diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
index c19a9120a2..1239ddecd3 100644
--- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml
+++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
@@ -41,6 +41,7 @@ tags:
   - ProxyNotShell
   - Qakbot
   - Chaos Ransomware
+  - AsyncRAT
   automated_detection_testing: passed
   confidence: 50
   context:
diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
index 636a33c60c..0320a29342 100644
--- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
+++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
@@ -52,6 +52,8 @@ tags:
   - Trickbot
   - Chaos Ransomware
   - LockBit Ransomware
+  - AsyncRAT
+  - Swift Slicer
   automated_detection_testing: passed
   confidence: 50
   context:
diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml
index 12e3d27224..a6245ff28a 100644
--- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml
+++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml
@@ -2,7 +2,7 @@ name: Execution of File with Multiple Extensions
 id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7
 version: 3
 date: '2020-11-18'
-author: Rico Valdez, Splunk
+author: Rico Valdez, Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
@@ -10,21 +10,25 @@ description: This search looks for processes launched from files that have doubl
   extensions in the file name. This is typically done to obscure the "real" file extension
   and make it appear as though the file being accessed is a data file, as opposed
   to executable content.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process = *.doc.exe
-  OR Processes.process = *.htm.exe OR Processes.process = *.html.exe OR Processes.process
-  = *.txt.exe OR Processes.process = *.pdf.exe OR Processes.process = *.doc.exe by
-  Processes.dest Processes.user Processes.process Processes.parent_process | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | `execution_of_file_with_multiple_extensions_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process IN ("*.doc.exe", "*.xls.exe","*.ppt.exe", "*.htm.exe", "*.html.exe", "*.txt.exe", "*.pdf.exe", 
+  "*.docx.exe", "*.xlsx.exe", "*.pptx.exe","*.one.exe", "*.bat.exe", "*rtf.exe") 
+  by Processes.dest Processes.user Processes.process Processes.parent_process 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `drop_dm_object_name(Processes)` 
+  | `execution_of_file_with_multiple_extensions_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records process activity from your hosts to populate the endpoint data model
   in the processes node.
 known_false_positives: None identified.
-references: []
+references: 
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
 tags:
   analytic_story:
   - Windows File Extension and Association Abuse
   - Masquerading - Rename System Utilities
+  - AsyncRAT
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml
index e0f0ca006b..089c1fa6db 100644
--- a/detections/endpoint/loading_of_dynwrapx_module.yml
+++ b/detections/endpoint/loading_of_dynwrapx_module.yml
@@ -34,9 +34,11 @@ references:
 - https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
 - https://tria.ge/210929-ap75vsddan
 - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
 tags:
   analytic_story:
   - Remcos
+  - AsyncRAT
   confidence: 100
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
index 0d1737fdd4..7161c76f83 100644
--- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
+++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
@@ -30,6 +30,7 @@ tags:
   - DHS Report TA18-074A
   - HAFNIUM Group
   - DarkCrystal RAT
+  - AsyncRAT
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
index 6be2fe62a8..61a46593c3 100644
--- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
+++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
@@ -20,9 +20,11 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 ScriptBlockText=*frombase64string* | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter`'
+search: '`powershell` EventCode=4104 ScriptBlockText = "*frombase64string*" OR ScriptBlockText = "*gnirtS46esaBmorF*" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `powershell_fileless_script_contains_base64_encoded_content_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -36,6 +38,7 @@ tags:
   analytic_story:
   - Hermetic Wiper 
   - Malicious PowerShell
+  - AsyncRAT
   confidence: 80
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
index d75da6a33f..c7994cef85 100644
--- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
+++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
@@ -38,6 +38,7 @@ tags:
   - Hermetic Wiper 
   - Malicious PowerShell
   - AgentTesla
+  - AsyncRAT
   confidence: 80
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml
index f1916b6e27..ef4b4a8c3b 100644
--- a/detections/endpoint/powershell_processing_stream_of_data.yml
+++ b/detections/endpoint/powershell_processing_stream_of_data.yml
@@ -30,6 +30,7 @@ tags:
   analytic_story:
   - Hermetic Wiper 
   - Malicious PowerShell
+  - AsyncRAT
   confidence: 80
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml
index d2097f3cea..35bbbeeae8 100644
--- a/detections/endpoint/recon_using_wmi_class.yml
+++ b/detections/endpoint/recon_using_wmi_class.yml
@@ -37,6 +37,7 @@ tags:
   - Industroyer2
   - Qakbot
   - LockBit Ransomware
+  - AsyncRAT
   confidence: 80
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml
index f34b445490..7cf8f71de9 100644
--- a/detections/endpoint/registry_keys_used_for_persistence.yml
+++ b/detections/endpoint/registry_keys_used_for_persistence.yml
@@ -56,6 +56,7 @@ tags:
   - Azorult
   - Qakbot
   - Chaos Ransomware
+  - AsyncRAT
   asset_type: Endpoint
   cis20:
   - CIS 8
diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml
index 1aab04eb9a..256fa37499 100644
--- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml
+++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml
@@ -35,6 +35,7 @@ tags:
   - Remcos
   - Hermetic Wiper
   - Living Off The Land
+  - AsyncRAT
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml
index 4870a430ed..c5fe49ec9e 100644
--- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml
+++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml
@@ -37,6 +37,7 @@ tags:
   - Remcos
   - Living Off The Land
   - Qakbot
+  - AsyncRAT
   confidence: 80
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
index b2fcb6a9ba..86658c58f1 100644
--- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
+++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
@@ -39,6 +39,7 @@ tags:
   - Qakbot
   - Trickbot
   - Prestige Ransomware
+  - AsyncRAT
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml
index cf42d1b659..27c4affdff 100644
--- a/detections/endpoint/suspicious_copy_on_system32.yml
+++ b/detections/endpoint/suspicious_copy_on_system32.yml
@@ -32,6 +32,7 @@ tags:
   - Unusual Processes
   - Qakbot
   - IcedID
+  - AsyncRAT
   confidence: 90
   context:
   - Stage:Execution
diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml
index d7d110624c..4c86863b05 100644
--- a/detections/endpoint/suspicious_process_file_path.yml
+++ b/detections/endpoint/suspicious_process_file_path.yml
@@ -1,7 +1,7 @@
 name: Suspicious Process File Path
 id: 9be25988-ad82-11eb-a14f-acde48001122
 version: 1
-date: '2021-05-05'
+date: '2023-01-25'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -31,6 +31,7 @@ references:
 - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 - https://twitter.com/pr0xylife/status/1590394227758104576
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
 tags:
   analytic_story:
   - Data Destruction 
@@ -50,6 +51,8 @@ tags:
   - Prestige Ransomware
   - Chaos Ransomware
   - LockBit Ransomware
+  - AsyncRAT
+  - Swift Slicer
   automated_detection_testing: passed
   confidence: 50
   context:
diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml
index bf7c985b7b..4f1cf24d68 100644
--- a/detections/endpoint/vbscript_execution_using_wscript_app.yml
+++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml
@@ -26,10 +26,12 @@ how_to_implement: To successfully implement this search you need to be ingesting
 known_false_positives: unknown
 references:
 - https://www.joesandbox.com/analysis/369332/0/html
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
 tags:
   analytic_story:
   - FIN7
   - Remcos
+  - AsyncRAT
   confidence: 70
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml
index 89c68e99d5..867efa92ea 100644
--- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml
+++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml
@@ -22,9 +22,11 @@ references:
 - https://devblogs.microsoft.com/oldnewthing/20080314-00/?p=23113
 - https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e
 - https://atomicredteam.io/privilege-escalation/T1134.001/#atomic-test-2---%60sedebugprivilege%60-token-duplication
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
 tags:
   analytic_story:
   - Brute Ratel C4
+  - AsyncRAT
   asset_type:  Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/windows_powershell_cryptography_namespace.yml b/detections/endpoint/windows_powershell_cryptography_namespace.yml
new file mode 100644
index 0000000000..22785d2a30
--- /dev/null
+++ b/detections/endpoint/windows_powershell_cryptography_namespace.yml
@@ -0,0 +1,69 @@
+name: Windows Powershell Cryptography Namespace
+id: f8b482f4-6d62-49fa-a905-dfa15698317b
+version: 1
+date: '2023-01-26'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies suspicious PowerShell script execution
+  via EventCode 4104 that is processing cryptography namespace library. 
+  This technique was seen in several powershell malware, loader, downloader and stager that will decrypt or decode the next malicious stager or the actual payload. 
+  This Anomaly detection can be a good indicator that a powershell process to decrypt code. We recommend to further check the parent_process_name, the file or data 
+  it tries to decrypt, network connection and user who execute the script.
+search: '`powershell` EventCode=4104 ScriptBlockText = "*System.Security.Cryptography*" AND NOT(ScriptBlockText IN ("*SHA*", "*MD5*", "*DeriveBytes*"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_powershell_cryptography_namespace_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: False positives should be limited. Filter as needed.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
+tags:
+  analytic_story:
+  - AsyncRAT
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/windows-powershell-xml.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: A suspicious powershell script contains cryptography command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$
+  mitre_attack_id:
+  - T1059.001
+  - T1059
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
+  - EventCodes
+  risk_score: 25
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml b/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml
new file mode 100644
index 0000000000..62488a1eca
--- /dev/null
+++ b/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml
@@ -0,0 +1,76 @@
+name: Windows Scheduled Task with Highest Privileges
+id: 2f15e1a4-0fc2-49dd-919e-cbbe60699218
+version: 1
+date: '2023-01-26'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies Schtasks.exe creating a new task with highest privilege execution. 
+  This techniques was seen in asyncrat where it uses the scheduled task as part of it persistence and privilege escalation. 
+  AsyncRAT will setup a scheduled task with parameter '/rl' and 'highest' to trigger this technique. This TTP detection can be a 
+  good indicator of malware or adversaries trying to gain persistence and privilege escalation through scheduled task. We recommend to always 
+  check and monitoring this type of events even filtering is needed.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime  from datamodel=Endpoint.Processes 
+  where Processes.process_name = "schtasks.exe" Processes.process = "*/rl *" Processes.process = "* highest *"
+  by Processes.process_name Processes.parent_process_name Processes.parent_process Processes.process Processes.process_guid Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_scheduled_task_with_highest_privileges_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+known_false_positives: False positives will be limited to legitimate applications
+  creating a task to run as SYSTEM. Filter as needed based on parent process, or modify
+  the query to have world writeable paths to restrict it.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
+tags:
+  analytic_story:
+  - AsyncRAT
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: a $process_name$ creating a schedule task $process$ with highest run level privilege in $dest$
+  mitre_attack_id:
+  - T1053
+  - T1053.005
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 64
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml b/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml
new file mode 100644
index 0000000000..cf9810daa7
--- /dev/null
+++ b/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml
@@ -0,0 +1,70 @@
+name: 'Windows Spearphishing Attachment Connect To None MS Office Domain'
+id: 1cb40e15-cffa-45cc-abbd-e35884a49766
+version: 1
+date: '2023-01-27'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: this detection was designed to identifies suspicious office documents
+  that connect to a website aside from Microsoft Office Domain. This technique was seen in 
+  several malicious documents that abuses .rels xml properties of MS office to connect or download malicious files. 
+  This hunting query can a good pivot or guide to check what URL link it tries to connect, what domain, where the documents came from and 
+  how the connection happens.
+search: '`sysmon` EventCode=22 Image IN ("*\\winword.exe","*\\excel.exe","*\\powerpnt.exe","*\\mspub.exe","*\\visio.exe","*\\wordpad.exe","*\\wordview.exe","*\\onenote.exe",
+  "*\\onenotem.exe","*\\onenoteviewer.exe","*\\onenoteim.exe") 
+  AND NOT(QueryName IN ("*.office.com", "*.office.net"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryResults QueryStatus Computer
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_spearphishing_attachment_connect_to_none_ms_office_domain_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Windows Office document may contain legitimate url link other than MS office Domain. filter is needed
+references:
+- https://www.netskope.com/blog/asyncrat-using-fully-undetected-downloader
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  - AsyncRAT
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/office_doc_abuses_rels/sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: a office document process $Image$ connect to an URL link $QueryName$ in $Computer$
+  mitre_attack_id:
+  - T1566.001
+  - T1566
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image 
+  - QueryName 
+  - QueryResults 
+  - QueryStatus 
+  - Computer
+  risk_score: 9
+  security_domain: endpoint
diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
index 2cf55b3181..9f09959223 100644
--- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
@@ -47,6 +47,7 @@ tags:
   - Industroyer2
   - CISA AA22-257A
   - Prestige Ransomware
+  - AsyncRAT
   confidence: 100
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
index ddfd760714..f07564c58f 100644
--- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
+++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
@@ -36,6 +36,7 @@ tags:
   - CISA AA22-257A
   - Qakbot
   - Prestige Ransomware
+  - AsyncRAT
   confidence: 100
   context:
   - Source:Endpoint
diff --git a/tests/endpoint/windows_powershell_cryptography_namespace.test.yml b/tests/endpoint/windows_powershell_cryptography_namespace.test.yml
new file mode 100644
index 0000000000..d8b74bc1b7
--- /dev/null
+++ b/tests/endpoint/windows_powershell_cryptography_namespace.test.yml
@@ -0,0 +1,13 @@
+name: Windows Powershell Cryptography Namespace Unit Test
+tests:
+- name: Windows Powershell Cryptography Namespace
+  file: endpoint/windows_powershell_cryptography_namespace.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-powershell-xml.log
+    data:  https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/windows-powershell-xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_scheduled_task_with_highest_privileges.test.yml b/tests/endpoint/windows_scheduled_task_with_highest_privileges.test.yml
new file mode 100644
index 0000000000..b527dbd01d
--- /dev/null
+++ b/tests/endpoint/windows_scheduled_task_with_highest_privileges.test.yml
@@ -0,0 +1,13 @@
+name: Windows Scheduled Task with Highest Privileges Unit Test
+tests:
+- name: Windows Scheduled Task with Highest Privileges
+  file: endpoint/windows_scheduled_task_with_highest_privileges.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.test.yml b/tests/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.test.yml
new file mode 100644
index 0000000000..6c0843d362
--- /dev/null
+++ b/tests/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.test.yml
@@ -0,0 +1,13 @@
+name: Windows Spearphishing Attachment Connect To None MS Office Domain Unit Test
+tests:
+- name: 'Windows Spearphishing Attachment Connect To None MS Office Domain'
+  file: endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/office_doc_abuses_rels/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true