improvements ssa detections

bin/contentctl_project/contentctl_infrastructure/builder/sigma_converter.py

@@ -183,7 +183,7 @@ class SigmaConverter():
                         )
                     )
 
-                    detection = self.convert_detection_fields(detection, field_mapping)
+                    detection = self.convert_detection_fields(detection, field_mapping_underline)
                     sigma_rule = self.get_sigma_rule(detection, data_source)
                     sigma_processing_pipeline = self.get_pipeline_from_processing_items(processing_items)
 

dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml

@@ -7,8 +7,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
   null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval
   process=ucast(map_get(input_event,"process"), "map<string, any>", null) | eval process_pid=ucast(map_get(process,"pid"),
-  "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,any>", null) 
-  | eval process_file_path=ucast(map_get(process_file,"path"), "string",
+  "string", null) | eval process_file=ucast(map_get(process,"file"), "map<string,
+  any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
   process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
@@ -20,7 +20,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (process.file.name="WinRAR.exe" OR like(process_file_name, "7z%") OR like(process_file_name,
+  (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") OR like(process_file_name,
   "winzip%")) AND (like(actor_process_file_name, "%powershell.exe") OR like(actor_process_file_name,
   "%cmd.exe")) 
   | eval body=create_map(

dist/ssa/srs/ssa___attempt_to_delete_services.yml

@@ -23,7 +23,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  process_file_name="sc.exe" AND like(process_cmd_line, "%delete%") 
+  like(process_cmd_line, "%delete%") AND process_file_name="sc.exe" 
   | eval body=create_map(
     "devices", [
         create_map(

dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml

@@ -21,7 +21,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%") 
+  like(process_cmd_line, "%/W:%") AND process_file_name="cipher.exe" 
   | eval body=create_map(
     "devices", [
         create_map(

dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml

@@ -22,8 +22,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe")
-  AND match_regex(process_cmd_line, /(?i)deny/)=true 
+  match_regex(process_cmd_line, /(?i)deny/)=true AND (process_file_name="icacls.exe"
+  OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") 
   | eval body=create_map(
     "devices", [
         create_map(

dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml

@@ -22,8 +22,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe")
-  AND match_regex(process_cmd_line, /(?i)grant/)=true 
+  match_regex(process_cmd_line, /(?i)grant/)=true AND (process_file_name="icacls.exe"
+  OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") 
   | eval body=create_map(
     "devices", [
         create_map(

dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml

@@ -22,7 +22,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true 
+  match_regex(process_cmd_line, /(?i)/)=true AND process_file_name="attrib.exe" 
   | eval body=create_map(
     "devices", [
         create_map(

dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml

@@ -21,10 +21,10 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (process_file_name="cscript.exe" OR process_file_name="wscript.exe") AND (match_regex(actor_process_file_name,
-  /(?i)visio.exe/)=true OR match_regex(actor_process_file_name, /(?i)mspub.exe/)=true
-  OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true OR match_regex(actor_process_file_name,
-  /(?i)excel.exe/)=true OR match_regex(actor_process_file_name, /(?i)winword.exe/)=true)
+  (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name,
+  /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true
+  OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true OR match_regex(actor_process_file_name,
+  /(?i)winword.exe/)=true) AND (process_file_name="cscript.exe" OR process_file_name="wscript.exe")
   
   | eval body=create_map(
     "devices", [

dist/ssa/srs/ssa___windows_mshta_child_process.yml

@@ -22,11 +22,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (process_file_name="wscript.exe" OR process_file_name="cscript.exe" OR process_file_name="searchprotocolhost.exe"
+  like(actor_process_file_name, "%mshta.exe") AND (process_file_name="wscript.exe"
+  OR process_file_name="cscript.exe" OR process_file_name="searchprotocolhost.exe"
   OR process_file_name="microsoft.workflow.compiler.exe" OR process_file_name="msbuild.exe"
   OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" OR process_file_name="cmd.exe"
-  OR process_file_name="powershell.exe") AND like(actor_process_file_name, "%mshta.exe")
-  
+  OR process_file_name="powershell.exe") 
   | eval body=create_map(
     "devices", [
         create_map(

dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml

@@ -24,8 +24,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  process_file_name="MSBuild.exe" AND (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true
-  OR match_regex(actor_process_file_name, /(?i)wscript.exe/)=true) 
+  (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name,
+  /(?i)wscript.exe/)=true) AND process_file_name="MSBuild.exe" 
   | eval body=create_map(
     "devices", [
         create_map(

dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml

@@ -25,7 +25,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  process_file_name="MSBuild.exe" AND match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true
+  match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true AND process_file_name="MSBuild.exe"
   
   | eval body=create_map(
     "devices", [

ssa_detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml

@@ -26,7 +26,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (process.file.name="WinRAR.exe" OR like(process_file_name, "7z%") OR like(process_file_name,
+  (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") OR like(process_file_name,
   "winzip%")) AND (like(actor_process_file_name, "%powershell.exe") OR like(actor_process_file_name,
   "%cmd.exe")) --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information

ssa_detections/endpoint/ssa___attempt_to_delete_services.yml

@@ -29,7 +29,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  process_file_name="sc.exe" AND like(process_cmd_line, "%delete%") --finding_report--'
+  like(process_cmd_line, "%delete%") AND process_file_name="sc.exe" --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -58,7 +58,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___attempt_to_disable_services.yml

@@ -58,7 +58,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -58,7 +58,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml

@@ -54,7 +54,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml

@@ -27,7 +27,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%") --finding_report--'
+  like(process_cmd_line, "%/W:%") AND process_file_name="cipher.exe" --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -54,7 +54,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___delete_a_net_user.yml

@@ -58,7 +58,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___deny_permission_using_cacls_utility.yml

@@ -28,8 +28,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe")
-  AND match_regex(process_cmd_line, /(?i)deny/)=true --finding_report--'
+  match_regex(process_cmd_line, /(?i)deny/)=true AND (process_file_name="icacls.exe"
+  OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -55,7 +55,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___detect_rclone_command_line_usage.yml

@@ -66,7 +66,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___disable_net_user_account.yml

@@ -57,7 +57,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml

@@ -62,7 +62,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___fsutil_zeroing_file.yml

@@ -56,7 +56,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___grant_permission_using_cacls_utility.yml

@@ -28,8 +28,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe")
-  AND match_regex(process_cmd_line, /(?i)grant/)=true --finding_report--'
+  match_regex(process_cmd_line, /(?i)grant/)=true AND (process_file_name="icacls.exe"
+  OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -55,7 +55,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml

@@ -28,7 +28,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true --finding_report--'
+  match_regex(process_cmd_line, /(?i)/)=true AND process_file_name="attrib.exe" --finding_report--'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.
@@ -57,7 +57,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml

@@ -58,7 +58,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___office_product_spawning_windows_script_host.yml

@@ -27,10 +27,10 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (process_file_name="cscript.exe" OR process_file_name="wscript.exe") AND (match_regex(actor_process_file_name,
-  /(?i)visio.exe/)=true OR match_regex(actor_process_file_name, /(?i)mspub.exe/)=true
-  OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true OR match_regex(actor_process_file_name,
-  /(?i)excel.exe/)=true OR match_regex(actor_process_file_name, /(?i)winword.exe/)=true)
+  (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name,
+  /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true
+  OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true OR match_regex(actor_process_file_name,
+  /(?i)winword.exe/)=true) AND (process_file_name="cscript.exe" OR process_file_name="wscript.exe")
   --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -57,7 +57,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   - name: actor.process.file.name

ssa_detections/endpoint/ssa___resize_shadowstorage_volume.yml

@@ -57,7 +57,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___sdelete_application_execution.yml

@@ -69,7 +69,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___system_process_running_from_unexpected_location.yml

@@ -264,7 +264,7 @@ tags:
   - name: process.file.path
     type: File
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___wbadmin_delete_system_backups.yml

@@ -56,7 +56,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml

@@ -62,7 +62,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml

@@ -58,7 +58,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_bits_job_persistence.yml

@@ -65,7 +65,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_bitsadmin_download_file.yml

@@ -69,7 +69,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_certutil_decode_file.yml

@@ -64,7 +64,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_certutil_urlcache_download.yml

@@ -60,7 +60,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_certutil_verifyctl_download.yml

@@ -61,7 +61,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml

@@ -60,7 +60,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml

@@ -72,7 +72,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml

@@ -53,7 +53,7 @@ tags:
   - name: process.file.path
     type: File
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml

@@ -55,7 +55,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml

@@ -98,7 +98,7 @@ tags:
   - name: process.file.path
     type: File
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml

@@ -64,7 +64,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml

@@ -58,7 +58,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml

@@ -95,7 +95,7 @@ tags:
   - name: process.file.path
     type: File
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_mshta_child_process.yml

@@ -28,11 +28,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (process_file_name="wscript.exe" OR process_file_name="cscript.exe" OR process_file_name="searchprotocolhost.exe"
+  like(actor_process_file_name, "%mshta.exe") AND (process_file_name="wscript.exe"
+  OR process_file_name="cscript.exe" OR process_file_name="searchprotocolhost.exe"
   OR process_file_name="microsoft.workflow.compiler.exe" OR process_file_name="msbuild.exe"
   OR process_file_name="colorcpl.exe" OR process_file_name="scrcons.exe" OR process_file_name="cmd.exe"
-  OR process_file_name="powershell.exe") AND like(actor_process_file_name, "%mshta.exe")
-  --finding_report--'
+  OR process_file_name="powershell.exe") --finding_report--'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -61,7 +61,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   - name: actor.process.file.name

ssa_detections/endpoint/ssa___windows_mshta_command_line_url.yml

@@ -63,7 +63,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_mshta_inline_hta_execution.yml

@@ -61,7 +61,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_odbcconf_load_response_file.yml

@@ -57,7 +57,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml

@@ -67,7 +67,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml

@@ -63,7 +63,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml

@@ -70,7 +70,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_powershell_downloadfile.yml

@@ -64,7 +64,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_powershell_start_bitstransfer.yml

@@ -62,7 +62,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_rasautou_dll_execution.yml

@@ -61,7 +61,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml

@@ -61,7 +61,7 @@ tags:
   - name: process.file.path
     type: File
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml

@@ -60,7 +60,7 @@ tags:
   - name: process.file.path
     type: File
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml

@@ -60,7 +60,7 @@ tags:
   - name: process.file.path
     type: File
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml

@@ -60,7 +60,7 @@ tags:
   - name: process.file.path
     type: File
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml

@@ -61,7 +61,7 @@ tags:
   - name: process.file.path
     type: File
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml

@@ -60,7 +60,7 @@ tags:
   - name: process.file.path
     type: File
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml

@@ -60,7 +60,7 @@ tags:
   - name: process.file.path
     type: File
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml

@@ -60,7 +60,7 @@ tags:
   - name: process.file.path
     type: File
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml

@@ -60,7 +60,7 @@ tags:
   - name: process.file.path
     type: File
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml

@@ -55,7 +55,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_rundll32_inline_hta_execution.yml

@@ -62,7 +62,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml

@@ -30,8 +30,8 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  process_file_name="MSBuild.exe" AND (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true
-  OR match_regex(actor_process_file_name, /(?i)wscript.exe/)=true) --finding_report--'
+  (match_regex(actor_process_file_name, /(?i)cscript.exe/)=true OR match_regex(actor_process_file_name,
+  /(?i)wscript.exe/)=true) AND process_file_name="MSBuild.exe" --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -60,7 +60,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   - name: actor.process.file.name

ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml

@@ -59,7 +59,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml

@@ -68,7 +68,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml

@@ -71,7 +71,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml

@@ -54,7 +54,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml

@@ -54,7 +54,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml

@@ -54,7 +54,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   product:

ssa_detections/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml

@@ -31,7 +31,7 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
   null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
   | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  process_file_name="MSBuild.exe" AND match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true
+  match_regex(actor_process_file_name, /(?i)wmiprvse.exe/)=true AND process_file_name="MSBuild.exe"
   --finding_report--'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -61,7 +61,7 @@ tags:
   - name: device.hostname
     type: Hostname
   - name: process.file.name
-    type: File Name
+    type: File
   - name: process.cmd_line
     type: Other
   - name: actor.process.file.name