diff --git a/bin/generate.py b/bin/generate.py
index 975a9449c3..ee2f245d1c 100644
--- a/bin/generate.py
+++ b/bin/generate.py
@@ -64,6 +64,7 @@ def generate_savedsearches_conf(detections, investigations, baselines):
     output_path = OUTPUT_PATH + "/default/savedsearches.conf"
     output = template.render(detections=detections, investigations=investigations, baselines=baselines, time=utc_time)
     with open(output_path, 'w') as f:
+        output = output.encode('ascii', 'ignore').decode('ascii')
         f.write(output)
 
     return output_path
diff --git a/detections/system_processes_run_from_unexpected_locations.yml b/detections/system_processes_run_from_unexpected_locations.yml
index a24938ea99..9cf09a64e1 100644
--- a/detections/system_processes_run_from_unexpected_locations.yml
+++ b/detections/system_processes_run_from_unexpected_locations.yml
@@ -29,9 +29,9 @@ detect:
           - system
         risk_score: 50
       macros:
-        - system32_executables
+        - is_windows_system_file
       lookups:
-        - system32_executables
+        - is_windows_system_file
       schedule:
         cron_schedule: 0 * * * *
         earliest_time: -70m@m
@@ -39,14 +39,14 @@ detect:
       search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as
         lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*"
         Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.user Processes.dest
-        Processes.process_name Processes.process_path Processes.process_id | `drop_dm_object_name("Processes")`
+        Processes.process_name Processes.process_id Processes.process_path Processes.parent_process_name Processes.process_hash| `drop_dm_object_name("Processes")`
         | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file`'
       suppress:
         suppress_fields: dest,process_name
         suppress_period: 86400s
 eli5: This search returns all the processes that are not executing out of the C:\Windows\System32
   or C:\Windows\SysWOW64 directories. Next, it takes the filename and looks it up
-  in a table of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64
+  in a table `is_windows_system_file` of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64
   directory. Any matches are then returned.
 entities:
   - dest
@@ -98,7 +98,7 @@ mappings:
   nist:
     - PR.PT
     - DE.CM
-modification_date: '2020-01-21'
+modification_date: '2020-02-04'
 name: System Processes Run From Unexpected Locations
 original_authors:
   - company: Splunk
@@ -108,4 +108,4 @@ references: []
 security_domain: endpoint
 spec_version: 2
 type: splunk
-version: '4.0'
+version: '5.0'
diff --git a/lookups/system32_executables.csv b/lookups/is_windows_system_file.csv
similarity index 100%
rename from lookups/system32_executables.csv
rename to lookups/is_windows_system_file.csv
diff --git a/lookups/system32_executables.yml b/lookups/is_windows_system_file.yml
similarity index 59%
rename from lookups/system32_executables.yml
rename to lookups/is_windows_system_file.yml
index acdc769149..413e326626 100644
--- a/lookups/system32_executables.yml
+++ b/lookups/is_windows_system_file.yml
@@ -1,5 +1,5 @@
 default_match: 'false'
 description: A list of executable files in Windows\System32
-filename: system32_executables.csv
+filename: is_windows_system_file.csv
 min_matches: 1
-name: system32_executables
+name: is_windows_system_file
diff --git a/macros/is_windows_system_file.yml b/macros/is_windows_system_file.yml
index 30c4bdec8f..8d9f30d68f 100644
--- a/macros/is_windows_system_file.yml
+++ b/macros/is_windows_system_file.yml
@@ -1,5 +1,5 @@
-definition: lookup update=true system32_executables filename as process_name
+definition: lookup update=true is_windows_system_file filename as process_name
   OUTPUT systemFile | search systemFile=true
 description: This macro limits the output to process names that are in the Windows
   System directory
-name: system32_executables
+name: is_windows_system_file
diff --git a/package/appserver/static/analytic_story_details.css b/package/appserver/static/analytic_story_details.css
index f42035edd4..ce54b7882b 100644
--- a/package/appserver/static/analytic_story_details.css
+++ b/package/appserver/static/analytic_story_details.css
@@ -169,6 +169,7 @@ h3 {
 
 .kill_chain_tag {
 	background-color: #ed8440;
+	color: #303841;
 }
 
 .attack_tag {
diff --git a/package/default/analytic_stories.conf b/package/default/analytic_stories.conf
index 3159b59ea4..b10126c3a4 100644
--- a/package/default/analytic_stories.conf
+++ b/package/default/analytic_stories.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2020-01-23T21:55:09 UTC
+# On Date: 2020-02-04T17:15:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -691,9 +691,9 @@ narrative = A traditional security best practice is to control the ports, protoc
 [Ransomware]
 category =  Malware
 creation_date = 2017-07-24
-modification_date = 2017-09-10
+modification_date = 2020-02-04
 id = cf309d0d-d4aa-4fbb-963d-1e79febd3756
-version = 1.0
+version = 1.1
 reference = ["https://www.symantec.com/connect/blogs/what-you-need-know-about-wannacry-ransomware", "https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
 detection_searches = ["ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Windows Event Log Cleared - Rule"]
 mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["AppInit DLLs", "Authentication Package", "Command and Control", "Commonly Used Port", "Defense Evasion", "Execution", "Exfiltration", "Exfiltration Over Alternative Protocol", "Indicator Removal on Host", "Lateral Movement", "Masquerading", "Persistence", "Registry Run Keys / Start Folder", "Scheduled Task", "Windows Management Instrumentation"], "mitre_technique_id": [], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
@@ -891,9 +891,9 @@ The searches in this Analytic Story will monitor your AWS network traffic for ev
 [Suspicious Command-Line Executions]
 category =  Adversary Tactics
 creation_date = 2017-10-09
-modification_date = 2017-10-23
+modification_date = 2020-02-04
 id = f4368ddf-d59f-4192-84f6-778ac5a3ffc7
-version = 2.0
+version = 2.1
 reference = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"]
 detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd.exe - Rule", "ESCU - Detect Use of cmd.exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["Command-Line Interface", "Defense Evasion", "Execution", "Masquerading", "Persistence", "Scripting"], "mitre_technique_id": [], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
@@ -1014,9 +1014,9 @@ narrative = A common attack technique is to infiltrate a cloud instance and make
 [Unusual Processes]
 category =  Malware
 creation_date = 2016-08-09
-modification_date = 2018-11-20
+modification_date = 2020-02-04
 id = f4368e3f-d59f-4192-84f6-748ac5a3ddb6
-version = 2.0
+version = 2.1
 reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
 detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
 mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["Accessibility Features", "Defense Evasion", "Execution", "Masquerading", "Rundll32"], "mitre_technique_id": [], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]}
diff --git a/package/default/macros.conf b/package/default/macros.conf
index 15ab74292f..afb08f196a 100644
--- a/package/default/macros.conf
+++ b/package/default/macros.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2020-01-23T21:55:09 UTC
+# On Date: 2020-02-04T17:15:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -126,6 +126,10 @@ description = This limits the query fields to domains that are associated with e
 definition = lookup update=true lookup_rare_process_whitelist_default process as process OUTPUTNEW whitelist | where whitelist="false" | lookup update=true lookup_rare_process_whitelist_local process as process OUTPUT whitelist | where whitelist="false"
 description = This macro is intended to whitelist processes that have been definied as rare
 
+[is_windows_system_file]
+definition = lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true
+description = This macro limits the output to process names that are in the Windows System directory
+
 [malicious_powershell_process_obfuscation_techniques_output_filter]
 definition = search *
 description = Use this macro to add output filters for Malicious PowerShell Process With Obfuscation Techniques.
@@ -223,10 +227,6 @@ description = This macro limites the output to file names that have been marked
 definition = sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
 description = customer specific splunk configurations(eg- index, source, sourcetype) for Windows Sysmon Logs. Replace the macro definition with configurations for your Splunk Environmnent.
 
-[system32_executables]
-definition = lookup update=true system32_executables filename as process_name OUTPUT systemFile | search systemFile=true
-description = This macro limits the output to process names that are in the Windows System directory
-
 [system_network_configuration_discovery_tools]
 definition = (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe" OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe" OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name= "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name= "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name= "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name= "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name= "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe")
 description = This macro is a list of process that can be used to discover the network configuration
diff --git a/package/default/savedsearches.conf b/package/default/savedsearches.conf
index 333c5cd6f0..7f952a429a 100644
--- a/package/default/savedsearches.conf
+++ b/package/default/savedsearches.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2020-01-23T21:55:09 UTC
+# On Date: 2020-02-04T17:15:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -721,7 +721,7 @@ quantity = 0
 realtime_schedule = 0
 schedule_window = auto
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter` 
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`
 
 [ESCU - Attempt To Stop Security Service - Rule]
 action.escu = 0
@@ -8223,11 +8223,11 @@ action.escu.enabled = 1
 description = This search looks for system processes that normally run out of C:\Windows\System32\ or C:\Windows\SysWOW64 that are not run from that location.  This can indicate a malicious process that is trying to hide as a legitimate process.
 action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["Defense Evasion", "Masquerading"], "nist": ["PR.PT", "DE.CM"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This search returns all the processes that are not executing out of the C:\Windows\System32 or C:\Windows\SysWOW64 directories. Next, it takes the filename and looks it up in a table of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64 directory. Any matches are then returned.
+action.escu.eli5 = This search returns all the processes that are not executing out of the C:\Windows\System32 or C:\Windows\SysWOW64 directories. Next, it takes the filename and looks it up in a table `is_windows_system_file` of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64 directory. Any matches are then returned.
 action.escu.how_to_implement = To successfully implement this search you need to ingest details about process execution from your hosts. Specifically, this search requires the process name and the full path to the process executable.
 action.escu.known_false_positives = None identified
 action.escu.creation_date = 2016-08-24
-action.escu.modification_date = 2020-01-21
+action.escu.modification_date = 2020-02-04
 action.escu.confidence = medium
 action.escu.full_search_name = ESCU - System Processes Run From Unexpected Locations - Rule
 action.escu.search_type = detection
@@ -8266,7 +8266,7 @@ quantity = 0
 realtime_schedule = 0
 schedule_window = auto
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*" Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.user Processes.dest Processes.process_name Processes.process_path Processes.process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*" Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.user Processes.dest Processes.process_name Processes.process_id Processes.process_path Processes.parent_process_name Processes.process_hash| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file`
 
 [ESCU - TOR Traffic - Rule]
 action.escu = 0
diff --git a/package/default/transforms.conf b/package/default/transforms.conf
index bff025196d..4baf89ad08 100644
--- a/package/default/transforms.conf
+++ b/package/default/transforms.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2020-01-23T21:55:09 UTC
+# On Date: 2020-02-04T17:15:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -60,6 +60,12 @@ filename = suspicious_email_attachments.csv
 # description = A list of suspicious extensions for email attachments
 match_type = WILDCARD(file_name)
 
+[is_windows_system_file]
+filename = is_windows_system_file.csv
+default_match = false
+# description = A list of executable files in Windows\System32
+min_matches = 1
+
 [legit_domains]
 filename = legit_domains.csv
 # description = A list of legit domains to be used to whitelist possible phishing sites
@@ -194,9 +200,3 @@ default_match = false
 match_type = WILDCARD(file)
 min_matches = 1
 
-[system32_executables]
-filename = system32_executables.csv
-default_match = false
-# description = A list of executable files in Windows\System32
-min_matches = 1
-
diff --git a/package/default/use_case_library.conf b/package/default/use_case_library.conf
index 5aaa34f6ed..d4030d72a5 100644
--- a/package/default/use_case_library.conf
+++ b/package/default/use_case_library.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2020-01-23T21:55:09 UTC
+# On Date: 2020-02-04T17:15:12 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -515,8 +515,8 @@ narrative = A traditional security best practice is to control the ports, protoc
 
 [analytic_story://Ransomware]
 category = Malware
-last_updated = 2017-09-10
-version = 1.0
+last_updated = 2020-02-04
+version = 1.1
 references = ["https://www.symantec.com/connect/blogs/what-you-need-know-about-wannacry-ransomware", "https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 2
@@ -660,8 +660,8 @@ The searches in this Analytic Story will monitor your AWS network traffic for ev
 
 [analytic_story://Suspicious Command-Line Executions]
 category = Adversary Tactics
-last_updated = 2017-10-23
-version = 2.0
+last_updated = 2020-02-04
+version = 2.1
 references = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 2
@@ -748,8 +748,8 @@ narrative = A common attack technique is to infiltrate a cloud instance and make
 
 [analytic_story://Unusual Processes]
 category = Malware
-last_updated = 2018-11-20
-version = 2.0
+last_updated = 2020-02-04
+version = 2.1
 references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 2
@@ -2585,7 +2585,7 @@ providing_technologies = ["Sysmon"]
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This search returns all the processes that are not executing out of the C:\Windows\System32 or C:\Windows\SysWOW64 directories. Next, it takes the filename and looks it up in a table of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64 directory. Any matches are then returned.
+explanation = This search returns all the processes that are not executing out of the C:\Windows\System32 or C:\Windows\SysWOW64 directories. Next, it takes the filename and looks it up in a table `is_windows_system_file` of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64 directory. Any matches are then returned.
 how_to_implement = To successfully implement this search you need to ingest details about process execution from your hosts. Specifically, this search requires the process name and the full path to the process executable.
 annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["Defense Evasion", "Masquerading"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = None identified
diff --git a/package/lookups/system32_executables.csv b/package/lookups/is_windows_system_file.csv
similarity index 100%
rename from package/lookups/system32_executables.csv
rename to package/lookups/is_windows_system_file.csv
diff --git a/stories/ransomware.yml b/stories/ransomware.yml
index 90e7218458..ee97ca6138 100644
--- a/stories/ransomware.yml
+++ b/stories/ransomware.yml
@@ -66,7 +66,7 @@ maintainers:
   - company: Splunk
     email: davidd@splunk.com
     name: David Dorsey
-modification_date: '2017-09-10'
+modification_date: '2020-02-04'
 name: Ransomware
 narrative: Ransomware is an ever-present risk to the enterprise, wherein an infected
   host encrypts business-critical data, holding it hostage until the victim pays the
@@ -87,4 +87,4 @@ references:
   - https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html
 spec_version: 2
 usecase: Advanced Threat Detection
-version: '1.0'
+version: '1.1'
diff --git a/stories/suspicious_cmd_line_executions.yml b/stories/suspicious_cmd_line_executions.yml
index c1834af62a..55e0e00103 100644
--- a/stories/suspicious_cmd_line_executions.yml
+++ b/stories/suspicious_cmd_line_executions.yml
@@ -30,7 +30,7 @@ maintainers:
   - company: Splunk
     email: bpatel@splunk.com
     name: Bhavin Patel
-modification_date: '2017-10-23'
+modification_date: '2020-02-04'
 name: Suspicious Command-Line Executions
 narrative: The ability to execute arbitrary commands via the Windows CLI is a primary
   goal for the adversary. With access to the shell, an attacker can easily run scripts
@@ -51,4 +51,4 @@ references:
   - https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
 spec_version: 2
 usecase: Advanced Threat Detection
-version: '2.0'
+version: '2.1'
diff --git a/stories/unusual_processes.yml b/stories/unusual_processes.yml
index d78141aad3..e845c8d852 100644
--- a/stories/unusual_processes.yml
+++ b/stories/unusual_processes.yml
@@ -33,7 +33,7 @@ maintainers:
   - company: Splunk
     email: bpatel@splunk.com
     name: Bhavin Patel
-modification_date: '2018-11-20'
+modification_date: '2020-02-04'
 name: Unusual Processes
 narrative: 'Being able to profile a host''s processes within your environment can
   help you more quickly identify processes that seem out of place when compared to
@@ -58,4 +58,4 @@ references:
   - https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262
 spec_version: 2
 usecase: Advanced Threat Detection
-version: '2.0'
+version: '2.1'