
+* [Living Off The Land](/stories/living_off_the_land)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 6.0 | 30 | 20 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing a protocol handler. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://www.oreilly.com/library/view/learning-java/1565927184/apas02.html](https://www.oreilly.com/library/view/learning-java/1565927184/apas02.html)
+* [https://blogs.windows.com/msedgedev/2022/01/20/getting-started-url-protocol-handlers-microsoft-edge/](https://blogs.windows.com/msedgedev/2022/01/20/getting-started-url-protocol-handlers-microsoft-edge/)
+* [https://github.com/Mr-Un1k0d3r/PoisonHandler](https://github.com/Mr-Un1k0d3r/PoisonHandler)
+* [https://www.mdsec.co.uk/2021/03/phishing-users-to-take-a-test/](https://www.mdsec.co.uk/2021/03/phishing-users-to-take-a-test/)
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-5---protocolhandlerexe-downloaded-a-suspicious-file](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-5---protocolhandlerexe-downloaded-a-suspicious-file)
+* [https://techcommunity.microsoft.com/t5/windows-it-pro-blog/disabling-the-msix-ms-appinstaller-protocol-handler/ba-p/3119479](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/disabling-the-msix-ms-appinstaller-protocol-handler/ba-p/3119479)
+* [https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug](https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug)
+* [https://parsiya.net/blog/2021-03-17-attack-surface-analysis-part-2-custom-protocol-handlers/](https://parsiya.net/blog/2021-03-17-attack-surface-analysis-part-2-custom-protocol-handlers/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/protocol_handlers/protocolhandlers.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/protocol_handlers/protocolhandlers.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_identify_protocol_handlers.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-12-spring4shell_payload_url_request.md b/docs/_posts/2022-07-12-spring4shell_payload_url_request.md
new file mode 100644
index 0000000000..e1c61a9c8d
--- /dev/null
+++ b/docs/_posts/2022-07-12-spring4shell_payload_url_request.md
@@ -0,0 +1,180 @@
+---
+title: "Spring4Shell Payload URL Request"
+excerpt: "Web Shell
+, Server Software Component
+, Exploit Public-Facing Application
+"
+categories:
+  - Web
+last_modified_at: 2022-07-12
+toc: true
+toc_label: ""
+tags:
+  - Web Shell
+  - Server Software Component
+  - Exploit Public-Facing Application
+  - Persistence
+  - Persistence
+  - Initial Access
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - CVE-2022-22965
+  - Web
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic is static indicators related to CVE-2022-22963, Spring4Shell. The 3 indicators provide an amount of fidelity that source IP is attemping to exploit a web shell on the destination. The filename and cmd are arbitrary in this exploitation. Java will write a JSP to disk and a process will spawn from Java based on the cmd passed. This is indicative of typical web shell activity.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
+- **Last Updated**: 2022-07-12
+- **Author**: Michael Haag, Splunk
+- **ID**: 9d44d649-7d67-4559-95c1-8022ff49420b
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1505.003](https://attack.mitre.org/techniques/T1505/003/) | Web Shell | Persistence |
+
+| [T1505](https://attack.mitre.org/techniques/T1505/) | Server Software Component | Persistence |
+
+| [T1190](https://attack.mitre.org/techniques/T1190/) | Exploit Public-Facing Application | Initial Access |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+| ID          | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
+| ----------- | ----------- | -------------- |
+| [CVE-2022-22965](https://nvd.nist.gov/vuln/detail/CVE-2022-22965) | A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it. | 7.5 |
+
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats count from datamodel=Web where Web.http_method IN ("GET") Web.url IN ("*tomcatwar.jsp*","*poc.jsp*","*shell.jsp*") by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype 
+| `drop_dm_object_name("Web")` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `spring4shell_payload_url_request_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+> :information_source:
+> **spring4shell_payload_url_request_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Web.http_method
+* Web.url
+* Web.url_length
+* Web.src
+* Web.dest
+* Web.http_user_agent
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on Web traffic that include fields relavent for traffic into the `Web` datamodel.
+
+#### Known False Positives
+The jsp file names are static names used in current proof of concept code. =
+
+#### Associated Analytic story
+* [Spring4Shell CVE-2022-22965](/stories/spring4shell_cve-2022-22965)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 36.0 | 60 | 60 | A URL was requested related to Spring4Shell POC code on $dest$ by $src$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/](https://www.microsoft.com/security/blog/2022/04/04/springshell-rce-vulnerability-guidance-for-protecting-against-and-detecting-cve-2022-22965/)
+* [https://github.com/TheGejr/SpringShell](https://github.com/TheGejr/SpringShell)
+* [https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability](https://www.tenable.com/blog/spring4shell-faq-spring-framework-remote-code-execution-vulnerability)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/spring4shell_nginx.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/spring4shell/spring4shell_nginx.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/web/spring4shell_payload_url_request.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-15-certutil_exe_certificate_extraction.md b/docs/_posts/2022-07-15-certutil_exe_certificate_extraction.md
new file mode 100644
index 0000000000..f26825b569
--- /dev/null
+++ b/docs/_posts/2022-07-15-certutil_exe_certificate_extraction.md
@@ -0,0 +1,158 @@
+---
+title: "Certutil exe certificate extraction"
+excerpt: ""
+categories:
+  - Endpoint
+last_modified_at: 2022-07-15
+toc: true
+toc_label: ""
+tags:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Last Updated**: 2022-07-15
+- **Author**: Rod Soto, Splunk
+- **ID**: 337a46be-600f-11eb-ae93-0242ac130002
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Installation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `certutil_exe_certificate_extraction_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **certutil_exe_certificate_extraction_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+
+#### Known False Positives
+Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services.
+
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
+* [Living Off The Land](/stories/living_off_the_land)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 63.0 | 90 | 70 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack](https://blog.sygnia.co/detection-and-hunting-of-golden-saml-attack)
+* [https://strontic.github.io/xcyclopedia/library/certutil.exe-09A8A29BAA3A451713FD3D07943B4A43.html](https://strontic.github.io/xcyclopedia/library/certutil.exe-09A8A29BAA3A451713FD3D07943B4A43.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/certutil_exe_certificate_extraction.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-15-powershell_disable_security_monitoring.md b/docs/_posts/2022-07-15-powershell_disable_security_monitoring.md
new file mode 100644
index 0000000000..0aff23150f
--- /dev/null
+++ b/docs/_posts/2022-07-15-powershell_disable_security_monitoring.md
@@ -0,0 +1,171 @@
+---
+title: "Powershell Disable Security Monitoring"
+excerpt: "Disable or Modify Tools
+, Impair Defenses
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-07-15
+toc: true
+toc_label: ""
+tags:
+  - Disable or Modify Tools
+  - Impair Defenses
+  - Defense Evasion
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Last Updated**: 2022-07-15
+- **Author**: Michael Haag, Splunk
+- **ID**: c148a894-dd93-11eb-bf2a-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
+
+| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process="*set-mppreference*" AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*","*DisableBehaviorMonitoring*","*drtm *","*dioavp *","*dscrptsc *","*dbaf *","*dbm *") by Processes.dest Processes.user Processes.parent_process Processes.original_file_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `powershell_disable_security_monitoring_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **powershell_disable_security_monitoring_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+Limited false positives. However, tune based on scripts that may perform this action.
+
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+* [Revil Ransomware](/stories/revil_ransomware)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 25.0 | 50 | 50 |  |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell)
+* [https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps](https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/pwh_defender_disabling/windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/powershell_disable_security_monitoring.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-15-windows_mof_event_triggered_execution_via_wmi.md b/docs/_posts/2022-07-15-windows_mof_event_triggered_execution_via_wmi.md
new file mode 100644
index 0000000000..97d58f137b
--- /dev/null
+++ b/docs/_posts/2022-07-15-windows_mof_event_triggered_execution_via_wmi.md
@@ -0,0 +1,174 @@
+---
+title: "Windows MOF Event Triggered Execution via WMI"
+excerpt: "Windows Management Instrumentation Event Subscription
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-07-15
+toc: true
+toc_label: ""
+tags:
+  - Windows Management Instrumentation Event Subscription
+  - Persistence
+  - Privilege Escalation
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following anaytic identifies MOFComp.exe loading a MOF file. The Managed Object Format (MOF) compiler parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Typically, MOFComp.exe does not reach out to the public internet or load a MOF file from User Profile paths. A filter and consumer is typically registered in WMI. Review parallel processes and query WMI subscriptions to gather artifacts. The default path of mofcomp.exe is C:\Windows\System32\wbem.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-07-15
+- **Author**: Michael Haag, Splunk
+- **ID**: e59b5a73-32bf-4467-a585-452c36ae10c1
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1546.003](https://attack.mitre.org/techniques/T1546/003/) | Windows Management Instrumentation Event Subscription | Persistence, Privilege Escalation |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+* DE.CM
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+* CIS 3
+* CIS 5
+* CIS 16
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name IN ("cmd.exe", "powershell.exe") Processes.process_name=mofcomp.exe) OR (Processes.process_name=mofcomp.exe Processes.process IN ("*\\AppData\\Local\\*","*\\Users\\Public\\*", "*\\WINDOWS\\Temp\\*")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_mof_event_triggered_execution_via_wmi_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **windows_mof_event_triggered_execution_via_wmi_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+False positives may be present from automation based applications (SCCM), filtering may be required. In addition, break the query out based on volume of usage. Filter process names or f
+
+#### Associated Analytic story
+* [Living Off The Land](/stories/living_off_the_land)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 64.0 | 80 | 80 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ loading a MOF file. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1546/003/](https://attack.mitre.org/techniques/T1546/003/)
+* [https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/](https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/)
+* [https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp](https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp)
+* [https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/](https://pentestlab.blog/2020/01/21/persistence-wmi-event-subscription/)
+* [https://www.sakshamdixit.com/wmi-events/](https://www.sakshamdixit.com/wmi-events/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/mofcomp.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/mofcomp.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-19-allow_inbound_traffic_by_firewall_rule_registry.md b/docs/_posts/2022-07-19-allow_inbound_traffic_by_firewall_rule_registry.md
new file mode 100644
index 0000000000..b75d110ed0
--- /dev/null
+++ b/docs/_posts/2022-07-19-allow_inbound_traffic_by_firewall_rule_registry.md
@@ -0,0 +1,176 @@
+---
+title: "Allow Inbound Traffic By Firewall Rule Registry"
+excerpt: "Remote Desktop Protocol
+, Remote Services
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-07-19
+toc: true
+toc_label: ""
+tags:
+  - Remote Desktop Protocol
+  - Remote Services
+  - Lateral Movement
+  - Lateral Movement
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine by allowing the traffic in a firewall rule.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Last Updated**: 2022-07-19
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 0a46537c-be02-11eb-92ca-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1021.001](https://attack.mitre.org/techniques/T1021/001/) | Remote Desktop Protocol | Lateral Movement |
+
+| [T1021](https://attack.mitre.org/techniques/T1021/) | Remote Services | Lateral Movement |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_data = "*
+|Action=Allow
+|*" Registry.registry_value_data = "*
+|Dir=In
+|*"  Registry.registry_value_data = "*
+|LPort=*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data 
+| `drop_dm_object_name(Registry)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
+| `allow_inbound_traffic_by_firewall_rule_registry_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **allow_inbound_traffic_by_firewall_rule_registry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_path
+* Registry.registry_value_name
+* Registry.registry_key_name
+* Registry.registry_value_data
+* Registry.action
+* Registry.dest
+* Registry.user
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+
+#### Known False Positives
+network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered.
+
+#### Associated Analytic story
+* [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 25.0 | 50 | 50 | Suspicious firewall allow rule modifications were detected via the registry on endpoint $dest$ by user $user$. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps](https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log)
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2022-07-19-wmic_noninteractive_app_uninstallation.md b/docs/_posts/2022-07-19-wmic_noninteractive_app_uninstallation.md
new file mode 100644
index 0000000000..7b073bc0b0
--- /dev/null
+++ b/docs/_posts/2022-07-19-wmic_noninteractive_app_uninstallation.md
@@ -0,0 +1,169 @@
+---
+title: "Wmic NonInteractive App Uninstallation"
+excerpt: "Disable or Modify Tools
+, Impair Defenses
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-07-19
+toc: true
+toc_label: ""
+tags:
+  - Disable or Modify Tools
+  - Impair Defenses
+  - Defense Evasion
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/products/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This analytic indentifies WMIC command-line attempting to uninstall application non-interactively. This technique was seen in IceID to uninstall AV products on the compromised host to evade detection. This Hunting query maybe a good indicator that some process tries to uninstall application using wmic which is not a common behavior. This approach may seen in some script or third part appication to uninstall their application but it is a good thing to check what it uninstall and why.
+
+- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-07-19
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: bff0e7a0-317f-11ec-ab4e-acde48001122
+
+
+#### Annotations
+
+<details>
+  <summary>ATT&CK</summary>
+
+<div markdown="1">
+
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
+
+| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+</div>
+</details>
+
+
+<details>
+  <summary>Kill Chain Phase</summary>
+
+<div markdown="1">
+
+* Exploitation
+
+
+</div>
+</details>
+
+
+<details>
+  <summary>NIST</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CIS20</summary>
+
+<div markdown="1">
+
+
+
+</div>
+</details>
+
+<details>
+  <summary>CVE</summary>
+
+<div markdown="1">
+
+
+</div>
+</details>
+
+#### Search 
+
+```
+
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe Processes.process="* product *" Processes.process="*where name*" Processes.process="*call uninstall*" Processes.process="*/nointeractive*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `wmic_noninteractive_app_uninstallation_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+> :information_source:
+> **wmic_noninteractive_app_uninstallation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+Third party application may use this approach to uninstall applications.
+
+#### Associated Analytic story
+* [IceID](/stories/iceid)
+* [Azorult](/stories/azorult)
+
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 25.0 | 50 | 50 | Wmic $process_name$ with command-line $process$ on $dest$ attempting to uninstall software. |
+
+
+> :information_source:
+> The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author. 
+
+#### Reference
+
+* [https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/](https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/disable_av/sysmon2.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_stories/active_directory_discovery.md b/docs/_stories/active_directory_discovery.md
index c1db9d6cd8..a47fe11c82 100644
--- a/docs/_stories/active_directory_discovery.md
+++ b/docs/_stories/active_directory_discovery.md
@@ -60,7 +60,7 @@ Once an attacker obtains an initial foothold in an Active Directory environment,
 | [Get DomainUser with PowerShell](/endpoint/get_domainuser_with_powershell/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery)| TTP |
 | [Get DomainUser with PowerShell Script Block](/endpoint/get_domainuser_with_powershell_script_block/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery)| TTP |
 | [Get-ForestTrust with PowerShell](/endpoint/get-foresttrust_with_powershell/) | [Domain Trust Discovery](/tags/#domain-trust-discovery)| TTP |
-| [Get-ForestTrust with PowerShell Script Block](/endpoint/get-foresttrust_with_powershell_script_block/) | [Domain Trust Discovery](/tags/#domain-trust-discovery)| TTP |
+| [Get-ForestTrust with PowerShell Script Block](/endpoint/get-foresttrust_with_powershell_script_block/) | [Domain Trust Discovery](/tags/#domain-trust-discovery), [PowerShell](/tags/#powershell)| TTP |
 | [Get WMIObject Group Discovery](/endpoint/get_wmiobject_group_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups)| Hunting |
 | [Get WMIObject Group Discovery with Script Block Logging](/endpoint/get_wmiobject_group_discovery_with_script_block_logging/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups)| Hunting |
 | [GetAdComputer with PowerShell](/endpoint/getadcomputer_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery)| Hunting |
@@ -76,7 +76,7 @@ Once an attacker obtains an initial foothold in an Active Directory environment,
 | [GetDomainGroup with PowerShell](/endpoint/getdomaingroup_with_powershell/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups)| TTP |
 | [GetDomainGroup with PowerShell Script Block](/endpoint/getdomaingroup_with_powershell_script_block/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Domain Groups](/tags/#domain-groups)| TTP |
 | [GetLocalUser with PowerShell](/endpoint/getlocaluser_with_powershell/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account)| Hunting |
-| [GetLocalUser with PowerShell Script Block](/endpoint/getlocaluser_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account)| Hunting |
+| [GetLocalUser with PowerShell Script Block](/endpoint/getlocaluser_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account), [PowerShell](/tags/#powershell)| Hunting |
 | [GetNetTcpconnection with PowerShell](/endpoint/getnettcpconnection_with_powershell/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery)| Hunting |
 | [GetNetTcpconnection with PowerShell Script Block](/endpoint/getnettcpconnection_with_powershell_script_block/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery)| Hunting |
 | [GetWmiObject Ds Computer with PowerShell](/endpoint/getwmiobject_ds_computer_with_powershell/) | [Remote System Discovery](/tags/#remote-system-discovery)| TTP |
@@ -86,7 +86,7 @@ Once an attacker obtains an initial foothold in an Active Directory environment,
 | [GetWmiObject DS User with PowerShell](/endpoint/getwmiobject_ds_user_with_powershell/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery)| TTP |
 | [GetWmiObject DS User with PowerShell Script Block](/endpoint/getwmiobject_ds_user_with_powershell_script_block/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery)| TTP |
 | [GetWmiObject User Account with PowerShell](/endpoint/getwmiobject_user_account_with_powershell/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account)| Hunting |
-| [GetWmiObject User Account with PowerShell Script Block](/endpoint/getwmiobject_user_account_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account)| Hunting |
+| [GetWmiObject User Account with PowerShell Script Block](/endpoint/getwmiobject_user_account_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account), [PowerShell](/tags/#powershell)| Hunting |
 | [Local Account Discovery with Net](/endpoint/local_account_discovery_with_net/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account)| Hunting |
 | [Local Account Discovery With Wmic](/endpoint/local_account_discovery_with_wmic/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account)| Hunting |
 | [Net Localgroup Discovery](/endpoint/net_localgroup_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups)| Hunting |
diff --git a/docs/_stories/active_directory_lateral_movement.md b/docs/_stories/active_directory_lateral_movement.md
index 12fee30468..f7b2e57295 100644
--- a/docs/_stories/active_directory_lateral_movement.md
+++ b/docs/_stories/active_directory_lateral_movement.md
@@ -44,8 +44,8 @@ If there is evidence of lateral movement, it is imperative for analysts to colle
 | [Executable File Written in Administrative SMB Share](/endpoint/executable_file_written_in_administrative_smb_share/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares)| TTP |
 | [Impacket Lateral Movement Commandline Parameters](/endpoint/impacket_lateral_movement_commandline_parameters/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service)| TTP |
 | [Interactive Session on Remote Endpoint with PowerShell](/endpoint/interactive_session_on_remote_endpoint_with_powershell/) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management)| TTP |
-| [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model)| TTP |
-| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell)| TTP |
+| [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [MMC](/tags/#mmc)| TTP |
+| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell), [MMC](/tags/#mmc)| TTP |
 | [Remote Process Instantiation via DCOM and PowerShell](/endpoint/remote_process_instantiation_via_dcom_and_powershell/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model)| TTP |
 | [Remote Process Instantiation via DCOM and PowerShell Script Block](/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model)| TTP |
 | [Remote Process Instantiation via WinRM and PowerShell](/endpoint/remote_process_instantiation_via_winrm_and_powershell/) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management)| TTP |
diff --git a/docs/_stories/azorult.md b/docs/_stories/azorult.md
new file mode 100644
index 0000000000..de9440d619
--- /dev/null
+++ b/docs/_stories/azorult.md
@@ -0,0 +1,100 @@
+---
+title: "Azorult"
+last_modified_at: 2022-06-09
+toc: true
+toc_label: ""
+tags:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+  - Actions on Objectives
+  - Delivery
+  - Exploitation
+  - Installation
+  - Reconnaissance
+---
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+Leverage searches that allow you to detect and investigate unusual activities that might relate to the Azorult malware including firewall modification, icacl execution, spawning more process, botnet c2 communication, defense evasion and etc. The AZORULT malware was first discovered in 2016 to be an information stealer that steals browsing history, cookies, ID/passwords, cryptocurrency information and more. It can also be a downloader of other malware. A variant of this malware was able to create a new, hidden administrator account on the machine to set a registry key to establish a Remote Desktop Protocol (RDP) connection. Exploit kits such as Fallout Exploit Kit (EK) and phishing mails with social engineering technique are one of the major infection vectors of the AZORult malware. The current malspam and phishing emails use fake product order requests, invoice documents and payment information requests. This Trojan-Spyware connects to command and control (C&C) servers of attacker to send and receive information.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-06-09
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: efed5343-4ac2-42b1-a16d-da2428d0ce94
+
+#### Narrative
+
+Adversaries may use this technique to maximize the impact on the target organization in operations where network wide availability interruption is the goal.
+
+#### Detections
+
+| Name        | Technique   | Type         |
+| ----------- | ----------- |--------------|
+| [Allow Inbound Traffic By Firewall Rule Registry](/endpoint/allow_inbound_traffic_by_firewall_rule_registry/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services)| TTP |
+| [Allow Operation with Consent Admin](/endpoint/allow_operation_with_consent_admin/) | [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [CHCP Command Execution](/endpoint/chcp_command_execution/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP |
+| [CMD Carry Out String Command Parameter](/endpoint/cmd_carry_out_string_command_parameter/) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting |
+| [Create local admin accounts using net exe](/endpoint/create_local_admin_accounts_using_net_exe/) | [Local Account](/tags/#local-account), [Create Account](/tags/#create-account)| TTP |
+| [Detect Use of cmd exe to Launch Script Interpreters](/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell)| TTP |
+| [Disable Defender BlockAtFirstSeen Feature](/endpoint/disable_defender_blockatfirstseen_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Defender Enhanced Notification](/endpoint/disable_defender_enhanced_notification/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Defender Spynet Reporting](/endpoint/disable_defender_spynet_reporting/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Defender Submit Samples Consent Feature](/endpoint/disable_defender_submit_samples_consent_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Show Hidden Files](/endpoint/disable_show_hidden_files/) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Hide Artifacts](/tags/#hide-artifacts), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Excessive Attempt To Disable Services](/endpoint/excessive_attempt_to_disable_services/) | [Service Stop](/tags/#service-stop)| Anomaly |
+| [Excessive Usage Of Cacls App](/endpoint/excessive_usage_of_cacls_app/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification)| Anomaly |
+| [Excessive Usage Of Net App](/endpoint/excessive_usage_of_net_app/) | [Account Access Removal](/tags/#account-access-removal)| Anomaly |
+| [Excessive Usage Of SC Service Utility](/endpoint/excessive_usage_of_sc_service_utility/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution)| Anomaly |
+| [Excessive Usage Of Taskkill](/endpoint/excessive_usage_of_taskkill/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Anomaly |
+| [Executables Or Script Creation In Suspicious Path](/endpoint/executables_or_script_creation_in_suspicious_path/) | [Masquerading](/tags/#masquerading)| TTP |
+| [Firewall Allowed Program Enable](/endpoint/firewall_allowed_program_enable/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses)| Anomaly |
+| [Hide User Account From Sign-In Screen](/endpoint/hide_user_account_from_sign-in_screen/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification)| TTP |
+| [Icacls Deny Command](/endpoint/icacls_deny_command/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification)| TTP |
+| [Net Localgroup Discovery](/endpoint/net_localgroup_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups)| Hunting |
+| [Network Connection Discovery With Net](/endpoint/network_connection_discovery_with_net/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery)| Hunting |
+| [Non Firefox Process Access Firefox Profile Dir](/endpoint/non_firefox_process_access_firefox_profile_dir/) | [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers)| Anomaly |
+| [Processes launching netsh](/endpoint/processes_launching_netsh/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP |
+| [Sc exe Manipulating Windows Services](/endpoint/sc_exe_manipulating_windows_services/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process)| TTP |
+| [Scheduled Task Deleted Or Created via CMD](/endpoint/scheduled_task_deleted_or_created_via_cmd/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP |
+| [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly |
+| [Windows Application Layer Protocol RMS Radmin Tool Namedpipe](/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe/) | [Application Layer Protocol](/tags/#application-layer-protocol)| TTP |
+| [Windows Defender Exclusion Registry Entry](/endpoint/windows_defender_exclusion_registry_entry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Windows Gather Victim Network Info Through Ip Check Web Services](/endpoint/windows_gather_victim_network_info_through_ip_check_web_services/) | [IP Addresses](/tags/#ip-addresses), [Gather Victim Network Information](/tags/#gather-victim-network-information)| Hunting |
+| [Windows Impair Defense Add Xml Applocker Rules](/endpoint/windows_impair_defense_add_xml_applocker_rules/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Hunting |
+| [Windows Impair Defense Deny Security Software With Applocker](/endpoint/windows_impair_defense_deny_security_software_with_applocker/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Windows Modify Registry Disable Toast Notifications](/endpoint/windows_modify_registry_disable_toast_notifications/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows Modify Registry Disable Win Defender Raw Write Notif](/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows Modify Registry Disable Windows Security Center Notif](/endpoint/windows_modify_registry_disable_windows_security_center_notif/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows Modify Registry Disabling WER Settings](/endpoint/windows_modify_registry_disabling_wer_settings/) | [Modify Registry](/tags/#modify-registry)| TTP |
+| [Windows Modify Registry DisAllow Windows App](/endpoint/windows_modify_registry_disallow_windows_app/) | [Modify Registry](/tags/#modify-registry)| TTP |
+| [Windows Modify Registry Regedit Silent Reg Import](/endpoint/windows_modify_registry_regedit_silent_reg_import/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows Modify Registry Suppress Win Defender Notif](/endpoint/windows_modify_registry_suppress_win_defender_notif/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows Powershell Import Applocker Policy](/endpoint/windows_powershell_import_applocker_policy/) | [PowerShell](/tags/#powershell)| TTP |
+| [Windows Remote Access Software RMS Registry](/endpoint/windows_remote_access_software_rms_registry/) | [Remote Access Software](/tags/#remote-access-software)| TTP |
+| [Windows Remote Service Rdpwinst Tool Execution](/endpoint/windows_remote_service_rdpwinst_tool_execution/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services)| TTP |
+| [Windows Remote Services Allow Rdp In Firewall](/endpoint/windows_remote_services_allow_rdp_in_firewall/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services)| Anomaly |
+| [Windows Remote Services Allow Remote Assistance](/endpoint/windows_remote_services_allow_remote_assistance/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services)| Anomaly |
+| [Windows Remote Services Rdp Enable](/endpoint/windows_remote_services_rdp_enable/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services)| TTP |
+| [Windows Service Stop By Deletion](/endpoint/windows_service_stop_by_deletion/) | [Service Stop](/tags/#service-stop)| TTP |
+| [Windows Valid Account With Never Expires Password](/endpoint/windows_valid_account_with_never_expires_password/) | [Service Stop](/tags/#service-stop)| TTP |
+| [Wmic NonInteractive App Uninstallation](/endpoint/wmic_noninteractive_app_uninstallation/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Hunting |
+
+#### Reference
+
+* [https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null](https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null)
+* [https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/](https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/stories/azorult.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_stories/container_implantation_monitoring_and_investigation.md b/docs/_stories/container_implantation_monitoring_and_investigation.md
index d39b89f55d..a8a5a7c554 100644
--- a/docs/_stories/container_implantation_monitoring_and_investigation.md
+++ b/docs/_stories/container_implantation_monitoring_and_investigation.md
@@ -7,7 +7,6 @@ tags:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
-  - Exploitation
 ---
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -30,8 +29,6 @@ Container Registrys provide a way for organizations to keep customized images of
 
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
-| [GCP GCR container uploaded](/deprecated/gcp_gcr_container_uploaded/) | [Implant Internal Image](/tags/#implant-internal-image)| Hunting |
-| [New container uploaded to AWS ECR](/cloud/new_container_uploaded_to_aws_ecr/) | [Implant Internal Image](/tags/#implant-internal-image)| Hunting |
 
 #### Reference
 
diff --git a/docs/_stories/disabling_security_tools.md b/docs/_stories/disabling_security_tools.md
index 1316ad27c7..33a01aa290 100644
--- a/docs/_stories/disabling_security_tools.md
+++ b/docs/_stories/disabling_security_tools.md
@@ -43,7 +43,7 @@ Attackers employ a variety of tactics in order to avoid detection and operate wi
 
 * [https://attack.mitre.org/wiki/Technique/T1089](https://attack.mitre.org/wiki/Technique/T1089)
 * [https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/](https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/)
-* [https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf](https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf)
+* [https://web.archive.org/web/20220425194457/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf](https://web.archive.org/web/20220425194457/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf)
 
 
 
diff --git a/docs/_stories/hermetic_wiper.md b/docs/_stories/hermetic_wiper.md
index 9aa678645f..a604392772 100644
--- a/docs/_stories/hermetic_wiper.md
+++ b/docs/_stories/hermetic_wiper.md
@@ -45,7 +45,7 @@ Hermetic Wiper is destructive malware operation found by Sentinel One targeting
 | [Change Default File Association](/endpoint/change_default_file_association/) | [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution)| TTP |
 | [CMD Carry Out String Command Parameter](/endpoint/cmd_carry_out_string_command_parameter/) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting |
 | [Detect Empire with PowerShell Script Block Logging](/endpoint/detect_empire_with_powershell_script_block_logging/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
-| [Detect Mimikatz With PowerShell Script Block Logging](/endpoint/detect_mimikatz_with_powershell_script_block_logging/) | [OS Credential Dumping](/tags/#os-credential-dumping)| TTP |
+| [Detect Mimikatz With PowerShell Script Block Logging](/endpoint/detect_mimikatz_with_powershell_script_block_logging/) | [OS Credential Dumping](/tags/#os-credential-dumping), [PowerShell](/tags/#powershell)| TTP |
 | [ETW Registry Disabled](/endpoint/etw_registry_disabled/) | [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses)| TTP |
 | [Executable File Written in Administrative SMB Share](/endpoint/executable_file_written_in_administrative_smb_share/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares)| TTP |
 | [Executables Or Script Creation In Suspicious Path](/endpoint/executables_or_script_creation_in_suspicious_path/) | [Masquerading](/tags/#masquerading)| TTP |
@@ -56,19 +56,19 @@ Hermetic Wiper is destructive malware operation found by Sentinel One targeting
 | [Malicious PowerShell Process With Obfuscation Techniques](/endpoint/malicious_powershell_process_with_obfuscation_techniques/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
 | [MSI Module Loaded by Non-System Binary](/endpoint/msi_module_loaded_by_non-system_binary/) | [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow)| Hunting |
 | [Overwriting Accessibility Binaries](/endpoint/overwriting_accessibility_binaries/) | [Event Triggered Execution](/tags/#event-triggered-execution), [Accessibility Features](/tags/#accessibility-features)| TTP |
-| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell)| TTP |
+| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell), [MMC](/tags/#mmc)| TTP |
 | [PowerShell 4104 Hunting](/endpoint/powershell_4104_hunting/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| Hunting |
 | [PowerShell - Connect To Internet With Hidden Window](/endpoint/powershell_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting |
 | [PowerShell Domain Enumeration](/endpoint/powershell_domain_enumeration/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
 | [Powershell Enable SMB1Protocol Feature](/endpoint/powershell_enable_smb1protocol_feature/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools)| TTP |
-| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution)| TTP |
+| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [PowerShell](/tags/#powershell)| TTP |
 | [Powershell Fileless Process Injection via GetProcAddress](/endpoint/powershell_fileless_process_injection_via_getprocaddress/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [PowerShell](/tags/#powershell)| TTP |
 | [Powershell Fileless Script Contains Base64 Encoded Content](/endpoint/powershell_fileless_script_contains_base64_encoded_content/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [PowerShell](/tags/#powershell)| TTP |
 | [PowerShell Loading DotNET into Memory via Reflection](/endpoint/powershell_loading_dotnet_into_memory_via_reflection/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
 | [Powershell Processing Stream Of Data](/endpoint/powershell_processing_stream_of_data/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
 | [Powershell Using memory As Backing Store](/endpoint/powershell_using_memory_as_backing_store/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP |
 | [Recon AVProduct Through Pwh or WMI](/endpoint/recon_avproduct_through_pwh_or_wmi/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
-| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
+| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information), [PowerShell](/tags/#powershell)| TTP |
 | [Registry Keys Used For Privilege Escalation](/endpoint/registry_keys_used_for_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Event Triggered Execution](/tags/#event-triggered-execution)| TTP |
 | [Regsvr32 Silent and Install Param Dll Loading](/endpoint/regsvr32_silent_and_install_param_dll_loading/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly |
 | [Runas Execution in CommandLine](/endpoint/runas_execution_in_commandline/) | [Access Token Manipulation](/tags/#access-token-manipulation), [Token Impersonation/Theft](/tags/#token-impersonation/theft)| Hunting |
diff --git a/docs/_stories/hidden_cobra_malware.md b/docs/_stories/hidden_cobra_malware.md
index 90eca71f14..3d81551f91 100644
--- a/docs/_stories/hidden_cobra_malware.md
+++ b/docs/_stories/hidden_cobra_malware.md
@@ -51,7 +51,7 @@ Among other searches in this Analytic Story is a detection search that looks for
 #### Reference
 
 * [https://web.archive.org/web/20191220004307/https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity](https://web.archive.org/web/20191220004307/https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity)
-* [https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf](https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf)
+* [https://web.archive.org/web/20220421112536/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf](https://web.archive.org/web/20220421112536/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf)
 
 
 
diff --git a/docs/_stories/industroyer2.md b/docs/_stories/industroyer2.md
index aebbdb8692..d14ba34e91 100644
--- a/docs/_stories/industroyer2.md
+++ b/docs/_stories/industroyer2.md
@@ -47,7 +47,7 @@ Industroyer2 is part of continuous attack to ukraine targeting energy facilities
 | [Linux Shred Overwrite Command](/endpoint/linux_shred_overwrite_command/) | [Data Destruction](/tags/#data-destruction)| TTP |
 | [Linux Stop Services](/endpoint/linux_stop_services/) | [Service Stop](/tags/#service-stop)| TTP |
 | [Linux System Network Discovery](/endpoint/linux_system_network_discovery/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery)| Anomaly |
-| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
+| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information), [PowerShell](/tags/#powershell)| TTP |
 | [Schtasks Run Task On Demand](/endpoint/schtasks_run_task_on_demand/) | [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP |
 | [Suspicious Process File Path](/endpoint/suspicious_process_file_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process)| TTP |
 | [Windows Hidden Schedule Task Settings](/endpoint/windows_hidden_schedule_task_settings/) | [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP |
diff --git a/docs/_stories/living_off_the_land.md b/docs/_stories/living_off_the_land.md
index c3278cd696..d9fd58ec4f 100644
--- a/docs/_stories/living_off_the_land.md
+++ b/docs/_stories/living_off_the_land.md
@@ -8,9 +8,11 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Endpoint
+  - Risk
   - Actions on Objectives
   - Exploitation
   - Installation
+  - Reconnaissance
 ---
 
 [Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
@@ -20,7 +22,7 @@ tags:
 Leverage analytics that allow you to identify the presence of an adversary leveraging native applications within your environment.
 
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
-- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint), [Risk](https://docs.splunk.com/Documentation/CIM/latest/User/Risk)
 - **Last Updated**: 2022-03-16
 - **Author**: Lou Stella, Splunk
 - **ID**: 6f7982e2-900b-11ec-a54a-acde48001122
@@ -64,9 +66,10 @@ Living Off The Land refers to an adversary methodology of using native applicati
 | [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP |
 | [Esentutl SAM Copy](/endpoint/esentutl_sam_copy/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping)| Hunting |
 | [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Living Off The Land](/endpoint/living_off_the_land/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Correlation |
 | [MacOS LOLbin](/endpoint/macos_lolbin/) | [Unix Shell](/tags/#unix-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP |
 | [MacOS plutil](/endpoint/macos_plutil/) | [Plist File Modification](/tags/#plist-file-modification)| TTP |
-| [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model)| TTP |
+| [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [MMC](/tags/#mmc)| TTP |
 | [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP |
 | [Ntdsutil Export NTDS](/endpoint/ntdsutil_export_ntds/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP |
 | [Reg exe Manipulating Windows Services Registry Keys](/endpoint/reg_exe_manipulating_windows_services_registry_keys/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow)| TTP |
@@ -100,7 +103,9 @@ Living Off The Land refers to an adversary methodology of using native applicati
 | [Suspicious Rundll32 dllregisterserver](/endpoint/suspicious_rundll32_dllregisterserver/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [Rundll32](/tags/#rundll32)| TTP |
 | [Suspicious Scheduled Task from Public Directory](/endpoint/suspicious_scheduled_task_from_public_directory/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly |
 | [Svchost LOLBAS Execution Process Spawn](/endpoint/svchost_lolbas_execution_process_spawn/) | [Scheduled Task/Job](/tags/#scheduled-task/job), [Scheduled Task](/tags/#scheduled-task)| TTP |
+| [Windows Binary Proxy Execution Mavinject DLL Injection](/endpoint/windows_binary_proxy_execution_mavinject_dll_injection/) | [Mavinject](/tags/#mavinject), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP |
 | [Windows Diskshadow Proxy Execution](/endpoint/windows_diskshadow_proxy_execution/) | [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP |
+| [Windows Identify Protocol Handlers](/endpoint/windows_identify_protocol_handlers/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting |
 | [Windows Indirect Command Execution Via forfiles](/endpoint/windows_indirect_command_execution_via_forfiles/) | [Indirect Command Execution](/tags/#indirect-command-execution)| TTP |
 | [Windows Indirect Command Execution Via pcalua](/endpoint/windows_indirect_command_execution_via_pcalua/) | [Indirect Command Execution](/tags/#indirect-command-execution)| TTP |
 | [Windows InstallUtil in Non Standard Path](/endpoint/windows_installutil_in_non_standard_path/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution), [InstallUtil](/tags/#installutil)| TTP |
@@ -108,6 +113,10 @@ Living Off The Land refers to an adversary methodology of using native applicati
 | [Windows InstallUtil Uninstall Option](/endpoint/windows_installutil_uninstall_option/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP |
 | [Windows InstallUtil Uninstall Option with Network](/endpoint/windows_installutil_uninstall_option_with_network/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP |
 | [Windows InstallUtil URL in Command Line](/endpoint/windows_installutil_url_in_command_line/) | [InstallUtil](/tags/#installutil), [System Binary Proxy Execution](/tags/#system-binary-proxy-execution)| TTP |
+| [Windows MOF Event Triggered Execution via WMI](/endpoint/windows_mof_event_triggered_execution_via_wmi/) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription)| TTP |
+| [Windows Odbcconf Hunting](/endpoint/windows_odbcconf_hunting/) | [Odbcconf](/tags/#odbcconf)| Hunting |
+| [Windows Odbcconf Load DLL](/endpoint/windows_odbcconf_load_dll/) | [Odbcconf](/tags/#odbcconf)| TTP |
+| [Windows Odbcconf Load Response File](/endpoint/windows_odbcconf_load_response_file/) | [Odbcconf](/tags/#odbcconf)| TTP |
 | [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
 
 #### Reference
diff --git a/docs/_stories/malicious_powershell.md b/docs/_stories/malicious_powershell.md
index 048722cb11..afa4018a1b 100644
--- a/docs/_stories/malicious_powershell.md
+++ b/docs/_stories/malicious_powershell.md
@@ -50,23 +50,26 @@ Most recently we have added new content related to PowerShell Script Block loggi
 | [Any Powershell DownloadFile](/endpoint/any_powershell_downloadfile/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer)| TTP |
 | [Any Powershell DownloadString](/endpoint/any_powershell_downloadstring/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer)| TTP |
 | [Detect Empire with PowerShell Script Block Logging](/endpoint/detect_empire_with_powershell_script_block_logging/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
-| [Detect Mimikatz With PowerShell Script Block Logging](/endpoint/detect_mimikatz_with_powershell_script_block_logging/) | [OS Credential Dumping](/tags/#os-credential-dumping)| TTP |
+| [Detect Mimikatz With PowerShell Script Block Logging](/endpoint/detect_mimikatz_with_powershell_script_block_logging/) | [OS Credential Dumping](/tags/#os-credential-dumping), [PowerShell](/tags/#powershell)| TTP |
+| [GetLocalUser with PowerShell Script Block](/endpoint/getlocaluser_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account), [PowerShell](/tags/#powershell)| Hunting |
+| [GetWmiObject User Account with PowerShell Script Block](/endpoint/getwmiobject_user_account_with_powershell_script_block/) | [Account Discovery](/tags/#account-discovery), [Local Account](/tags/#local-account), [PowerShell](/tags/#powershell)| Hunting |
 | [Malicious PowerShell Process - Encoded Command](/endpoint/malicious_powershell_process_-_encoded_command/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information)| Hunting |
 | [Malicious PowerShell Process With Obfuscation Techniques](/endpoint/malicious_powershell_process_with_obfuscation_techniques/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
-| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell)| TTP |
+| [Possible Lateral Movement PowerShell Spawn](/endpoint/possible_lateral_movement_powershell_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [PowerShell](/tags/#powershell), [MMC](/tags/#mmc)| TTP |
 | [PowerShell 4104 Hunting](/endpoint/powershell_4104_hunting/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| Hunting |
 | [PowerShell - Connect To Internet With Hidden Window](/endpoint/powershell_-_connect_to_internet_with_hidden_window/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting |
-| [Powershell Creating Thread Mutex](/endpoint/powershell_creating_thread_mutex/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools)| TTP |
+| [Powershell Creating Thread Mutex](/endpoint/powershell_creating_thread_mutex/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [PowerShell](/tags/#powershell)| TTP |
 | [PowerShell Domain Enumeration](/endpoint/powershell_domain_enumeration/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
 | [Powershell Enable SMB1Protocol Feature](/endpoint/powershell_enable_smb1protocol_feature/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools)| TTP |
-| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution)| TTP |
+| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [PowerShell](/tags/#powershell)| TTP |
 | [Powershell Fileless Process Injection via GetProcAddress](/endpoint/powershell_fileless_process_injection_via_getprocaddress/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Process Injection](/tags/#process-injection), [PowerShell](/tags/#powershell)| TTP |
 | [Powershell Fileless Script Contains Base64 Encoded Content](/endpoint/powershell_fileless_script_contains_base64_encoded_content/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [PowerShell](/tags/#powershell)| TTP |
 | [PowerShell Loading DotNET into Memory via Reflection](/endpoint/powershell_loading_dotnet_into_memory_via_reflection/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
 | [Powershell Processing Stream Of Data](/endpoint/powershell_processing_stream_of_data/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
 | [Powershell Using memory As Backing Store](/endpoint/powershell_using_memory_as_backing_store/) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP |
 | [Recon AVProduct Through Pwh or WMI](/endpoint/recon_avproduct_through_pwh_or_wmi/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
-| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
+| [Recon Using WMI Class](/endpoint/recon_using_wmi_class/) | [Gather Victim Host Information](/tags/#gather-victim-host-information), [PowerShell](/tags/#powershell)| TTP |
+| [ServicePrincipalNames Discovery with PowerShell](/endpoint/serviceprincipalnames_discovery_with_powershell/) | [Kerberoasting](/tags/#kerberoasting)| TTP |
 | [Set Default PowerShell Execution Policy To Unrestricted or Bypass](/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell)| TTP |
 | [Unloading AMSI via Reflection](/endpoint/unloading_amsi_via_reflection/) | [Impair Defenses](/tags/#impair-defenses), [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP |
 | [WMI Recon Running Process Or Services](/endpoint/wmi_recon_running_process_or_services/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
diff --git a/docs/_stories/ransomware.md b/docs/_stories/ransomware.md
index e6626f3fa5..ece4ff2fdd 100644
--- a/docs/_stories/ransomware.md
+++ b/docs/_stories/ransomware.md
@@ -70,7 +70,7 @@ Ransomware is an ever-present risk to the enterprise, wherein an infected host e
 | [Permission Modification using Takeown App](/endpoint/permission_modification_using_takeown_app/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification)| TTP |
 | [Powershell Disable Security Monitoring](/endpoint/powershell_disable_security_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
 | [Powershell Enable SMB1Protocol Feature](/endpoint/powershell_enable_smb1protocol_feature/) | [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools)| TTP |
-| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution)| TTP |
+| [Powershell Execute COM Object](/endpoint/powershell_execute_com_object/) | [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [PowerShell](/tags/#powershell)| TTP |
 | [Prevent Automatic Repair Mode using Bcdedit](/endpoint/prevent_automatic_repair_mode_using_bcdedit/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery)| TTP |
 | [Recon AVProduct Through Pwh or WMI](/endpoint/recon_avproduct_through_pwh_or_wmi/) | [Gather Victim Host Information](/tags/#gather-victim-host-information)| TTP |
 | [Recursive Delete of Directory In Batch CMD](/endpoint/recursive_delete_of_directory_in_batch_cmd/) | [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host)| TTP |
diff --git a/docs/_stories/splunk_vulnerabilities.md b/docs/_stories/splunk_vulnerabilities.md
index 112db56d1a..91fc04e7cb 100644
--- a/docs/_stories/splunk_vulnerabilities.md
+++ b/docs/_stories/splunk_vulnerabilities.md
@@ -34,6 +34,7 @@ This analytic story includes detections that focus on attacker behavior targeted
 
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
+| [Detect Risky SPL using Pretrained ML Model](/application/detect_risky_spl_using_pretrained_ml_model/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Anomaly |
 | [Path traversal SPL injection](/application/path_traversal_spl_injection/) | [File and Directory Discovery](/tags/#file-and-directory-discovery)| TTP |
 | [Splunk Command and Scripting Interpreter Delete Usage](/application/splunk_command_and_scripting_interpreter_delete_usage/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Anomaly |
 | [Splunk Command and Scripting Interpreter Risky Commands](/application/splunk_command_and_scripting_interpreter_risky_commands/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting |
diff --git a/docs/_stories/windows_defense_evasion_tactics.md b/docs/_stories/windows_defense_evasion_tactics.md
index c9cdd4b3f0..8abb5678a2 100644
--- a/docs/_stories/windows_defense_evasion_tactics.md
+++ b/docs/_stories/windows_defense_evasion_tactics.md
@@ -64,7 +64,7 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve
 | [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
 | [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
 | [Suspicious Reg exe Process](/endpoint/suspicious_reg_exe_process/) | [Modify Registry](/tags/#modify-registry)| TTP |
-| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [MMC](/tags/#mmc)| TTP |
 | [Windows Command and Scripting Interpreter Hunting Path Traversal](/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting |
 | [Windows Command and Scripting Interpreter Path Traversal Exec](/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP |
 | [Windows Defender Exclusion Registry Entry](/endpoint/windows_defender_exclusion_registry_entry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json
index cf6253f311..3ae393b8e1 100644
--- a/docs/mitre-map/coverage.json
+++ b/docs/mitre-map/coverage.json
@@ -4,16 +4,16 @@
     "description": "security_content detection coverage",
     "domain": "mitre-enterprise",
     "techniques": [
+        {
+            "techniqueID": "T1059",
+            "score": 46,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/detect_risky_spl_using_pretrained_ml_model.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/living_off_the_land.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_writing_dynamicwrapperx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_identify_protocol_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml"
+        },
         {
             "techniqueID": "T1083",
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/path_traversal_spl_injection.yml"
         },
-        {
-            "techniqueID": "T1059",
-            "score": 43,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_delete_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_risky_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/splunk_command_and_scripting_interpreter_risky_spl_mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/chcp_command_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_distinct_processes_from_windows_temp.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_taskhost_processes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/jscript_execution_using_cscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/macos_lolbin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_ldap_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_scripting_process_loading_wmi_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_writing_dynamicwrapperx.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_process_with_discord_dns_query.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/vbscript_execution_using_wscript_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_hunting_path_traversal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml"
-        },
         {
             "techniqueID": "T1587.003",
             "score": 2,
@@ -116,8 +116,8 @@
         },
         {
             "techniqueID": "T1562",
-            "score": 53,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_iptables_firewall_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_registry_delete_task_sd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml"
+            "score": 55,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_network_access_control_list_deleted.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_network_discovery_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/etw_registry_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/firewall_allowed_program_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_iptables_firewall_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/processes_launching_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_registry_delete_task_sd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stdout_redirection_to_dev_null_file.yml"
         },
         {
             "techniqueID": "T1554",
@@ -241,19 +241,14 @@
         },
         {
             "techniqueID": "T1059.001",
-            "score": 20,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_powershell_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml"
+            "score": 28,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_powershell_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/get_foresttrust_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getlocaluser_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/nishang_powershelltcponeline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_4104_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_creating_thread_mutex.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_domain_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_execute_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_processing_stream_of_data.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_using_memory_as_backing_store.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/recon_using_wmi_class.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unloading_amsi_via_reflection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_powershell_import_applocker_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_module_usage.yml"
         },
         {
             "techniqueID": "T1059.003",
             "score": 8,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/first_time_seen_command_line_argument.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/windows_connhost_exe_started_forcefully.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_carry_out_string_command_parameter.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmd_echo_pipe___escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/potentially_malicious_code_on_commandline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ryuk_wake_on_lan_command.yml"
         },
-        {
-            "techniqueID": "T1525",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_gcr_container_uploaded.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/new_container_uploaded_to_aws_ecr.yml"
-        },
         {
             "techniqueID": "T1078.002",
             "score": 5,
@@ -281,8 +276,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 54,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_diskshadow_proxy_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
+            "score": 55,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_diskshadow_proxy_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
         },
         {
             "techniqueID": "T1036",
@@ -346,18 +341,18 @@
         },
         {
             "techniqueID": "T1562.001",
-            "score": 42,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml"
+            "score": 44,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/add_or_set_windows_defender_exclusion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempt_to_stop_security_service.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_amsi_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_antivirus_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_blockatfirstseen_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_enhanced_notification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_mpengine_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_spynet_reporting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_defender_submit_samples_consent_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_etw_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_registry_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_show_hidden_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_app_hotkeys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_behavior_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_windows_smartscreen_protection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_cmd_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_controlpanel.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_defender_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_firewall_with_netsh.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_folderoptions_windows_feature.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_norun_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/disabling_task_manager.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_usage_of_taskkill.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hide_user_account_from_sign_in_screen.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_disable_security_monitoring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remove_windows_defender_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_windows_defender_exclusion_commands.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_kill_base_on_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unload_sysmon_filter_driver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defender_exclusion_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disableantispyware_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dism_remove_defender.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_for_service_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_excessive_disabled_services_event.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_add_xml_applocker_rules.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_context_menu.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_delete_win_defender_profile_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defense_deny_security_software_with_applocker.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_impair_defenses_disable_win_defender_auto_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raccine_scheduled_task_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_terminating_lsass_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmic_noninteractive_app_uninstallation.yml"
         },
         {
             "techniqueID": "T1021.001",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_traffic.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_services_allow_remote_assistance.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_services_rdp_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_traffic.yml"
         },
         {
             "techniqueID": "T1021",
-            "score": 20,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executable_file_written_in_administrative_smb_share.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mmc_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/smb_traffic_spike___mltk.yml"
+            "score": 24,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_psexec_with_accepteula_flag.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_rdp_in_other_port_number.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/executable_file_written_in_administrative_smb_share.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mmc_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_service_rdpwinst_tool_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_services_allow_remote_assistance.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_services_rdp_enable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wsmprovhost_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remote_desktop_process_running_on_system.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_bruteforce.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/remote_desktop_network_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/smb_traffic_spike.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/smb_traffic_spike___mltk.yml"
         },
         {
             "techniqueID": "T1548",
@@ -366,8 +361,8 @@
         },
         {
             "techniqueID": "T1105",
-            "score": 12,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/curl_download_and_bash_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wget_download_and_bash_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_curl_download_to_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_curl_upload_to_remote_destination.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_curl_network_connection.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadfile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/any_powershell_downloadstring.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/bitsadmin_download_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/curl_download_and_bash_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/download_files_using_telegram.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/living_off_the_land.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wget_download_and_bash_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_curl_download_to_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_curl_upload_to_remote_destination.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_curl_network_connection.yml"
         },
         {
             "techniqueID": "T1036.005",
@@ -536,8 +531,8 @@
         },
         {
             "techniqueID": "T1190",
-            "score": 26,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hunting_for_log4shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_class_file_download_by_java_user_agent.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_writing_jsp_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_java_spawning_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_java_spawning_shells.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winrm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_zerologon_via_zeek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/sql_injection_with_long_urls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/spring4shell_payload_url_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_server_side_template_injection_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_jsp_request_via_url.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring4shell_http_request_class_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring_cloud_function_functionrouter.yml"
+            "score": 27,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_exchange_web_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/hunting_for_log4shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_class_file_download_by_java_user_agent.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/java_writing_jsp_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_java_spawning_shell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/living_off_the_land.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unified_messaging_service_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/exchange_powershell_abuse_via_ssrf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_java_spawning_shells.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winrm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_zerologon_via_zeek.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/detect_f5_tmui_rce_cve_2020_5902.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/sql_injection_with_long_urls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_ldap_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26134.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/spring4shell_payload_url_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_server_side_template_injection_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/vmware_workspace_one_freemarker_server_side_template_injection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_jsp_request_via_url.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring4shell_http_request_class_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/web/web_spring_cloud_function_functionrouter.yml"
         },
         {
             "techniqueID": "T1218.001",
@@ -596,8 +591,8 @@
         },
         {
             "techniqueID": "T1546.003",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_wmi_event_subscription_persistence.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml"
         },
         {
             "techniqueID": "T1070.001",
@@ -606,8 +601,8 @@
         },
         {
             "techniqueID": "T1112",
-            "score": 17,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_security_logs_using_minint_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_inprocserver32_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_client_registry_install_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_shimcache_flush.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_change_password_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_logoff_button_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_notification_center.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_shutdown_button_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_hide_notification_features_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml"
+            "score": 24,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/disable_security_logs_using_minint_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/fodhelper_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/malicious_inprocserver32_modification.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/remcos_client_registry_install_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/revil_registry_entry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_shimcache_flush.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_reg_exe_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_change_password_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_logoff_button_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_notification_center.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_shutdown_button_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_hide_notification_features_through_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_disallow_windows_app.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_regedit_silent_reg_import.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml"
         },
         {
             "techniqueID": "T1564",
@@ -646,8 +641,8 @@
         },
         {
             "techniqueID": "T1489",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stop_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stop_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_stop_by_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_valid_account_with_never_expires_password.yml"
         },
         {
             "techniqueID": "T1222",
@@ -819,6 +814,11 @@
             "score": 3,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rubeus_command_line_parameters.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml"
         },
+        {
+            "techniqueID": "T1218.014",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/mmc_lolbas_execution_process_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/possible_lateral_movement_powershell_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml"
+        },
         {
             "techniqueID": "T1491",
             "score": 1,
@@ -981,13 +981,23 @@
         },
         {
             "techniqueID": "T1590",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml"
         },
         {
             "techniqueID": "T1590.005",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml"
+        },
+        {
+            "techniqueID": "T1071",
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_smb_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/excessive_dns_failures.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/tor_traffic.yml"
+        },
+        {
+            "techniqueID": "T1218.013",
             "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml"
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml"
         },
         {
             "techniqueID": "T1218.004",
@@ -1014,6 +1024,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_nirsoft_advancedrun.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_nirsoft_utilities.yml"
         },
+        {
+            "techniqueID": "T1218.008",
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_odbcconf_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_odbcconf_load_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_odbcconf_load_response_file.yml"
+        },
         {
             "techniqueID": "T1561.002",
             "score": 2,
@@ -1024,6 +1039,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml"
         },
+        {
+            "techniqueID": "T1219",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_access_software_rms_registry.yml"
+        },
         {
             "techniqueID": "T1220",
             "score": 2,
@@ -1094,11 +1114,6 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_smb_traffic.yml"
         },
-        {
-            "techniqueID": "T1071",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/network/detect_outbound_smb_traffic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/dns_query_length_outliers___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/excessive_dns_failures.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/network/tor_traffic.yml"
-        },
         {
             "techniqueID": "T1041",
             "score": 1,
@@ -1137,7 +1152,7 @@
             "#096ed7"
         ],
         "minValue": 0,
-        "maxValue": 54
+        "maxValue": 55
     },
     "filters": {
         "platforms": [

From 48271e887863e36ef527553c5ed2093b25492f75 Mon Sep 17 00:00:00 2001
From: d1vious <josehelps@gmail.com>
Date: Wed, 20 Jul 2022 17:52:11 -0400
Subject: [PATCH 2/2] moving to deprecated

---
 .../container_implantation_monitoring_and_investigation.yml       | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename stories/{ => deprecated}/container_implantation_monitoring_and_investigation.yml (100%)

diff --git a/stories/container_implantation_monitoring_and_investigation.yml b/stories/deprecated/container_implantation_monitoring_and_investigation.yml
similarity index 100%
rename from stories/container_implantation_monitoring_and_investigation.yml
rename to stories/deprecated/container_implantation_monitoring_and_investigation.yml