diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
similarity index 55%
rename from detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
index ce57b526e6..69518c020c 100644
--- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
+++ b/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
@@ -1,30 +1,35 @@
 name: Applying Stolen Credentials via Mimikatz modules
 id: 759a653f-cb92-40f9-94c9-ec4e47b0f709
-version: 1
-date: '2020-11-03'
+version: 2
+date: '2021-11-24'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token
-  attack, Golden or Silver kerberos ticket attack, and Skeleton key attack.
+  - Endpoint_Processes
+description: 'The following analytic identifites the use of Mimikatz modules attempting to perform Pass-the-Ticket, Golden or Silver Kerberos ticket attacks and Skeleton Key attack. This behavior is typically performed within interactive Mimikatz memory space, however it may be identified on the command-line.
+  A Pass-the-Ticket (ptt) attack is performed once an adversary has established access to a single endpoint and retrieved the kerberos ticket to now begin moving laterally using this method. Typically, it blends in with logon activity as the ticket can be copied to another system and passed into the current session effectively simulating a logon without any communication with the Domain Controller.
+  A Golden or Silver ticket attack requires some setup by the adversary, but once performed it will simulate lateral based authentication to additional endpoints.'
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
   cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line,
   /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true
   OR match_regex(cmd_line, /(?i)misc::skeleton/)=true )
-
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
   | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting logs
+  with the process name, parent process, and command-line executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to Mimikatz.
 references:
-- https://github.com/gentilkiwi/mimikatz
-- https://adsecurity.org/?p=1275
+  - https://github.com/gentilkiwi/mimikatz
+  - https://adsecurity.org/?p=1275
+  - https://adsecurity.org/?p=1515
+  - https://adsecurity.org/?page_id=1821#KERBEROSPTT
+  - https://attack.mitre.org/software/S0002/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1550.002/T1550.002.md#atomic-test-1---mimikatz-pass-the-hash
 tags:
   analytic_story:
   - Credential Dumping
@@ -58,6 +63,10 @@ tags:
   - T1554
   - T1556
   - T1558
+  - T1558.002
+  - T1558.001
+  - T1003
+  - T1003.001
   nist:
   - PR.AC
   - PR.IP
@@ -81,6 +90,7 @@ tags:
   - dest_user_id
   - process
   - _time
+  - cmd_line
   risk_score: 90
   risk_severity: high
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml
similarity index 64%
rename from detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
rename to detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml
index c52f46a113..1023e7c74c 100644
--- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
+++ b/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml
@@ -1,15 +1,13 @@
 name: Applying Stolen Credentials via PowerSploit modules
 id: 270b482d-2af2-448f-9923-9cf005f61be4
-version: 1
-date: '2020-11-03'
+version: 2
+date: '2021-11-24'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Stolen credentials are applied by methods such as user impersonation,
-  credential injection, spoofing of authentication processes or getting hold of critical
-  accounts. This detection indicates such activities carried out by PowerSploit exploit
-  kit APIs.
+  - Endpoint_Processes
+description: 'The following analytic identifies commonly used PowerSploit modules that perform credential access, spoofing of authentication processes, user impersonation and attempting to manipulate tokens. Specifically, the following modules `Invoke-CredentialInjection`, `Invoke-TokenManipulation`, `Invoke-UserImpersonation`, `Get-System`, and `Invoke-RevertToSelf` were identfiied as modules used to access credentials.
+  PowerSploit is an archived project on GitHub, but much of its modules and scripts are still utilized today by adversaries. This behavior is typically performed within interactive PowerShell sessions or injected into processes, however it may be identified on the command-line.'
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -24,11 +22,13 @@ search: '| from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
   | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting logs
+  with the process name, parent process, and command-line executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to PowerSploit.
 references:
-- https://github.com/PowerShellMafia/PowerSploit
+  - https://github.com/PowerShellMafia/PowerSploit
+  - https://attack.mitre.org/software/S0194/
 tags:
   analytic_story:
   - Credential Dumping
@@ -62,6 +62,7 @@ tags:
   - T1554
   - T1555
   - T1558
+  - T1059.001
   nist:
   - PR.AC
   - PR.IP
@@ -85,6 +86,7 @@ tags:
   - dest_user_id
   - process
   - _time
+  - cmd_line
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml
similarity index 68%
rename from detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
rename to detections/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml
index 77ce2b1fb7..7db363f5db 100644
--- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
+++ b/detections/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml
@@ -1,13 +1,12 @@
 name: Assessment of Credential Strength via DSInternals modules
 id: 5526d3a4-2497-4e8d-9d3c-7a34c9aace2f
-version: 1
-date: '2020-11-03'
+version: 2
+date: '2021-11-24'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: This detection identifies use of DSInternals modules that verify password
-  strength, i.e., identify weak accounts that would be easily compromised.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of a DSInternals module, `Test-PasswordQuality`, that verifies password strength. Adversaries have utilized this module to determine password complexity or to identify accounts with weak passwords.'
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -19,11 +18,13 @@ search: '| from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
   | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting logs
+  with the process name, parent process, and command-line executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to DSInternals.
 references:
-- https://github.com/MichaelGrafnetter/DSInternals
+  - https://github.com/MichaelGrafnetter/DSInternals
+  - https://attack.mitre.org/techniques/T1059/001/
 tags:
   analytic_story:
   - Credential Dumping
@@ -49,6 +50,8 @@ tags:
   - T1201
   - T1552
   - T1555
+  - T1059.001
+  - T1059
   nist:
   - PR.AC
   - PR.IP
@@ -72,6 +75,7 @@ tags:
   - process
   - dest_device_id
   - dest_user_id
+  - cmd_line
   risk_score: 25
   risk_severity: high
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/deprecated/ssa___credential_extraction_dsinternals_conversion_modules.yml
similarity index 66%
rename from detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml
rename to detections/deprecated/ssa___credential_extraction_dsinternals_conversion_modules.yml
index f3c7b0941e..346e9ec039 100644
--- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml
+++ b/detections/deprecated/ssa___credential_extraction_dsinternals_conversion_modules.yml
@@ -1,16 +1,14 @@
 name: Credential Extraction indicative of use of DSInternals credential conversion
   modules
 id: 73e23834-c7ad-4860-bfd0-7d8ffe6527c2
-version: 1
-date: '2020-10-21'
+version: 2
+date: '2021-11-29'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Credential extraction is often an illegal recovery of credential material
-  from secured authentication resources and repositories. This process may also involve
-  decryption or other transformations of the stored credential material. DSInternals
-  is a collection of PowerShell modules commonly employed in exploits.
+  - Endpoint_Processes
+description: 'The following analytic identifies modules within DSInternals that are used for extracting credentials from Active Directory. Modules include `ConvertFrom-ADManagedPasswordBlob`, `ConvertFrom-GPPrefPassword`, `ConvertFrom-UnicodePasswor`, `ConvertTo-GPPrefPassword`,`ConvertTo-KerberosKey`, `ConvertTo-LMHash`, `ConvertTo-NTHash` `ConvertTo-OrgIdHash` or `ConvertTo-UnicodePassword`.
+  Adversaries may use these modules for decrypting or transforming the stored credentials.' 
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -30,11 +28,14 @@ search: '| from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to DSInternals.
 references:
-- https://github.com/MichaelGrafnetter/DSInternals
+  - https://github.com/MichaelGrafnetter/DSInternals
+  - https://attack.mitre.org/techniques/T1059/001/
 tags:
   analytic_story:
   - Credential Dumping
@@ -53,10 +54,12 @@ tags:
   kill_chain_phases:
   - Actions on Objectives
   message: DSInternals tool kit is converting stolen credential material to a form
-    applicable to authentications. Operation is performed at the device $dest_device_id$,
-    by the account $dest_user_id$ via command $cmd_line$
+    applicable to authentications. Operation is performed on the device $dest_device_id$,
+    by the account $dest_user_id$ via process $process_name$.
   mitre_attack_id:
   - T1003
+  - T1003.002
+  - T1059.001
   nist:
   - PR.AC
   - PR.IP
@@ -69,10 +72,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -82,7 +85,7 @@ tags:
   - _time
   - process_path
   - dest_user_id
-  - process
+  - cmd_line
   risk_score: 70
   risk_severity: high
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/deprecated/ssa___credential_extraction_dsinternals_modules.yml
similarity index 76%
rename from detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml
rename to detections/deprecated/ssa___credential_extraction_dsinternals_modules.yml
index ad2a5a161b..0b9a3c4b74 100644
--- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml
+++ b/detections/deprecated/ssa___credential_extraction_dsinternals_modules.yml
@@ -1,15 +1,13 @@
 name: Credential Extraction indicative of use of DSInternals modules
 id: 5d2172f0-8a7d-4ecd-aad9-2dcc95699e0d
-version: 1
-date: '2020-10-21'
+version: 2
+date: '2021-11-29'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel:
-- Endpoint_Processes
-description: Credential extraction is often an illegal recovery of credential material
-  from secured authentication resources and repositories. This process may also involve
-  decryption or other transformations of the stored credential material. DSInternals
-  is a collection of PowerShell modules commonly employed in exploits.
+datamodel: 
+  - Endpoint_Processes
+description: 'The following analytic identifies modules of DSInternals being used on the associated endpoint.
+  Adversaries may use these modules for manipulating data related to Active Directory and credentials.' 
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -31,11 +29,14 @@ search: '| from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to DSInternals.
 references:
-- https://github.com/MichaelGrafnetter/DSInternals
+  - https://github.com/MichaelGrafnetter/DSInternals
+  - https://attack.mitre.org/techniques/T1059/001/
 tags:
   analytic_story:
   - Credential Dumping
@@ -56,9 +57,11 @@ tags:
   message: DSInternals tool kit is accessing sensitive credential material such as
     KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation.
     Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
-    via command $cmd_line$
+    via process $process_name$
   mitre_attack_id:
   - T1003
+  - T1003.002
+  - T1059.001
   nist:
   - PR.AC
   - PR.IP
@@ -71,10 +74,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: Process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -85,6 +88,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 70
   risk_severity: high
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_s_option.yml
similarity index 69%
rename from detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml
rename to detections/deprecated/ssa___credential_extraction_fgdump_cachedump_s_option.yml
index 100e2c60f0..d31701b203 100644
--- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml
+++ b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_s_option.yml
@@ -1,17 +1,13 @@
 name: Credential Extraction indicative of FGDump and CacheDump with s option
 id: 312582f2-5e91-42c1-a275-cd67f31373c8
-version: 1
-date: '2020-10-18'
+version: 2
+date: '2021-11-29'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Credential extraction is often an illegal recovery of credential material
-  from secured authentication resources and repositories. This process may also involve
-  decryption or other transformations of the stored credential material. FGdump is
-  a newer version of pwdump tool that extracts NTLM and LanMan password hashes from
-  Windows. Cachedump is a publicly-available tool that extracts cached password hashes
-  from a system's registry.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of CacheDump with the `-s` parameter to dump cached credentials on the associated endpoint. Adversaries use Cachedump as it is a publicly-available tool that extracts cached password hashes
+  from a system''s registry.'
 search: ' | from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -28,10 +24,16 @@ search: ' | from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
-references: []
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: False positives will be limited as this analytic targets specific credential dumping process names. Filter as needed.
+references:
+  - https://attack.mitre.org/software/S0119/
+  - https://en.kali.tools/all/?tool=182
+  - http://foofus.net/goons/fizzgig/fgdump/
+  - https://attack.mitre.org/software/S0120/
 tags:
   analytic_story:
   - Unusual Processes
@@ -51,9 +53,10 @@ tags:
   - Actions on Objectives
   message: Malicious actor is accessing stored credentials via FGDump or CacheDump
     tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
-    via command $cmd_line$
+    via process $process_name$.
   mitre_attack_id:
   - T1003
+  - T1003.002
   nist:
   - PR.AC
   - PR.IP
@@ -66,10 +69,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: Process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -80,6 +83,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 70
   risk_severity: high
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_v_option.yml
similarity index 67%
rename from detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml
rename to detections/deprecated/ssa___credential_extraction_fgdump_cachedump_v_option.yml
index c636e1241d..ec6113cf84 100644
--- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml
+++ b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_v_option.yml
@@ -1,17 +1,13 @@
 name: Credential Extraction indicative of FGDump and CacheDump with v option
 id: 3c40b0ef-a03f-460a-9484-e4b9117cbb38
-version: 1
-date: '2020-10-18'
+version: 2
+date: '2021-11-29'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Credential extraction is often an illegal recovery of credential material
-  from secured authentication resources and repositories. This process may also involve
-  decryption or other transformations of the stored credential material. FGdump is
-  a newer version of pwdump tool that extracts NTLM and LanMan password hashes from
-  Windows. Cachedump is a publicly-available tool that extracts cached password hashes
-  from a system's registry.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of CacheDump with the `-v` parameter to dump cached credentials on the associated endpoint. Adversaries use Cachedump as it is a publicly-available tool that extracts cached password hashes
+  from a system''s registry.'
 search: ' | from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -26,9 +22,16 @@ search: ' | from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: False positives will be limited as this analytic targets specific credential dumping process names. Filter as needed.
+references:
+  - https://attack.mitre.org/software/S0119/
+  - https://en.kali.tools/all/?tool=182
+  - http://foofus.net/goons/fizzgig/fgdump/
+  - https://attack.mitre.org/software/S0120/
 references: []
 tags:
   analytic_story:
@@ -49,9 +52,10 @@ tags:
   - Actions on Objectives
   message: Malicious actor is accessing stored credentials via FGDump or CacheDump
     tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
-    via command $cmd_line$
+    via process $process_name$
   mitre_attack_id:
   - T1003
+  - T1003.002
   nist:
   - PR.AC
   - PR.IP
@@ -64,10 +68,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: Process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -77,6 +81,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 63
   risk_severity: high
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/deprecated/ssa___credential_extraction_getaddbaccount_from_dump.yml
similarity index 100%
rename from detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml
rename to detections/deprecated/ssa___credential_extraction_getaddbaccount_from_dump.yml
diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/deprecated/ssa___credential_extraction_lazagne_command_options.yml
similarity index 100%
rename from detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml
rename to detections/deprecated/ssa___credential_extraction_lazagne_command_options.yml
diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/deprecated/ssa___credential_extraction_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml
rename to detections/deprecated/ssa___credential_extraction_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/deprecated/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
similarity index 100%
rename from detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
rename to detections/deprecated/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/deprecated/ssa___credential_extraction_ms_debuggers_z_option.yml
similarity index 100%
rename from detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml
rename to detections/deprecated/ssa___credential_extraction_ms_debuggers_z_option.yml
diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/deprecated/ssa___credential_extraction_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___credential_extraction_powersploit_modules.yml
rename to detections/deprecated/ssa___credential_extraction_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_access_user_content_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml
rename to detections/deprecated/ssa___illegal_access_user_content_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_account_creation_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
rename to detections/deprecated/ssa___illegal_account_creation_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/deprecated/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
rename to detections/deprecated/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/deprecated/ssa___illegal_log_deletion_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___illegal_log_deletion_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/deprecated/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
rename to detections/deprecated/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
rename to detections/deprecated/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
rename to detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/deprecated/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
rename to detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/deprecated/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
rename to detections/deprecated/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_and_use_computers_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___recon_and_use_computers_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_and_use_shares_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___recon_and_use_shares_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_shares_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_and_use_shares_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_connectivity_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_connectivity_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_defensive_tools_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_defensive_tools_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_processes_and_services_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___recon_processes_and_services_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/deprecated/ssa___setting_credentials_via_dsinternals_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
rename to detections/deprecated/ssa___setting_credentials_via_dsinternals_modules.yml
diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/deprecated/ssa___setting_credentials_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___setting_credentials_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/deprecated/ssa___setting_credentials_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml
rename to detections/deprecated/ssa___setting_credentials_via_powersploit_modules.yml
diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/endpoint/net_localgroup_discovery.yml
index be87f8b84f..ea47f2e0e7 100644
--- a/detections/endpoint/net_localgroup_discovery.yml
+++ b/detections/endpoint/net_localgroup_discovery.yml
@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Windows Discovery Techniques
   automated_detection_testing: passed
   confidence: 50
   context:
diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml
index 02b3713ccb..b796491f7b 100644
--- a/detections/endpoint/ssa___attempt_to_delete_services.yml
+++ b/detections/endpoint/ssa___attempt_to_delete_services.yml
@@ -1,16 +1,13 @@
 name: Attempt To Delete Services
 id: a0c8c292-d01a-11eb-aa18-acde48001122
 version: 3
-date: '2021-11-30'
+date: '2021-11-24'
 author: Teoderick Contreras, splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: The following analytic identifies Windows Service Control, `sc.exe`,
-  attempting to delete a service. This is typically identified in parallel with other
-  instances of service enumeration of attempts to stop a service and then delete it.
-  Adversaries utilize this technique to terminate security services or other related
-  services to continue there objective and evade detections.
+  - Endpoint_Processes
+description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue
+  there objective and evade detections.'
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -26,11 +23,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
-known_false_positives: It is possible administrative scripts may start/stop/delete
-  services. Filter as needed.
+  Sysmon TA. 
+known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed.
 references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+  - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md
 tags:
   analytic_story:
   - XMRig
@@ -52,6 +49,8 @@ tags:
     on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service.
   mitre_attack_id:
   - T1489
+  - T1543
+  - T1543.003
   nist:
   - PR.DS
   - PR.IP
@@ -85,4 +84,4 @@ tags:
   - cmd_line
   risk_score: 36
   risk_severity: high
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml
index ece73aba06..313f4d4564 100644
--- a/detections/endpoint/ssa___attempt_to_disable_services.yml
+++ b/detections/endpoint/ssa___attempt_to_disable_services.yml
@@ -1,16 +1,13 @@
 name: Attempt To Disable Services
 id: afb31de4-d023-11eb-98d5-acde48001122
 version: 3
-date: '2021-11-30'
+date: '2021-11-24'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: The following analytic identifies Windows Service Control, `sc.exe`,
-  attempting to disable a service. This is typically identified in parallel with other
-  instances of service enumeration of attempts to stop a service and then disable
-  it. Adversaries utilize this technique to terminate security services or other related
-  services to continue there objective and evade detections.
+  - Endpoint_Processes
+description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to disable a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then disable it. Adversaries utilize this technique to terminate security services or other related services to continue
+  there objective and evade detections.'
 search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event,
   "_datamodels"), "collection<string>", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
@@ -27,13 +24,12 @@ search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(inpu
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
-known_false_positives: It is possible administrative scripts may start/stop/delete
-  services. Filter as needed.
+  Sysmon TA. 
+known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed.
 references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
-- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
+  - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+  - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
 tags:
   analytic_story:
   - XMRig
@@ -87,4 +83,4 @@ tags:
   - process
   risk_score: 36
   risk_severity: medium
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
index fb81931e78..ed66d0cca6 100644
--- a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -1,13 +1,12 @@
 name: Attempted Credential Dump From Registry via Reg exe
 id: 14038953-e5f2-4daf-acff-5452062baf03
-version: 1
-date: 2020-6-04
+version: 2
+date: '2021-11-29'
 author: Jose Hernandez, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Monitor for execution of reg.exe with parameters specifying an export
-  of keys that contain hashed credentials that attackers may try to crack offline.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of `reg.exe` attempting to export Windows registry keys that contain hashed credentials. Adversaries will utilize this technique to capture and perform offline password cracking.'
 search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event,
   "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"),
@@ -22,11 +21,14 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma
   = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id),
   body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
   | into write_ssa_detected_events(); '
-how_to_implement: You must be ingesting windows endpoint data that tracks process
-  activity, including parent-child relationships from your endpoints.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
 known_false_positives: None identified.
 references:
-- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
+  - https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
 tags:
   analytic_story:
   - Credential Dumping
@@ -43,11 +45,10 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: Malicious actor is dumping stored credentials from the registry sections
-    SAM, Security, or System. Operation is performed at the device $dest_device_id$,
-    by the account $dest_user_id$ via command $cmd_line$
+  message: An attempt to save registry keys storing credentials has been performed on $dest_device_id$ by $dest_user_id$ via process $process_name$.
   mitre_attack_id:
   - T1003
+  - T1003.002
   nist:
   - DE.CM
   observable:
@@ -59,10 +60,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -71,6 +72,7 @@ tags:
   - dest_device_id
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 63
   risk_severity: low
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml b/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml
new file mode 100644
index 0000000000..7b19775d61
--- /dev/null
+++ b/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml
@@ -0,0 +1,84 @@
+name: BCDEdit Failure Recovery Modification
+id: 76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This search looks for flags passed to bcdedit.exe modifications to the
+  built-in Windows error recovery boot configurations. This is typically used by ransomware
+  to prevent recovery.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bcdedit.exe" AND
+  (like (cmd_line, "%recoveryenabled%") AND like (cmd_line, "%no%"))
+  | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: Administrators may modify the boot configuration.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
+tags:
+  analytic_story:
+  - Ryuk Ransomware
+  - Ransomware
+  cis20:
+  - CIS 8
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Impact
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+  impact: 100
+  kill_chain_phases:
+  - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting disable the ability to recover the
+    endpoint.
+  mitre_attack_id:
+  - T1490
+  nist:
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml
index 0d8c7562fe..04281188df 100644
--- a/detections/endpoint/ssa___delete_a_net_user.yml
+++ b/detections/endpoint/ssa___delete_a_net_user.yml
@@ -5,7 +5,7 @@ date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint_Processes
+  - Endpoint_Processes
 description: This analytic will detect a suspicious net.exe/net1.exe command-line
   to delete a user on a system. This technique may be use by an administrator for
   legitimate purposes, however this behavior has been used in the wild to impair some
@@ -18,14 +18,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND like(cmd_line, "%user%")
-  AND (process_name="net1.exe" OR process_name="net.exe") | eval start_time=timestamp,
-  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
-  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
-  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
-  "parent_process_name", parent_process_name, "process_path", process_path]) | into
-  write_ssa_detected_events();'
-how_to_implement: o successfully implement this search, you need to be ingesting logs
+  cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
+  OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting logs
   with the process name, parent process, and command-line executions from your endpoints.
   If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
   Tune and filter known instances where renamed net.exe may be used.
diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
index 99f240479b..2ffee7990f 100644
--- a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
+++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
@@ -1,15 +1,12 @@
 name: Deny Permission using Cacls Utility
 id: b76eae28-cd25-11eb-9c92-acde48001122
-version: 2
-date: '2021-06-14'
+version: 3
+date: '2021-11-29'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: This analytic identifies a potential adversary that changes the security
-  permission of a specific file or directory. This technique is commonly seen in APT
-  tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection
-  and prevent access to their component files.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of `cacls.exe`, `icacls.exe` or `xcacls.exe` placing the deny permission on a file or directory. Adversaries perform this behavior to prevent responders from reviewing or gaining access to adversary files on disk.' 
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
   null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
@@ -26,8 +23,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
-known_false_positives: network administrator may use this windows utility but this
-  is not a common practice.
+known_false_positives: System administrators may use cacls utilities but this
+  is not a common practice. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
@@ -71,6 +68,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
index 51de8d3da3..e2bf1d6826 100644
--- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
@@ -1,29 +1,29 @@
 name: Detect Dump LSASS Memory using comsvcs
 id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
 version: 2
-date: '2020-09-15'
+date: '2021-11-29'
 author: Jose Hernandez, Splunk
 type: TTP
-datamodel:
-- Endpoint_Processes
-description: This search detects the memory of lsass.exe being dumped for offline
-  credential theft attack.
-search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
-  | eval dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
-  process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)),
-  timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process=lower(ucast(map_get(input_event,
-  "process"), "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string",
-  null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
-  | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id)
-  | eval body=create_map(["event_id", event_id, "process_name", process_name, "process",
-  process]) | into write_ssa_detected_events();'
+datamodel: 
+  - Endpoint_Processes
+description: 'The following analytic identifies credential dumping using comsvcs.dll with `regsvr32.exe`. This technique is common with adversaries who would like to dump the memory of lsass.exe and perform offline password cracking.'
+search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event,
+  "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
+  "string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
+  null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process,
+  /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time =
+  timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id,
+  "process_name", process_name, "process", process]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including Windows command line logging. You can see how we test this with [Event
   Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)
   on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml).
-known_false_positives: None identified.
+known_false_positives: False positives should be limited, filter as needed.
 references:
-- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+  - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll
 tags:
   analytic_story:
   - Credential Dumping
@@ -41,9 +41,7 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: Malicious actor is dumping encoded credentials via Microsoft's native comsvc
-    DLL. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
-    via command $cmd_line$
+  message: A dump of lsass.exe was attempted using comsvcs.dll on endpoint $dest_device_id$ by user $dest_device_user$.
   mitre_attack_id:
   - T1003.003
   - T1003
@@ -58,10 +56,6 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
-    role:
-    - Others
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -72,4 +66,4 @@ tags:
   - process
   risk_score: 70
   risk_severity: low
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml
new file mode 100644
index 0000000000..f88b4a2fb7
--- /dev/null
+++ b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml
@@ -0,0 +1,90 @@
+name: Detect RClone Command-Line Usage
+id: e8b74268-5454-11ec-a799-acde48001122
+version: 1
+date: '2021-12-03'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This analytic identifies commonly used command-line arguments used by
+  `rclone.exe` to initiate a file transfer. Some arguments were negated as they are
+  specific to the configuration used by adversaries. In particular, an adversary may
+  list the files or directories of the remote file share using `ls` or `lsd`, which
+  is not indicative of malicious behavior. During triage, at this stage of a ransomware
+  event, exfiltration is about to occur or has already. Isolate the endpoint and continue
+  investigating by review file modifications and parallel processes.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rclone.exe" AND
+  (like (cmd_line, "%copy%") OR like (cmd_line, "%mega%")OR like (cmd_line, "%pcloud%")
+  OR like (cmd_line, "%ftp%") OR like (cmd_line, "%--config%") OR like (cmd_line, "%--progress%")
+  OR like (cmd_line, "%--no-check-certificate%") OR like (cmd_line, "%--ignore-existing%") OR like (cmd_line, "%--auto-confirm%")
+  OR like (cmd_line, "%--transfers%") OR like (cmd_line, "%--multi-thread-streams%"))
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: False positives should be limited as this is restricted to
+  the Rclone process name. Filter or tune the analytic as needed.
+references:
+  - https://redcanary.com/blog/rclone-mega-extortion/
+  - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+  - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
+  - https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
+tags:
+  analytic_story:
+  - DarkSide Ransomware
+  - Ransomware
+  automated_detection_testing: passed
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Exfiltration
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to connect to a remote cloud service
+    to move files or folders.
+  mitre_attack_id:
+  - T1020
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml
index 0948312f9f..23b8d7ef16 100644
--- a/detections/endpoint/ssa___disable_net_user_account.yml
+++ b/detections/endpoint/ssa___disable_net_user_account.yml
@@ -1,15 +1,14 @@
 name: Disable Net User Account
 id: ba858b08-d26c-11eb-af9b-acde48001122
 version: 3
-date: '2021-12-01'
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
+  - Endpoint_Processes
 description: This analytic will identify a suspicious command-line that disables a
-  user account using the native `net.exe` or `net1.exe` utility to Windows. This technique
-  may used by the adversaries to interrupt availability of accounts and continue the
-  impact against the organization.
+  user account using the native `net.exe` or `net1.exe` utility to Windows. This technique may used
+  by the adversaries to interrupt availability of accounts and continue the impact against the organization.
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -28,8 +27,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be
   used.
-known_false_positives: System administrators or automated scripts may disable an account
-  but not a common practice. Filter as needed.
+known_false_positives: System administrators or automated scripts may disable an
+  account but not a common practice. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
@@ -52,6 +51,7 @@ tags:
     on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts.
   mitre_attack_id:
   - T1489
+  - T1078
   nist:
   - PR.AC
   - PR.IP
@@ -83,6 +83,6 @@ tags:
   - dest_user_id
   - process
   - cmd_line
-  risk_score: 49
   risk_severity: medium
-  security_domain: endpoint
+  risk_score: 49
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml
new file mode 100644
index 0000000000..95d44c07d3
--- /dev/null
+++ b/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml
@@ -0,0 +1,86 @@
+name: DNS Exfiltration Using Nslookup App
+id: 2452e632-9e0d-11eb-34ba-acde48001122
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This search is to detect potential DNS exfiltration using nslookup application.
+  This technique are seen in couple of malware and APT group to exfiltrated collected
+  data in a infected machine or infected network. This detection is looking for unique
+  use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are
+  commonly used by attacker and also the retry parameter which is designed to query
+  C2 DNS multiple tries.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="nslookup.exe" AND
+  (like (cmd_line, "%-querytype=%") OR like (cmd_line, "%-qt=%") OR like (cmd_line, "%-q=%")
+  OR like (cmd_line, "%-type=%") OR like (cmd_line, "%-retry=%")) 
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: It is possible for some legitimate administrative utilities to use similar cmd_line parameters. Filter as needed.
+references:
+- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
+- https://www.varonis.com/blog/dns-tunneling/
+- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
+tags:
+  analytic_story:
+  - Suspicious DNS Traffic
+  - Dynamic DNS
+  - Command and Control
+  - Data Exfiltration
+  automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related to DNS exfiltration.
+  mitre_attack_id:
+  - T1048
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 72
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml
index 05bdaabafe..554d4d973e 100644
--- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml
+++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml
@@ -1,14 +1,15 @@
 name: First time seen command line argument
 id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23
-version: 3
-date: 2021-2-1
+version: 4
+date: '2021-11-30'
 author: Ignacio Bermudez Corrales, Splunk
 type: Anomaly
 datamodel:
-- Endpoint_Processes
+  - Endpoint_Processes
 description: This search looks for command-line arguments that use a `/c` parameter
   to execute a command that has not previously been seen. This is an implementation
   on SPL2 of the rule `First time seen command line argument` by @bpatel.
+  'The following analytic identifies first time seen command-line arguments on a single endpoint. The analytic looks for arguments instantiated by `cmd.exe /c` and the associated command-line. Adversaries automate or spawn multiple processes using this method, this analytic may assist with identifying the first time it's been found on this endpoint.'
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"),
   "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string",
@@ -26,12 +27,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
   dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be populating the endpoint data model for SSA and specifically
-  the process_name and the process fields
-known_false_positives: Legitimate programs can also use command-line arguments to
-  execute. Please verify the command-line arguments to check what command/program
-  is being executed. We recommend customizing the `first_time_seen_cmd_line_filter`
-  macro to exclude legitimate parent_process_name
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Legitimate programs use command-line arguments to
+  execute. Verify the command-line arguments to check what command/program
+  is being executed. Filtering will be needed.
 references: []
 tags:
   analytic_story:
@@ -47,11 +49,9 @@ tags:
   kill_chain_phases:
   - Command and Control
   - Actions on Objectives
-  message: A cmd process $process_name$ with commandline $cmd_line$ try to execute
-    command has not previously seen in host $dest_device_id$
+  message: A process $process_name$ ha been identified in the environment with a command-line $cmd_line$ not previously seen before on host $dest_device_id$
   mitre_attack_id:
   - T1059
-  - T1117
   - T1202
   nist:
   - PR.PT
@@ -74,6 +74,7 @@ tags:
   - dest_device_id
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 30
   risk_severity: low
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___fsutil_zeroing_file.yml b/detections/endpoint/ssa___fsutil_zeroing_file.yml
new file mode 100644
index 0000000000..4d2c223974
--- /dev/null
+++ b/detections/endpoint/ssa___fsutil_zeroing_file.yml
@@ -0,0 +1,83 @@
+name: Fsutil Zeroing File
+id: f792cdc9-43ee-4429-a3c0-ffce4fed1a85
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This search is to detect a suspicious fsutil process to zeroing a target
+  file. This technique was seen in lockbit ransomware where it tries to zero out its
+  malware path as part of its defense evasion after encrypting the compromised host.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="fsutil.exe" AND
+  (like (cmd_line, "%setzerodata%"))
+  | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting logs
+  with the process name, parent process, and command-line executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+  Tune and filter known instances where renamed net.exe may be used.
+known_false_positives: System administrators or scripts may delete user accounts via
+  this technique. Filter as needed.
+references:
+  - https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/
+  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
+tags:
+  analytic_story:
+  - Ransomware
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  dataset: []
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file deletion.
+  mitre_attack_id:
+  - T1070
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 54
+  risk_severity: high
+  security_domain: endpoint
diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
index 8356803542..93a6d31601 100644
--- a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
+++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
@@ -1,15 +1,12 @@
 name: Grant Permission Using Cacls Utility
 id: c6da561a-cd29-11eb-ae65-acde48001122
-version: 2
-date: '2021-06-14'
+version: 3
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: This analytic identifies potential adversaries that modify the security
-  permission of a specific file or directory. This technique is commonly seen in APT
-  tradecraft, ransomware and coinminer scripts to evade detections and restrict access
-  to their component files.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of `cacls.exe`, `icacls.exe` or `xcacls.exe` placing the grant permission on a file or directory. Adversaries perform this behavior to allow components of their files to run, however it allows responders to review or gaining access to adversary files on disk.' 
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
   null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
@@ -26,8 +23,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
-known_false_positives: network administrator may use this windows utility but this
-  is not a common practice.
+known_false_positives: System administrators may use cacls utilities but this
+  is not a common practice. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
@@ -71,6 +68,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
index 872c2a90b7..944c08e1bf 100644
--- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
@@ -1,7 +1,7 @@
 name: Modify ACLs Permission Of Files Or Folders
 id: 9ae9a48a-cdbe-11eb-875a-acde48001122
-version: 1
-date: '2021-06-15'
+version: 2
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
@@ -10,7 +10,7 @@ description: This analytic identifies suspicious modification of ACL permission
   a files or folder to make it available to everyone or to a specific user. This technique
   may be used by the adversary to evade ACLs or protected files access. This changes
   is commonly configured by the file or directory owner with appropriate permission.
-  This behavior is a good indicator if this command seen on a machine utilized by
+  This behavior raises suspicion if this command is seen on an endpoint utilized by
   an account with no permission to do so.
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
@@ -29,7 +29,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
-known_false_positives: network administrator may use this windows utility. filter
+known_false_positives: System administrators may use this windows utility. filter
   is needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -74,6 +74,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
index 26609a21e8..c557ace1ce 100644
--- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
@@ -4,15 +4,11 @@ version: 2
 date: '2020-11-10'
 author: Ignacio Bermudez Corrales, Splunk
 type: Anomaly
-datamodel:
-- Endpoint_Processes
-description: The following analytic identifies parent processes, browsers, Windows
-  terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
-  many applications spawn cmd.exe natively or built into macros. Much of this will
-  need to be tuned to further enhance the risk. During triage, review parallel process
-  execution and identify any file modifications that may have occurred. Capture any
-  artifacts and review further.
-search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+datamodel: 
+  - Endpoint_Processes
+description: 'The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk.'
+search: '| from read_ssa_enriched_events()
+
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
   | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
   parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
@@ -82,6 +78,7 @@ tags:
   - _time
   - dest_device_id
   - dest_user_id
+  - cmd_line
   risk_score: 35
   risk_severity: low
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
index 300cb649b0..62d3db0f76 100644
--- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
+++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
@@ -1,13 +1,13 @@
 name: Potential Pass the Token or Hash Observed at the Destination Device
 id: 82e76b80-5cdb-4899-9b43-85dbe777b36d
-version: 2
-date: '2021-11-05'
+version: 3
+date: '2021-11-30'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
 - Authentication
 description: This detection identifies potential Pass the Token or Pass the Hash credential
-  exploits. We detect the main side effect of these attacks, which is a transition
+  stealing. We detect the main side effect of these attacks, which is a transition
   from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
   by a detination device.
 search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels)
@@ -45,7 +45,8 @@ how_to_implement: You must be ingesting Windows Security logs from endpoint devi
 known_false_positives: Environments in which NTLM is used extremely rarely and for
   benign purposes (such as a rare use of SMB shares).
 references:
-- https://attack.mitre.org/techniques/T1550/002/
+  - https://attack.mitre.org/techniques/T1550/002/
+  - https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
 tags:
   analytic_story:
   - Lateral Movement
diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
index f8bd23739e..72a13c15f0 100644
--- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
+++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
@@ -7,7 +7,7 @@ type: TTP
 datamodel:
 - Authentication
 description: This detection identifies potential Pass the Token or Pass the Hash credential
-  exploits. We detect the main side effect of these attacks, which is a transition
+  stealing. We detect the main side effect of these attacks, which is a transition
   from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
   by an event-collecting device (i.e., a specific domain controller or an endpoint
   destination).
@@ -47,7 +47,8 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
 known_false_positives: Environments in which NTLM is used extremely rarely and for
   benign purposes (such as a rare use of SMB shares).
 references:
-- https://attack.mitre.org/techniques/T1550/002/
+  - https://attack.mitre.org/techniques/T1550/002/
+  - https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
 tags:
   analytic_story:
   - Lateral Movement
diff --git a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
index 17cfa4730e..a6faed82d7 100644
--- a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
+++ b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
@@ -1,13 +1,13 @@
 name: Rare Parent-Child Process Relationship
 id: cf090c78-bcc6-11eb-8529-0242ac130003
-version: 1
-date: '2021-05-20'
+version: 2
+date: '2021-11-30'
 author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk
 type: Anomaly
 datamodel:
 - Endpoint_Processes
 description: An attacker may use LOLBAS tools spawned from vulnerable applications
-  not typically used by system administrators. This search leverages the Splunk Streaming
+  not typically used by system administrators. This analytic leverages the Splunk Streaming
   ML DSP plugin to find rare parent/child relationships. The list of application has
   been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
@@ -52,12 +52,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "input", input, "mean", mean, "variance", variance, "output", output, "cmd_line",
   cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
-known_false_positives: 'Some custom tools used by admins could be used rarely to launch
+known_false_positives: 'Some custom tools used by administrators could be used rarely to launch
   remotely applications. This might trigger false positives at the beginning when
-  it hasn''t collected yet enough data to construct the baseline.
-
-  '
-references: []
+  it has not collected yet enough data to construct the baseline.'
+references: 
+  - https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
 tags:
   analytic_story:
   - Unusual Processes
@@ -82,5 +81,6 @@ tags:
   - _time
   - dest_device_id
   - dest_user_id
+  - cmd_line
   risk_severity: low
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___resize_shadowstorage_volume.yml b/detections/endpoint/ssa___resize_shadowstorage_volume.yml
index 57327daab1..f9da11fb80 100644
--- a/detections/endpoint/ssa___resize_shadowstorage_volume.yml
+++ b/detections/endpoint/ssa___resize_shadowstorage_volume.yml
@@ -1,17 +1,13 @@
 name: Resize Shadowstorage Volume
 id: dbc30554-d27e-11eb-9e5e-acde48001122
-version: 2
-date: '2021-06-21'
+version: 3
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint_Processes
-description: The following analytics identifies the resizing of shadowstorage by ransomware
-  malware to avoid the shadow volumes being made again. this technique is an alternative
-  by ransomware attacker than deleting the shadowstorage which is known alert in defensive
-  team. one example of ransomware that use this technique is CLOP ransomware where
-  it drops a .bat file that will resize the shadowstorage to minimum size as much
-  as possible
+description: The following analytic identifies the resizing of shadowstorage using vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event 
+  and a precursor to deleting the shadowstorage. 
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -29,8 +25,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: System administrators may resize the shadowstorage for valid
-  purposes. Filter as needed.
+known_false_positives: System administrators may resize the shadowstorage for valid purposes. Filter as needed.
 references:
 - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
 - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
@@ -88,4 +83,4 @@ tags:
   - cmd_line
   risk_score: 64
   risk_severity: high
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___sdelete_application_execution.yml b/detections/endpoint/ssa___sdelete_application_execution.yml
index 2ccd153f23..8aca4bc53b 100644
--- a/detections/endpoint/ssa___sdelete_application_execution.yml
+++ b/detections/endpoint/ssa___sdelete_application_execution.yml
@@ -5,34 +5,30 @@ date: '2021-11-15'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint_Processes
-description: This analytic will detect the execution of sdelete.exe attempting to
-  delete potentially important files that may related to adversary or insider threats
-  to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
-  to securely delete files on disk. This tool is commonly used to clear tracks and
-  artifact on the targeted host.
-search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
-  "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string",
-  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
-  null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
-  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null),
-  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
-  IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") AND
-  (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %")
-  OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") OR like (cmd_line, "%-s
-  %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") OR like (cmd_line,
-  "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line,
-  "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line,
-  "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line,
-  "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line,
-  "%.bmp%") OR like (cmd_line, "%.7z%")  OR like (cmd_line, "%.zip%") OR like (cmd_line,
-  "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line,
-  "%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
-  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
-  process_name, "process_path", process_path, "parent_process_name", parent_process_name,
-  "parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();'
+  - Endpoint_Processes
+description: This analytic will detect the execution of sdelete.exe attempting to delete potentially important files 
+  that may related to adversary or insider threats to destroy evidence or information sabotage. Sdelete is a SysInternals utility
+  meant to securely delete files on disk. This tool is commonly used to clear tracks and artifact on the targeted host.
+search: '| from read_ssa_enriched_events()
+  | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)), 
+  cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), 
+  process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), 
+  process_path=ucast(map_get(input_event, "process_path"), "string", null), 
+  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), 
+  parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null), 
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") 
+  AND (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %") OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %")
+  OR like (cmd_line, "%-s %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") 
+  OR like (cmd_line, "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") 
+  OR like (cmd_line, "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") 
+  OR like (cmd_line, "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") 
+  OR like (cmd_line, "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") 
+  OR like (cmd_line, "%.bmp%") OR like (cmd_line, "%.7z%")  OR like (cmd_line, "%.zip%") 
+  OR like (cmd_line, "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line, "%.xls%"))
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), 
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "process_path", process_path, "parent_process_name", parent_process_name, "parent_cmd_line", parent_cmd_line]) 
+  | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -52,27 +48,32 @@ tags:
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
   impact: 60
+  risk_score: 42
   kill_chain_phases:
   - Exploitation
-  message: sdelete process $process_name$ executed on $dest$ attempting to permanently
-    delete files.
-  mitre_attack_id:
-  - T1485
-  - T1070.004
-  - T1070
+  message: Sdelete process $process_name$ executed on $dest_device_id$ attempting to permanently
+    delete files by $dest_user_id$.
   observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: user
+  - name: dest_user_id
     type: User
     role:
     - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process
+    type: Parent Process
+    role:
+    - Parent Process
   - name: process_name
     type: Process
     role:
     - Child Process
+  mitre_attack_id:
+  - T1485
+  - T1070.004
+  - T1070
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -85,5 +86,5 @@ tags:
   - process
   - process_id
   - process_path
-  risk_score: 42
-  security_domain: endpoint
+  - cmd_line
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___wbadmin_delete_system_backups.yml b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml
new file mode 100644
index 0000000000..7c18a2e2ca
--- /dev/null
+++ b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml
@@ -0,0 +1,86 @@
+name: WBAdmin Delete System Backups
+id: 71efbf52-4dbb-4c00-a520-306aa546cbb7
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
+  Tool) that delete backup files. This is typically used by ransomware to prevent
+  recovery.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="wbadmin.exe" AND
+  like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line, "%systemstatebackup%")  
+  | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: Administrators may modify the boot configuration.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
+  - https://thedfirreport.com/2020/10/08/ryuks-return/
+  - https://attack.mitre.org/techniques/T1490/
+  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
+tags:
+  analytic_story:
+  - Ryuk Ransomware
+  - Ransomware
+  cis20:
+  - CIS 8
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  dataset: []
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system backups.
+  mitre_attack_id:
+  - T1490
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 15
+  risk_severity: high
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml
new file mode 100644
index 0000000000..c77d32a57e
--- /dev/null
+++ b/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml
@@ -0,0 +1,98 @@
+name: Windows Curl Upload to Remote Destination
+id: cc8d046a-543b-11ec-b864-acde48001122
+version: 1
+date: '2021-12-03'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of Windows Curl.exe uploading
+  a file to a remote destination. \
+
+  `-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination.
+  \
+
+  `-d` or `--data` POST is the HTTP method that was invented to send data to a receiving
+  web application, and it is, for example, how most common HTML forms on the web work.
+  \
+
+  HTTP multipart formposts are done with `-F`, but this appears to not be compatible
+  with the Windows version of Curl. Will update if identified adversary tradecraft.
+  \
+
+  Adversaries may use one of the three methods based on the remote destination and
+  what they are attempting to upload (zip vs txt). During triage, review parallel
+  processes for further behavior. In addition, identify if the upload was successful
+  in network logs. If a file was uploaded, isolate the endpoint and review.'
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="curl.exe" AND
+  (like (cmd_line, "%-T %") OR like (cmd_line, "%--upload-file %")OR like (cmd_line, "%-d %")
+  OR like (cmd_line, "%--data %") OR like (cmd_line, "%-F %"))
+
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: False positives may be limited to source control applications
+  and may be required to be filtered out.
+references:
+  - https://everything.curl.dev/usingcurl/uploads
+  - https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
+  - https://twitter.com/d1r4c/status/1279042657508081664?s=20
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log
+  impact: 80
+  kill_chain_phases:
+  - Exfiltration
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ uploading a file to a remote destination.
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  security_domain: endpoint
diff --git a/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml b/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml
index c9943d8552..000c10ed68 100644
--- a/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml
+++ b/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml
@@ -7,7 +7,7 @@ tests:
   latest_time: 'now'
   baselines:
   - name: Baseline Of Cloud Infrastructure API Calls Per User
-    file: baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml
+    file: detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
diff --git a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml b/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml
index 050d9eaf1f..f2074430c2 100644
--- a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml
+++ b/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml
@@ -7,7 +7,7 @@ tests:
   latest_time: 'now'
   baselines:
   - name: Baseline Of Cloud Security Group API Calls Per User
-    file: baselines/baseline_of_cloud_security_group_api_calls_per_user.yml
+    file: detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
diff --git a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml b/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml
index 7135ebd7ae..cc782a4a7e 100644
--- a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml
+++ b/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: 'now'
   baselines:
   - name: Previously Seen AWS Cross Account Activity - Initial
-    file: baselines/previously_seen_aws_cross_account_activity_initial.yml
+    file: detections/cloud/previously_seen_aws_cross_account_activity_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
   - name: Previously Seen AWS Cross Account Activity - Update
-    file: baselines/previously_seen_aws_cross_account_activity_update.yml
+    file: detections/cloud/previously_seen_aws_cross_account_activity_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
diff --git a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml b/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml
index 47371cb887..d55a8bb52f 100644
--- a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml
+++ b/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: 'now'
   baselines:
   - name: Previously Seen Cloud API Calls Per User Role - Initial
-    file: baselines/previously_seen_cloud_api_calls_per_user_role_initial.yml
+    file: detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
   - name: Previously Seen Cloud API Calls Per User Role - Update
-    file: baselines/previously_seen_cloud_api_calls_per_user_role_update.yml
+    file: detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
diff --git a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml b/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml
index 34ff1d2ad6..19fec95d05 100644
--- a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml
+++ b/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: 'now'
   baselines:
   - name: Previously Seen Cloud Compute Creations By User - Initial
-    file: baselines/previously_seen_cloud_compute_creations_by_user_initial.yml
+    file: detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
   - name: Previously Seen Cloud Compute Creations By User - Update
-    file: baselines/previously_seen_cloud_compute_creations_by_user_update.yml
+    file: detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
diff --git a/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml b/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml
index 4aaf714aa3..adce8dbd51 100644
--- a/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml
+++ b/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: 'now'
   baselines:
   - name: Previously Seen Cloud Regions - Initial
-    file: baselines/previously_seen_cloud_regions_initial.yml
+    file: detections/cloud/previously_seen_cloud_regions_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
   - name: Previously Seen Cloud Regions - Update
-    file: baselines/previously_seen_cloud_regions_update.yml
+    file: detections/cloud/previously_seen_cloud_regions_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
diff --git a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml
index 22263f5b15..5f5ca038f3 100644
--- a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml
+++ b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: 'now'
   baselines:
   - name: Previously Seen Cloud Compute Images - Initial
-    file: baselines/previously_seen_cloud_compute_images_initial.yml
+    file: detections/cloud/previously_seen_cloud_compute_images_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
   - name: Previously Seen Cloud Compute Images - Update
-    file: baselines/previously_seen_cloud_compute_images_update.yml
+    file: detections/cloud/previously_seen_cloud_compute_images_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
diff --git a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml
index ace490888d..f3873c8264 100644
--- a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml
+++ b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: 'now'
   baselines:
   - name: Previously Seen Cloud Compute Instance Types - Initial
-    file: baselines/previously_seen_cloud_compute_instance_types_initial.yml
+    file: detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
   - name: Previously Seen Cloud Compute Instance Types - Update
-    file: baselines/previously_seen_cloud_compute_instance_types_update.yml
+    file: detections/cloud/previously_seen_cloud_compute_instance_types_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
diff --git a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml b/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml
index bdf58b91f8..f7db1c4a6a 100644
--- a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml
+++ b/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: 'now'
   baselines:
   - name: Previously Seen Cloud Instance Modifications By User - Initial
-    file: baselines/previously_seen_cloud_instance_modifications_by_user_initial.yml
+    file: detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
   - name: Previously Seen Cloud Instance Modifications By User - Update
-    file: baselines/previously_seen_cloud_instance_modifications_by_user_update.yml
+    file: detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml
index 207ea9898d..741d779eb2 100644
--- a/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml
+++ b/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: 'now'
   baselines:
   - name: Previously Seen Cloud Provisioning Activity Sources - Initial
-    file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml
+    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
   - name: Previously Seen Cloud Provisioning Activity Sources - Update
-    file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml
+    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml
index d095d33251..232de687dc 100644
--- a/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml
+++ b/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: 'now'
   baselines:
   - name: Previously Seen Cloud Provisioning Activity Sources - Initial
-    file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml
+    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
   - name: Previously Seen Cloud Provisioning Activity Sources - Update
-    file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml
+    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml
index ee410cda1d..720252edac 100644
--- a/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml
+++ b/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: 'now'
   baselines:
   - name: Previously Seen Cloud Provisioning Activity Sources - Initial
-    file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml
+    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
   - name: Previously Seen Cloud Provisioning Activity Sources - Update
-    file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml
+    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml
index d4d7c727ec..e821a9025b 100644
--- a/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml
+++ b/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: 'now'
   baselines:
   - name: Previously Seen Cloud Provisioning Activity Sources - Initial
-    file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml
+    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
   - name: Previously Seen Cloud Provisioning Activity Sources - Update
-    file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml
+    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
diff --git a/tests/cloud/detect_aws_console_login_by_new_user.test.yml b/tests/cloud/detect_aws_console_login_by_new_user.test.yml
index 6e0fdf4290..b84e13d7a6 100644
--- a/tests/cloud/detect_aws_console_login_by_new_user.test.yml
+++ b/tests/cloud/detect_aws_console_login_by_new_user.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: 'now'
   baselines:
   - name: Previously Seen Users In Cloudtrail - Initial
-    file: baselines/previously_seen_users_in_cloudtrail_initial.yml
+    file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
   - name: Previously Seen Users In Cloudtrail - Update
-    file: baselines/previously_seen_users_in_cloudtrail_update.yml
+    file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml
index e032cbbd35..674b1c5f55 100644
--- a/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml
+++ b/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: 'now'
   baselines:
   - name: Previously Seen Users In Cloudtrail - Initial
-    file: baselines/previously_seen_users_in_cloudtrail_initial.yml
+    file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
   - name: Previously Seen Users In Cloudtrail - Update
-    file: baselines/previously_seen_users_in_cloudtrail_update.yml
+    file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml
index 691c5fa5af..7195ba7f46 100644
--- a/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml
+++ b/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: 'now'
   baselines:
   - name: Previously Seen Users In Cloudtrail - Initial
-    file: baselines/previously_seen_users_in_cloudtrail_initial.yml
+    file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
   - name: Previously Seen Users In Cloudtrail - Update
-    file: baselines/previously_seen_users_in_cloudtrail_update.yml
+    file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml
index 9ea20d1e25..c09f7ce926 100644
--- a/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml
+++ b/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: 'now'
   baselines:
   - name: Previously Seen Users In Cloudtrail - Initial
-    file: baselines/previously_seen_users_in_cloudtrail_initial.yml
+    file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
   - name: Previously Seen Users In Cloudtrail - Update
-    file: baselines/previously_seen_users_in_cloudtrail_update.yml
+    file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
diff --git a/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml b/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml
new file mode 100644
index 0000000000..0127db21ec
--- /dev/null
+++ b/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml
@@ -0,0 +1,10 @@
+name: BCDEdit Failure Recovery Modification - SSA Unit Test
+tests:
+  - name: BCDEdit Failure Recovery Modification
+    file: endpoint/ssa___bcdedit_failure_recovery_modification.yml
+    pass_condition: '@count_gt(0)'
+    description: Test detection of BCDEdit Failure Recovery Modification
+    attack_data:
+      - file_name: windows-sysmon.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+        source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
diff --git a/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml b/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml
new file mode 100644
index 0000000000..26bdade65a
--- /dev/null
+++ b/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml
@@ -0,0 +1,9 @@
+name: Detect RClone Command-Line Usage Unit Test
+tests:
+- name: Detect RClone Command-Line Usage
+  file: endpoint/ssa___detect_rclone_command_line_usage.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
diff --git a/tests/endpoint/ssa___dns_exfiltration_using_nslookup_app.test.yml b/tests/endpoint/ssa___dns_exfiltration_using_nslookup_app.test.yml
new file mode 100644
index 0000000000..cb4664986f
--- /dev/null
+++ b/tests/endpoint/ssa___dns_exfiltration_using_nslookup_app.test.yml
@@ -0,0 +1,9 @@
+name: DNS Exfiltration Using Nslookup App Unit Test
+tests:
+- name: DNS Exfiltration Using Nslookup App
+  file: endpoint/ssa_dns_exfiltration_using_nslookup_app.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
diff --git a/tests/endpoint/ssa___fsutil_zeroing_file.test.yml b/tests/endpoint/ssa___fsutil_zeroing_file.test.yml
new file mode 100644
index 0000000000..11edb21baf
--- /dev/null
+++ b/tests/endpoint/ssa___fsutil_zeroing_file.test.yml
@@ -0,0 +1,10 @@
+name: FSUtil Zeroing File - SSA Unit Test
+tests:
+  - name: FSUtil Zeroing File
+    file: endpoint/ssa___fsutil_zeroing_file.yml
+    pass_condition: '@count_gt(0)'
+    description: Test detection of FSUtil Zeroing File
+    attack_data:
+    - file_name: windows-sysmon.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log
+      source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
diff --git a/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml b/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml
new file mode 100644
index 0000000000..84a6b071df
--- /dev/null
+++ b/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml
@@ -0,0 +1,10 @@
+name: WBAdmin Delete System Backups - SSA Unit Test
+tests:
+  - name: WBAdmin Delete System Backups
+    file: endpoint/ssa___wbadmin_delete_system_backups.yml
+    pass_condition: '@count_gt(0)'
+    description: Test detection of WBAdmin Delete System Backups
+    attack_data:
+      - file_name: windows-sysmon.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+        source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml b/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml
new file mode 100644
index 0000000000..57cd2b8000
--- /dev/null
+++ b/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml
@@ -0,0 +1,9 @@
+name: Windows Curl Upload to Remote Destination Unit Test
+tests:
+- name: Windows Curl Upload to Remote Destination
+  file: endpoint/ssa___windows_curl_upload_to_remote_destination.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-sysmon_curl_upload.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
diff --git a/tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml b/tests/experimental/cloud/abnormally_high_cloud_instances_destroyed.test.yml
similarity index 100%
rename from tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml
rename to tests/experimental/cloud/abnormally_high_cloud_instances_destroyed.test.yml
diff --git a/tests/cloud/abnormally_high_cloud_instances_launched.test.yml b/tests/experimental/cloud/abnormally_high_cloud_instances_launched.test.yml
similarity index 100%
rename from tests/cloud/abnormally_high_cloud_instances_launched.test.yml
rename to tests/experimental/cloud/abnormally_high_cloud_instances_launched.test.yml