From e6cc42371eefd3323535fe3306daa602425b9ebc Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Mon, 15 Nov 2021 11:39:06 +0100
Subject: [PATCH 1/7] minor_ssa_update

---
 .../ssa___attempt_to_delete_services.yml       | 15 ++++++++++++++-
 .../ssa___attempt_to_disable_services.yml      | 13 +++++++++++++
 .../endpoint/ssa___delete_a_net_user.yml       | 18 ++++++++++++++++--
 .../ssa___disable_net_user_account.yml         | 15 ++++++++++++++-
 .../ssa___resize_shadowstorage_volume.yml      | 13 +++++++++++++
 .../endpoint/ssa___delete_a_net_user.test.yml  |  3 +++
 6 files changed, 73 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml
index 2321bedfa3..47fb1c6976 100644
--- a/detections/endpoint/ssa___attempt_to_delete_services.yml
+++ b/detections/endpoint/ssa___attempt_to_delete_services.yml
@@ -1,4 +1,4 @@
-name: Attempt To delete Services
+name: Attempt To Delete Services
 id: a0c8c292-d01a-11eb-aa18-acde48001122
 version: 2
 date: '2021-06-18'
@@ -57,3 +57,16 @@ tags:
   - process
   risk_severity: high
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  message: deleted service with commandline $process$ on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml
index 2afe31f0da..93a81ad172 100644
--- a/detections/endpoint/ssa___attempt_to_disable_services.yml
+++ b/detections/endpoint/ssa___attempt_to_disable_services.yml
@@ -59,3 +59,16 @@ tags:
   - process
   risk_severity: medium
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  message: disable service with commandline $process$ on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml
index 5024295db6..e119134115 100644
--- a/detections/endpoint/ssa___delete_a_net_user.yml
+++ b/detections/endpoint/ssa___delete_a_net_user.yml
@@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
+  cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND like(cmd_line, "%user%") AND (process_name="net1.exe"
   OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
@@ -41,10 +41,11 @@ tags:
   - CIS 16
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
-  - T1489
+  - T1531
   nist:
   - PR.AC
   - PR.IP
@@ -60,3 +61,16 @@ tags:
   - process
   risk_severity: high
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  message: deleted net users with commandline $process$ on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml
index b3772d342d..59220e00f6 100644
--- a/detections/endpoint/ssa___disable_net_user_account.yml
+++ b/detections/endpoint/ssa___disable_net_user_account.yml
@@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe"
+  cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND like(cmd_line, "%user%") AND (process_name="net1.exe"
   OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
@@ -59,3 +59,16 @@ tags:
   - process
   risk_severity: medium
   security_domain: endpoint
+  impact: 70
+  confidence: 70
+  # (impact * confidence)/100
+  risk_score: 49
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  message: disable net users with commandline $process$ on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/ssa___resize_shadowstorage_volume.yml b/detections/endpoint/ssa___resize_shadowstorage_volume.yml
index df3b78a776..8076446abc 100644
--- a/detections/endpoint/ssa___resize_shadowstorage_volume.yml
+++ b/detections/endpoint/ssa___resize_shadowstorage_volume.yml
@@ -61,3 +61,16 @@ tags:
   - process
   risk_severity: high
   security_domain: endpoint
+  impact: 80
+  confidence: 80
+  # (impact * confidence)/100
+  risk_score: 64
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  message: resize shadow copy made by process$process_name$ with commandline $process$ on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/tests/endpoint/ssa___delete_a_net_user.test.yml b/tests/endpoint/ssa___delete_a_net_user.test.yml
index bfe2de587b..4ce762e1fa 100644
--- a/tests/endpoint/ssa___delete_a_net_user.test.yml
+++ b/tests/endpoint/ssa___delete_a_net_user.test.yml
@@ -7,4 +7,7 @@ tests:
     attack_data:
       - file_name: net_user_del.log
         data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
+        source: WinEventLog:Security
+      - file_name: security.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log
         source: WinEventLog:Security
\ No newline at end of file

From 7948c3c1c64f6a044c770e4bc77a3265941c3b05 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Wed, 17 Nov 2021 11:42:54 +0100
Subject: [PATCH 2/7] Update ssa___attempt_to_disable_services.yml

---
 detections/endpoint/ssa___attempt_to_disable_services.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml
index 93a81ad172..72bb3a7284 100644
--- a/detections/endpoint/ssa___attempt_to_disable_services.yml
+++ b/detections/endpoint/ssa___attempt_to_disable_services.yml
@@ -66,9 +66,9 @@ tags:
   context:
   - Source:Endpoint
   - stage:Defense Evasion
-  message: disable service with commandline $process$ on $dest$ by $user$
+  message: disable service using sc.exe with commandline $process$ on $dest$ by $user$
   observable:
   - name: dest
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim

From b20185a0374f301e67f4d65a39b3b4774b4bd7a2 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 18 Nov 2021 12:11:02 +0100
Subject: [PATCH 3/7] Update ssa___attempt_to_delete_services.yml

---
 detections/endpoint/ssa___attempt_to_delete_services.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml
index 47fb1c6976..479e5ffd60 100644
--- a/detections/endpoint/ssa___attempt_to_delete_services.yml
+++ b/detections/endpoint/ssa___attempt_to_delete_services.yml
@@ -69,4 +69,5 @@ tags:
   - name: dest
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+    

From 295acf12f0aa65d081455a82fc8ba01eda977f69 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 25 Nov 2021 09:30:44 +0100
Subject: [PATCH 4/7] Update ssa___delete_a_net_user.test.yml

---
 tests/endpoint/ssa___delete_a_net_user.test.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/endpoint/ssa___delete_a_net_user.test.yml b/tests/endpoint/ssa___delete_a_net_user.test.yml
index 4ce762e1fa..c5fa64cac3 100644
--- a/tests/endpoint/ssa___delete_a_net_user.test.yml
+++ b/tests/endpoint/ssa___delete_a_net_user.test.yml
@@ -10,4 +10,6 @@ tests:
         source: WinEventLog:Security
       - file_name: security.log
         data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log
-        source: WinEventLog:Security
\ No newline at end of file
+        source: WinEventLog:Security
+        
+        

From 7300bfe836129f3be9494005fe75c9e2009c542f Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 1 Dec 2021 11:50:33 -0700
Subject: [PATCH 5/7] Update ssa___resize_shadowstorage_volume.yml

---
 detections/endpoint/ssa___resize_shadowstorage_volume.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/ssa___resize_shadowstorage_volume.yml b/detections/endpoint/ssa___resize_shadowstorage_volume.yml
index 8076446abc..2765fa9ace 100644
--- a/detections/endpoint/ssa___resize_shadowstorage_volume.yml
+++ b/detections/endpoint/ssa___resize_shadowstorage_volume.yml
@@ -68,9 +68,9 @@ tags:
   context:
   - Source:Endpoint
   - stage:Defense Evasion
-  message: resize shadow copy made by process$process_name$ with commandline $process$ on $dest$ by $user$
+  message: resize shadow copy made by process $process_name$ with commandline $process$ on $dest$ by $user$
   observable:
   - name: dest
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim

From f0157408a70c9ce340aac598cfa679acf586daec Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 1 Dec 2021 12:28:38 -0700
Subject: [PATCH 6/7] Updated some words

---
 .../ssa___attempt_to_delete_services.yml      | 43 ++++++++++-------
 .../ssa___attempt_to_disable_services.yml     | 46 ++++++++++++-------
 .../endpoint/ssa___delete_a_net_user.yml      | 27 ++++++++---
 .../ssa___disable_net_user_account.yml        | 34 +++++++++-----
 .../ssa___resize_shadowstorage_volume.yml     | 31 +++++++++----
 5 files changed, 120 insertions(+), 61 deletions(-)

diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml
index 479e5ffd60..200ddff399 100644
--- a/detections/endpoint/ssa___attempt_to_delete_services.yml
+++ b/detections/endpoint/ssa___attempt_to_delete_services.yml
@@ -1,15 +1,13 @@
 name: Attempt To Delete Services
 id: a0c8c292-d01a-11eb-aa18-acde48001122
-version: 2
-date: '2021-06-18'
+version: 3
+date: '2021-11-30'
 author: Teoderick Contreras, splunk
 type: TTP
 datamodel:
-- Endpoint
-description: This analytic identifies suspicious series of attempt to kill multiple
-  services on a system using either `net.exe` or `sc.exe`. This technique is use by
-  adversaries to terminate security services or other related services to continue
-  there objective and evade detections.
+- Endpoint_Processes
+description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue
+  there objective and evade detections.'
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -26,7 +24,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
-known_false_positives: unknown
+known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
@@ -55,19 +53,32 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_severity: high
   security_domain: endpoint
-  impact: 70
-  confidence: 70
+  impact: 60
+  confidence: 60
   # (impact * confidence)/100
-  risk_score: 49
+  risk_score: 36
   context:
   - Source:Endpoint
-  - stage:Defense Evasion
-  message: deleted service with commandline $process$ on $dest$ by $user$
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service.
   observable:
-  - name: dest
-    type: Endpoint
+  - name: dest_user_id
+    type: User
     role:
     - Victim
-    
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml
index 72bb3a7284..f4842b77c4 100644
--- a/detections/endpoint/ssa___attempt_to_disable_services.yml
+++ b/detections/endpoint/ssa___attempt_to_disable_services.yml
@@ -1,15 +1,13 @@
 name: Attempt To Disable Services
 id: afb31de4-d023-11eb-98d5-acde48001122
-version: 2
-date: '2021-06-18'
+version: 3
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
-description: This analytic will identify suspicious series of command-line to disable
-  several services. This technique is seen where the adversary attempts to disable
-  security app services or other malware services to complete the objective on the
-  compromised system.
+- Endpoint_Processes
+description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to disable a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then disable it. Adversaries utilize this technique to terminate security services or other related services to continue
+  there objective and evade detections.'
 search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event,
   "_datamodels"), "collection<string>", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
@@ -27,10 +25,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
-known_false_positives: unknown
+known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed.
 references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
-- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+  - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+  - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service 
 tags:
   analytic_story:
   - XMRig
@@ -59,16 +58,29 @@ tags:
   - process
   risk_severity: medium
   security_domain: endpoint
-  impact: 70
-  confidence: 70
+  impact: 60
+  confidence: 60
   # (impact * confidence)/100
-  risk_score: 49
+  risk_score: 36
   context:
   - Source:Endpoint
-  - stage:Defense Evasion
-  message: disable service using sc.exe with commandline $process$ on $dest$ by $user$
+  - Stage:Privilege Escalation
+  - Stage:Persistence
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service.
   observable:
-  - name: dest
-    type: Endpoint
+  - name: dest_user_id
+    type: User
     role:
     - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml
index e119134115..25f7681c21 100644
--- a/detections/endpoint/ssa___delete_a_net_user.yml
+++ b/detections/endpoint/ssa___delete_a_net_user.yml
@@ -1,11 +1,11 @@
 name: Delete A Net User
 id: 8776d79c-d26e-11eb-9a56-acde48001122
-version: 2
-date: '2021-06-21'
+version: 3
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: This analytic will detect a suspicious net.exe/net1.exe command-line
   to delete a user on a system. This technique may be use by an administrator for
   legitimate purposes, however this behavior has been used in the wild to impair some
@@ -59,6 +59,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_severity: high
   security_domain: endpoint
   impact: 70
@@ -68,9 +69,21 @@ tags:
   context:
   - Source:Endpoint
   - stage:Defense Evasion
-  message: deleted net users with commandline $process$ on $dest$ by $user$
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a user account.
   observable:
-  - name: dest
-    type: Endpoint
+  - name: dest_user_id
+    type: User
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
\ No newline at end of file
diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml
index 59220e00f6..68fb87b6c1 100644
--- a/detections/endpoint/ssa___disable_net_user_account.yml
+++ b/detections/endpoint/ssa___disable_net_user_account.yml
@@ -1,15 +1,14 @@
 name: Disable Net User Account
 id: ba858b08-d26c-11eb-af9b-acde48001122
-version: 2
-date: '2021-06-21'
+version: 3
+date: '2021-12-01'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
 description: This analytic will identify a suspicious command-line that disables a
-  user account using the `net.exe` utility native to Windows. This technique may used
-  by the adversaries to interrupt availability of such users to do their malicious
-  act.
+  user account using the native `net.exe` or `net1.exe` utility to Windows. This technique may used
+  by the adversaries to interrupt availability of accounts and continue the impact against the organization.
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -27,8 +26,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be
   used.
-known_false_positives: network operator may use this approach to quickly disable an
-  account but not a common practice.
+known_false_positives: System administrators or automated scripts may disable an
+  account but not a common practice. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
@@ -57,6 +56,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_severity: medium
   security_domain: endpoint
   impact: 70
@@ -66,9 +66,21 @@ tags:
   context:
   - Source:Endpoint
   - stage:Defense Evasion
-  message: disable net users with commandline $process$ on $dest$ by $user$
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts.
   observable:
-  - name: dest
-    type: Endpoint
+  - name: user
+    type: User
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
diff --git a/detections/endpoint/ssa___resize_shadowstorage_volume.yml b/detections/endpoint/ssa___resize_shadowstorage_volume.yml
index 2765fa9ace..6a960b11be 100644
--- a/detections/endpoint/ssa___resize_shadowstorage_volume.yml
+++ b/detections/endpoint/ssa___resize_shadowstorage_volume.yml
@@ -6,12 +6,8 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytics identifies the resizing of shadowstorage by ransomware
-  malware to avoid the shadow volumes being made again. this technique is an alternative
-  by ransomware attacker than deleting the shadowstorage which is known alert in defensive
-  team. one example of ransomware that use this technique is CLOP ransomware where
-  it drops a .bat file that will resize the shadowstorage to minimum size as much
-  as possible
+description: The following analytic identifies the resizing of shadowstorage using vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event 
+  and a precursor to deleting the shadowstorage. 
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -29,7 +25,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: network admin can resize the shadowstorage for valid purposes.
+known_false_positives: System administrators may resize the shadowstorage for valid purposes. Filter as needed.
 references:
 - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
 - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
@@ -59,6 +55,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_severity: high
   security_domain: endpoint
   impact: 80
@@ -68,9 +65,23 @@ tags:
   context:
   - Source:Endpoint
   - stage:Defense Evasion
-  message: resize shadow copy made by process $process_name$ with commandline $process$ on $dest$ by $user$
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a shadow copy to perform
+    offline password cracking.
   observable:
-  - name: dest
-    type: Endpoint
+  - name: dest_user_id
+    type: User
     role:
     - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process

From 6999693e3ba53d3ca1dceb57f844344e9d4c8cde Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 1 Dec 2021 12:34:20 -0700
Subject: [PATCH 7/7] fixed

---
 detections/endpoint/ssa___attempt_to_delete_services.yml  | 2 +-
 detections/endpoint/ssa___attempt_to_disable_services.yml | 2 +-
 detections/endpoint/ssa___delete_a_net_user.yml           | 2 +-
 detections/endpoint/ssa___disable_net_user_account.yml    | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml
index 200ddff399..0ad02f089a 100644
--- a/detections/endpoint/ssa___attempt_to_delete_services.yml
+++ b/detections/endpoint/ssa___attempt_to_delete_services.yml
@@ -5,7 +5,7 @@ date: '2021-11-30'
 author: Teoderick Contreras, splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
+  - Endpoint
 description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue
   there objective and evade detections.'
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml
index f4842b77c4..90206eb92d 100644
--- a/detections/endpoint/ssa___attempt_to_disable_services.yml
+++ b/detections/endpoint/ssa___attempt_to_disable_services.yml
@@ -5,7 +5,7 @@ date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
+  - Endpoint
 description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to disable a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then disable it. Adversaries utilize this technique to terminate security services or other related services to continue
   there objective and evade detections.'
 search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event,
diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml
index 25f7681c21..3e8aa55767 100644
--- a/detections/endpoint/ssa___delete_a_net_user.yml
+++ b/detections/endpoint/ssa___delete_a_net_user.yml
@@ -5,7 +5,7 @@ date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint_Processes
+  - Endpoint
 description: This analytic will detect a suspicious net.exe/net1.exe command-line
   to delete a user on a system. This technique may be use by an administrator for
   legitimate purposes, however this behavior has been used in the wild to impair some
diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml
index 68fb87b6c1..c9bd61c879 100644
--- a/detections/endpoint/ssa___disable_net_user_account.yml
+++ b/detections/endpoint/ssa___disable_net_user_account.yml
@@ -5,7 +5,7 @@ date: '2021-12-01'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint
+  - Endpoint
 description: This analytic will identify a suspicious command-line that disables a
   user account using the native `net.exe` or `net1.exe` utility to Windows. This technique may used
   by the adversaries to interrupt availability of accounts and continue the impact against the organization.