diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
similarity index 55%
rename from detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
index ce57b526e6..69518c020c 100644
--- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
+++ b/detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
@@ -1,30 +1,35 @@
 name: Applying Stolen Credentials via Mimikatz modules
 id: 759a653f-cb92-40f9-94c9-ec4e47b0f709
-version: 1
-date: '2020-11-03'
+version: 2
+date: '2021-11-24'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token
-  attack, Golden or Silver kerberos ticket attack, and Skeleton key attack.
+  - Endpoint_Processes
+description: 'The following analytic identifites the use of Mimikatz modules attempting to perform Pass-the-Ticket, Golden or Silver Kerberos ticket attacks and Skeleton Key attack. This behavior is typically performed within interactive Mimikatz memory space, however it may be identified on the command-line.
+  A Pass-the-Ticket (ptt) attack is performed once an adversary has established access to a single endpoint and retrieved the kerberos ticket to now begin moving laterally using this method. Typically, it blends in with logon activity as the ticket can be copied to another system and passed into the current session effectively simulating a logon without any communication with the Domain Controller.
+  A Golden or Silver ticket attack requires some setup by the adversary, but once performed it will simulate lateral based authentication to additional endpoints.'
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
   cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line,
   /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true
   OR match_regex(cmd_line, /(?i)misc::skeleton/)=true )
-
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
   | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting logs
+  with the process name, parent process, and command-line executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to Mimikatz.
 references:
-- https://github.com/gentilkiwi/mimikatz
-- https://adsecurity.org/?p=1275
+  - https://github.com/gentilkiwi/mimikatz
+  - https://adsecurity.org/?p=1275
+  - https://adsecurity.org/?p=1515
+  - https://adsecurity.org/?page_id=1821#KERBEROSPTT
+  - https://attack.mitre.org/software/S0002/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1550.002/T1550.002.md#atomic-test-1---mimikatz-pass-the-hash
 tags:
   analytic_story:
   - Credential Dumping
@@ -58,6 +63,10 @@ tags:
   - T1554
   - T1556
   - T1558
+  - T1558.002
+  - T1558.001
+  - T1003
+  - T1003.001
   nist:
   - PR.AC
   - PR.IP
@@ -81,6 +90,7 @@ tags:
   - dest_user_id
   - process
   - _time
+  - cmd_line
   risk_score: 90
   risk_severity: high
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml
similarity index 64%
rename from detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
rename to detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml
index c52f46a113..1023e7c74c 100644
--- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
+++ b/detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml
@@ -1,15 +1,13 @@
 name: Applying Stolen Credentials via PowerSploit modules
 id: 270b482d-2af2-448f-9923-9cf005f61be4
-version: 1
-date: '2020-11-03'
+version: 2
+date: '2021-11-24'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Stolen credentials are applied by methods such as user impersonation,
-  credential injection, spoofing of authentication processes or getting hold of critical
-  accounts. This detection indicates such activities carried out by PowerSploit exploit
-  kit APIs.
+  - Endpoint_Processes
+description: 'The following analytic identifies commonly used PowerSploit modules that perform credential access, spoofing of authentication processes, user impersonation and attempting to manipulate tokens. Specifically, the following modules `Invoke-CredentialInjection`, `Invoke-TokenManipulation`, `Invoke-UserImpersonation`, `Get-System`, and `Invoke-RevertToSelf` were identfiied as modules used to access credentials.
+  PowerSploit is an archived project on GitHub, but much of its modules and scripts are still utilized today by adversaries. This behavior is typically performed within interactive PowerShell sessions or injected into processes, however it may be identified on the command-line.'
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -24,11 +22,13 @@ search: '| from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
   | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting logs
+  with the process name, parent process, and command-line executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to PowerSploit.
 references:
-- https://github.com/PowerShellMafia/PowerSploit
+  - https://github.com/PowerShellMafia/PowerSploit
+  - https://attack.mitre.org/software/S0194/
 tags:
   analytic_story:
   - Credential Dumping
@@ -62,6 +62,7 @@ tags:
   - T1554
   - T1555
   - T1558
+  - T1059.001
   nist:
   - PR.AC
   - PR.IP
@@ -85,6 +86,7 @@ tags:
   - dest_user_id
   - process
   - _time
+  - cmd_line
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml
similarity index 68%
rename from detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
rename to detections/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml
index 77ce2b1fb7..7db363f5db 100644
--- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
+++ b/detections/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml
@@ -1,13 +1,12 @@
 name: Assessment of Credential Strength via DSInternals modules
 id: 5526d3a4-2497-4e8d-9d3c-7a34c9aace2f
-version: 1
-date: '2020-11-03'
+version: 2
+date: '2021-11-24'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: This detection identifies use of DSInternals modules that verify password
-  strength, i.e., identify weak accounts that would be easily compromised.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of a DSInternals module, `Test-PasswordQuality`, that verifies password strength. Adversaries have utilized this module to determine password complexity or to identify accounts with weak passwords.'
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -19,11 +18,13 @@ search: '| from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
   | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting logs
+  with the process name, parent process, and command-line executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to DSInternals.
 references:
-- https://github.com/MichaelGrafnetter/DSInternals
+  - https://github.com/MichaelGrafnetter/DSInternals
+  - https://attack.mitre.org/techniques/T1059/001/
 tags:
   analytic_story:
   - Credential Dumping
@@ -49,6 +50,8 @@ tags:
   - T1201
   - T1552
   - T1555
+  - T1059.001
+  - T1059
   nist:
   - PR.AC
   - PR.IP
@@ -72,6 +75,7 @@ tags:
   - process
   - dest_device_id
   - dest_user_id
+  - cmd_line
   risk_score: 25
   risk_severity: high
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/deprecated/ssa___credential_extraction_dsinternals_conversion_modules.yml
similarity index 66%
rename from detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml
rename to detections/deprecated/ssa___credential_extraction_dsinternals_conversion_modules.yml
index f3c7b0941e..346e9ec039 100644
--- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml
+++ b/detections/deprecated/ssa___credential_extraction_dsinternals_conversion_modules.yml
@@ -1,16 +1,14 @@
 name: Credential Extraction indicative of use of DSInternals credential conversion
   modules
 id: 73e23834-c7ad-4860-bfd0-7d8ffe6527c2
-version: 1
-date: '2020-10-21'
+version: 2
+date: '2021-11-29'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Credential extraction is often an illegal recovery of credential material
-  from secured authentication resources and repositories. This process may also involve
-  decryption or other transformations of the stored credential material. DSInternals
-  is a collection of PowerShell modules commonly employed in exploits.
+  - Endpoint_Processes
+description: 'The following analytic identifies modules within DSInternals that are used for extracting credentials from Active Directory. Modules include `ConvertFrom-ADManagedPasswordBlob`, `ConvertFrom-GPPrefPassword`, `ConvertFrom-UnicodePasswor`, `ConvertTo-GPPrefPassword`,`ConvertTo-KerberosKey`, `ConvertTo-LMHash`, `ConvertTo-NTHash` `ConvertTo-OrgIdHash` or `ConvertTo-UnicodePassword`.
+  Adversaries may use these modules for decrypting or transforming the stored credentials.' 
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -30,11 +28,14 @@ search: '| from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to DSInternals.
 references:
-- https://github.com/MichaelGrafnetter/DSInternals
+  - https://github.com/MichaelGrafnetter/DSInternals
+  - https://attack.mitre.org/techniques/T1059/001/
 tags:
   analytic_story:
   - Credential Dumping
@@ -53,10 +54,12 @@ tags:
   kill_chain_phases:
   - Actions on Objectives
   message: DSInternals tool kit is converting stolen credential material to a form
-    applicable to authentications. Operation is performed at the device $dest_device_id$,
-    by the account $dest_user_id$ via command $cmd_line$
+    applicable to authentications. Operation is performed on the device $dest_device_id$,
+    by the account $dest_user_id$ via process $process_name$.
   mitre_attack_id:
   - T1003
+  - T1003.002
+  - T1059.001
   nist:
   - PR.AC
   - PR.IP
@@ -69,10 +72,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -82,7 +85,7 @@ tags:
   - _time
   - process_path
   - dest_user_id
-  - process
+  - cmd_line
   risk_score: 70
   risk_severity: high
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/deprecated/ssa___credential_extraction_dsinternals_modules.yml
similarity index 76%
rename from detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml
rename to detections/deprecated/ssa___credential_extraction_dsinternals_modules.yml
index ad2a5a161b..0b9a3c4b74 100644
--- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml
+++ b/detections/deprecated/ssa___credential_extraction_dsinternals_modules.yml
@@ -1,15 +1,13 @@
 name: Credential Extraction indicative of use of DSInternals modules
 id: 5d2172f0-8a7d-4ecd-aad9-2dcc95699e0d
-version: 1
-date: '2020-10-21'
+version: 2
+date: '2021-11-29'
 author: Stanislav Miskovic, Splunk
 type: TTP
-datamodel:
-- Endpoint_Processes
-description: Credential extraction is often an illegal recovery of credential material
-  from secured authentication resources and repositories. This process may also involve
-  decryption or other transformations of the stored credential material. DSInternals
-  is a collection of PowerShell modules commonly employed in exploits.
+datamodel: 
+  - Endpoint_Processes
+description: 'The following analytic identifies modules of DSInternals being used on the associated endpoint.
+  Adversaries may use these modules for manipulating data related to Active Directory and credentials.' 
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -31,11 +29,14 @@ search: '| from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: None identified as this is strictly identifying known command-line attributes related to DSInternals.
 references:
-- https://github.com/MichaelGrafnetter/DSInternals
+  - https://github.com/MichaelGrafnetter/DSInternals
+  - https://attack.mitre.org/techniques/T1059/001/
 tags:
   analytic_story:
   - Credential Dumping
@@ -56,9 +57,11 @@ tags:
   message: DSInternals tool kit is accessing sensitive credential material such as
     KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation.
     Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
-    via command $cmd_line$
+    via process $process_name$
   mitre_attack_id:
   - T1003
+  - T1003.002
+  - T1059.001
   nist:
   - PR.AC
   - PR.IP
@@ -71,10 +74,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: Process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -85,6 +88,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 70
   risk_severity: high
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_s_option.yml
similarity index 69%
rename from detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml
rename to detections/deprecated/ssa___credential_extraction_fgdump_cachedump_s_option.yml
index 100e2c60f0..d31701b203 100644
--- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml
+++ b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_s_option.yml
@@ -1,17 +1,13 @@
 name: Credential Extraction indicative of FGDump and CacheDump with s option
 id: 312582f2-5e91-42c1-a275-cd67f31373c8
-version: 1
-date: '2020-10-18'
+version: 2
+date: '2021-11-29'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Credential extraction is often an illegal recovery of credential material
-  from secured authentication resources and repositories. This process may also involve
-  decryption or other transformations of the stored credential material. FGdump is
-  a newer version of pwdump tool that extracts NTLM and LanMan password hashes from
-  Windows. Cachedump is a publicly-available tool that extracts cached password hashes
-  from a system's registry.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of CacheDump with the `-s` parameter to dump cached credentials on the associated endpoint. Adversaries use Cachedump as it is a publicly-available tool that extracts cached password hashes
+  from a system''s registry.'
 search: ' | from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -28,10 +24,16 @@ search: ' | from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
-references: []
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: False positives will be limited as this analytic targets specific credential dumping process names. Filter as needed.
+references:
+  - https://attack.mitre.org/software/S0119/
+  - https://en.kali.tools/all/?tool=182
+  - http://foofus.net/goons/fizzgig/fgdump/
+  - https://attack.mitre.org/software/S0120/
 tags:
   analytic_story:
   - Unusual Processes
@@ -51,9 +53,10 @@ tags:
   - Actions on Objectives
   message: Malicious actor is accessing stored credentials via FGDump or CacheDump
     tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
-    via command $cmd_line$
+    via process $process_name$.
   mitre_attack_id:
   - T1003
+  - T1003.002
   nist:
   - PR.AC
   - PR.IP
@@ -66,10 +69,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: Process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -80,6 +83,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 70
   risk_severity: high
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_v_option.yml
similarity index 67%
rename from detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml
rename to detections/deprecated/ssa___credential_extraction_fgdump_cachedump_v_option.yml
index c636e1241d..ec6113cf84 100644
--- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml
+++ b/detections/deprecated/ssa___credential_extraction_fgdump_cachedump_v_option.yml
@@ -1,17 +1,13 @@
 name: Credential Extraction indicative of FGDump and CacheDump with v option
 id: 3c40b0ef-a03f-460a-9484-e4b9117cbb38
-version: 1
-date: '2020-10-18'
+version: 2
+date: '2021-11-29'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Credential extraction is often an illegal recovery of credential material
-  from secured authentication resources and repositories. This process may also involve
-  decryption or other transformations of the stored credential material. FGdump is
-  a newer version of pwdump tool that extracts NTLM and LanMan password hashes from
-  Windows. Cachedump is a publicly-available tool that extracts cached password hashes
-  from a system's registry.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of CacheDump with the `-v` parameter to dump cached credentials on the associated endpoint. Adversaries use Cachedump as it is a publicly-available tool that extracts cached password hashes
+  from a system''s registry.'
 search: ' | from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -26,9 +22,16 @@ search: ' | from read_ssa_enriched_events()
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be ingesting Windows Security logs from devices of interest,
-  including the event ID 4688 with enabled command line logging.
-known_false_positives: None identified.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: False positives will be limited as this analytic targets specific credential dumping process names. Filter as needed.
+references:
+  - https://attack.mitre.org/software/S0119/
+  - https://en.kali.tools/all/?tool=182
+  - http://foofus.net/goons/fizzgig/fgdump/
+  - https://attack.mitre.org/software/S0120/
 references: []
 tags:
   analytic_story:
@@ -49,9 +52,10 @@ tags:
   - Actions on Objectives
   message: Malicious actor is accessing stored credentials via FGDump or CacheDump
     tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
-    via command $cmd_line$
+    via process $process_name$
   mitre_attack_id:
   - T1003
+  - T1003.002
   nist:
   - PR.AC
   - PR.IP
@@ -64,10 +68,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: Process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -77,6 +81,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 63
   risk_severity: high
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/deprecated/ssa___credential_extraction_getaddbaccount_from_dump.yml
similarity index 100%
rename from detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml
rename to detections/deprecated/ssa___credential_extraction_getaddbaccount_from_dump.yml
diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/deprecated/ssa___credential_extraction_lazagne_command_options.yml
similarity index 100%
rename from detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml
rename to detections/deprecated/ssa___credential_extraction_lazagne_command_options.yml
diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/deprecated/ssa___credential_extraction_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml
rename to detections/deprecated/ssa___credential_extraction_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/deprecated/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
similarity index 100%
rename from detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
rename to detections/deprecated/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/deprecated/ssa___credential_extraction_ms_debuggers_z_option.yml
similarity index 100%
rename from detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml
rename to detections/deprecated/ssa___credential_extraction_ms_debuggers_z_option.yml
diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/deprecated/ssa___credential_extraction_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___credential_extraction_powersploit_modules.yml
rename to detections/deprecated/ssa___credential_extraction_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_access_user_content_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml
rename to detections/deprecated/ssa___illegal_access_user_content_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_account_creation_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
rename to detections/deprecated/ssa___illegal_account_creation_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/deprecated/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
rename to detections/deprecated/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/deprecated/ssa___illegal_log_deletion_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___illegal_log_deletion_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/deprecated/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
rename to detections/deprecated/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
rename to detections/deprecated/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
rename to detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/deprecated/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
rename to detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/deprecated/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
rename to detections/deprecated/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_and_use_computers_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___recon_and_use_computers_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_and_use_shares_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___recon_and_use_shares_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_and_use_shares_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_and_use_shares_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_connectivity_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_connectivity_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_defensive_tools_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_defensive_tools_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/deprecated/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
rename to detections/deprecated/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/deprecated/ssa___recon_processes_and_services_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___recon_processes_and_services_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/deprecated/ssa___setting_credentials_via_dsinternals_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
rename to detections/deprecated/ssa___setting_credentials_via_dsinternals_modules.yml
diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/deprecated/ssa___setting_credentials_via_mimikatz_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
rename to detections/deprecated/ssa___setting_credentials_via_mimikatz_modules.yml
diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/deprecated/ssa___setting_credentials_via_powersploit_modules.yml
similarity index 100%
rename from detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml
rename to detections/deprecated/ssa___setting_credentials_via_powersploit_modules.yml
diff --git a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml
index 7b38c7b154..d4993baf2c 100644
--- a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml
+++ b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml
@@ -19,7 +19,7 @@ known_false_positives: Legitimate logon activity by authorized NTLM systems may
 references: []
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
index 6b8b7a8286..a8f9c6fc3c 100644
--- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml
+++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
@@ -36,7 +36,7 @@ tags:
   - DHS Report TA18-074A
   - HAFNIUM Group
   - DarkSide Ransomware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
index f3bed31e95..aae0bea823 100644
--- a/detections/endpoint/detect_renamed_psexec.yml
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -33,7 +33,7 @@ tags:
   - DHS Report TA18-074A
   - HAFNIUM Group
   - DarkSide Ransomware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 90
   context:
diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml
index cea14e9c2d..d4cdc813b6 100644
--- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml
+++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml
@@ -8,7 +8,7 @@ datamodel:
 - Endpoint
 description: The following analytic identifies executable files (.exe or .dll) being
   written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents
-  suspicious behavior as its commonly user by tools like like PsExec/PaExec and others
+  suspicious behavior as its commonly used by tools like like PsExec/PaExec and others
   to stage service binaries before creating and starting a Windows service on remote
   endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral
   movement and remote code execution. The Trickbot malware family also implements
@@ -31,7 +31,7 @@ references:
 - https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   - Trickbot
   automated_detection_testing: passed
   confidence: 100
diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
index 103da14e4d..d2c6c8d24a 100644
--- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
+++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
@@ -36,7 +36,7 @@ references:
 - https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:
diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
index 8a8ae569ea..3f8090e1e6 100644
--- a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
+++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
@@ -25,7 +25,7 @@ references:
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enter-pssession?view=powershell-7.2
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   confidence: 50
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/investigate_successful_remote_desktop_authentications.yml b/detections/endpoint/investigate_successful_remote_desktop_authentications.yml
index adb4eb9517..0ef0b02006 100644
--- a/detections/endpoint/investigate_successful_remote_desktop_authentications.yml
+++ b/detections/endpoint/investigate_successful_remote_desktop_authentications.yml
@@ -23,7 +23,7 @@ references: []
 tags:
   analytic_story:
   - Hidden Cobra Malware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   - SamSam Ransomware
   product:
   - Splunk Phantom
diff --git a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml
index ea44d9edb0..b49f8879df 100644
--- a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml
@@ -40,7 +40,7 @@ references:
 - https://lolbas-project.github.io/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/endpoint/net_localgroup_discovery.yml
index be87f8b84f..ea47f2e0e7 100644
--- a/detections/endpoint/net_localgroup_discovery.yml
+++ b/detections/endpoint/net_localgroup_discovery.yml
@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Windows Discovery Techniques
   automated_detection_testing: passed
   confidence: 50
   context:
diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
new file mode 100644
index 0000000000..b9179b8089
--- /dev/null
+++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
@@ -0,0 +1,86 @@
+name: Possible Lateral Movement PowerShell Spawn
+id: cb909b3e-512b-11ec-aa31-3e22fbd008af
+version: 1
+date: '2021-11-29'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic assists with identifying a PowerShell process
+  spawned as a child or grand child process of commonly abused processes during lateral
+  movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe`
+  and `mmc.exe`. Legitimate Windows features such as the Service Control Manager,
+  Windows Management Instrumentation, Task Scheduler, Windows Remote Management and
+  the DCOM protocol can be abused to start a process on a remote endpoint. Looking
+  for PowerShell spawned out of this processes may reveal a lateral movement attack.
+  Red Teams and adversaries alike may abuse these services during a breach for lateral
+  movement and remote code execution.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe
+  OR Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe
+  OR Processes.parent_process_name=wsmprovhost.exe OR Processes.parent_process_name=mmc.exe)
+  (Processes.process_name=powershell.exe OR (Processes.process_name=cmd.exe AND Processes.process=*powershell.exe*)
+  OR Processes.process_name=pwsh.exe OR (Processes.process_name=cmd.exe AND Processes.process=*pwsh.exe*))
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Legitimate applications may spawn PowerShell as a child process
+  of the the identified processes. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1021/003
+- https://attack.mitre.org/techniques/T1021/006/
+- https://attack.mitre.org/techniques/T1047/
+- https://attack.mitre.org/techniques/T1053.005/
+- https://attack.mitre.org/techniques/T1543/003/
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  - Malicious PowerShell
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log
+  kill_chain_phases:
+  - Lateral Movement
+  - Malicious PowerShell
+  mitre_attack_id:
+  - T1021
+  - T1021.003
+  - T1021.006
+  - T1047
+  - T1053.005
+  - T1543.003
+  - T1059.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  security_domain: endpoint
+  impact: 90
+  confidence: 50
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A PowerShell process was spawned as a child process of typically abused
+    processes on $dest$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  automated_detection_testing: passed
diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
index a9909bece8..4732042e6b 100644
--- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
@@ -27,7 +27,7 @@ references:
 - https://www.cybereason.com/blog/dcom-lateral-movement-techniques
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:
diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
index 921e7209ea..15389b529a 100644
--- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
@@ -25,7 +25,7 @@ references:
 - https://www.cybereason.com/blog/dcom-lateral-movement-techniques
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:
diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
index b91bf8ffc1..b26ed0eae8 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
@@ -28,7 +28,7 @@ references:
 - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 50
   context:
diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
index 0cc04eb85e..3482d16ebd 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
@@ -26,7 +26,7 @@ references:
 - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 50
   context:
diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
index 66f259f1d8..0cf0e762c5 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
@@ -27,7 +27,7 @@ references:
 - https://attack.mitre.org/techniques/T1021/006/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml
index 4a29b6ae73..ea0ab2981e 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml
@@ -30,7 +30,7 @@ tags:
   analytic_story:
   - Ransomware
   - Suspicious WMI Use
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   automated_detection_testing: passed
   cis20:
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
index 230e41cbfe..aa04af220f 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
@@ -27,7 +27,7 @@ references:
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
index 6a6016cf50..abd9d37eec 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
@@ -25,7 +25,7 @@ references:
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 70
   context:
diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
index 61c0b7ecdd..dc1b4e2e5c 100644
--- a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
+++ b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
@@ -29,7 +29,7 @@ references:
 - https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob?redirectedfrom=MSDN
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml
index f30345a006..534990ea49 100644
--- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml
+++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml
@@ -26,7 +26,7 @@ references:
 - https://attack.mitre.org/techniques/T1053/005/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
index 06696828bb..ba117efbda 100644
--- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
+++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
@@ -27,7 +27,7 @@ known_false_positives: Administrators may create scheduled tasks on remote syste
 references: []
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   - NOBELIUM Group
   asset_type: Endpoint
   automated_detection_testing: passed
diff --git a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml
index bd90a89185..3761b132b9 100644
--- a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml
@@ -9,7 +9,7 @@ datamodel:
 description: The following analytic identifies `services.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing the Service Control
   Manager and creating a remote malicious service, the executed command is spawned
-  as a child processs of `services.exe`. The LOLBAS project documents Windows native
+  as a child process of `services.exe`. The LOLBAS project documents Windows native
   binaries that can be abused by threat actors to perform tasks like executing malicious
   code. Looking for child processes of services.exe that are part of the LOLBAS project
   can help defenders identify lateral movement activity.
@@ -40,7 +40,7 @@ references:
 - https://lolbas-project.github.io/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/short_lived_scheduled_task.yml b/detections/endpoint/short_lived_scheduled_task.yml
new file mode 100644
index 0000000000..7caeaf1551
--- /dev/null
+++ b/detections/endpoint/short_lived_scheduled_task.yml
@@ -0,0 +1,67 @@
+name: Short Lived Scheduled Task
+id: 6fa31414-546e-11ec-adfa-acde48001122
+version: 1
+date: '2021-12-03'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic leverages Windows Security EventCode 4698, `A
+  scheduled task was created` and Windows Security EventCode 4699, `A scheduled task
+  was deleted` to identify scheduled tasks created and deleted in less than 30 seconds.
+  This behavior may represent a lateral movement attack abusing the Task Scheduler
+  to obtain code execution. Red Teams and adversaries alike may abuse the Task Scheduler
+  for lateral movement and remote code execution.
+search: ' `wineventlog_security` EventCode=4698 OR EventCode=4699 | xmlkv Message
+  | transaction Task_Name  startswith=(EventCode=4698) endswith=(EventCode=4699) |
+  eval short_lived=case((duration<30),"TRUE") | search  short_lived = TRUE | table
+  _time, ComputerName, Account_Name, Command, Task_Name, short_lived | `short_lived_scheduled_task_filter` '
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also
+  required.
+known_false_positives: Although uncommon, legitimate applications may create and delete
+  a Scheduled Task within 30 seconds. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1053/005/
+- https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-security.log
+  kill_chain_phases:
+  - Lateral Movement
+  mitre_attack_id:
+  - T1053.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - ComputerName
+  - Account_Name
+  - Task_Name
+  - Description
+  - Command
+  security_domain: endpoint
+  impact: 90
+  confidence: 90
+  risk_score: 81
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Lateral Movement
+  message: A windows scheduled task was created and deleted in 30 seconds on $ComputerName$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  - name: Command
+    type: Command
+    role:
+    - Target
+  automated_detection_testing: passed
diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml
index 02b3713ccb..b796491f7b 100644
--- a/detections/endpoint/ssa___attempt_to_delete_services.yml
+++ b/detections/endpoint/ssa___attempt_to_delete_services.yml
@@ -1,16 +1,13 @@
 name: Attempt To Delete Services
 id: a0c8c292-d01a-11eb-aa18-acde48001122
 version: 3
-date: '2021-11-30'
+date: '2021-11-24'
 author: Teoderick Contreras, splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: The following analytic identifies Windows Service Control, `sc.exe`,
-  attempting to delete a service. This is typically identified in parallel with other
-  instances of service enumeration of attempts to stop a service and then delete it.
-  Adversaries utilize this technique to terminate security services or other related
-  services to continue there objective and evade detections.
+  - Endpoint_Processes
+description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue
+  there objective and evade detections.'
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -26,11 +23,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
-known_false_positives: It is possible administrative scripts may start/stop/delete
-  services. Filter as needed.
+  Sysmon TA. 
+known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed.
 references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+  - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md
 tags:
   analytic_story:
   - XMRig
@@ -52,6 +49,8 @@ tags:
     on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service.
   mitre_attack_id:
   - T1489
+  - T1543
+  - T1543.003
   nist:
   - PR.DS
   - PR.IP
@@ -85,4 +84,4 @@ tags:
   - cmd_line
   risk_score: 36
   risk_severity: high
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml
index ece73aba06..313f4d4564 100644
--- a/detections/endpoint/ssa___attempt_to_disable_services.yml
+++ b/detections/endpoint/ssa___attempt_to_disable_services.yml
@@ -1,16 +1,13 @@
 name: Attempt To Disable Services
 id: afb31de4-d023-11eb-98d5-acde48001122
 version: 3
-date: '2021-11-30'
+date: '2021-11-24'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: The following analytic identifies Windows Service Control, `sc.exe`,
-  attempting to disable a service. This is typically identified in parallel with other
-  instances of service enumeration of attempts to stop a service and then disable
-  it. Adversaries utilize this technique to terminate security services or other related
-  services to continue there objective and evade detections.
+  - Endpoint_Processes
+description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to disable a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then disable it. Adversaries utilize this technique to terminate security services or other related services to continue
+  there objective and evade detections.'
 search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event,
   "_datamodels"), "collection<string>", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
@@ -27,13 +24,12 @@ search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(inpu
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
-known_false_positives: It is possible administrative scripts may start/stop/delete
-  services. Filter as needed.
+  Sysmon TA. 
+known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed.
 references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
-- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
+  - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+  - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
 tags:
   analytic_story:
   - XMRig
@@ -87,4 +83,4 @@ tags:
   - process
   risk_score: 36
   risk_severity: medium
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
index fb81931e78..ed66d0cca6 100644
--- a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -1,13 +1,12 @@
 name: Attempted Credential Dump From Registry via Reg exe
 id: 14038953-e5f2-4daf-acff-5452062baf03
-version: 1
-date: 2020-6-04
+version: 2
+date: '2021-11-29'
 author: Jose Hernandez, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: Monitor for execution of reg.exe with parameters specifying an export
-  of keys that contain hashed credentials that attackers may try to crack offline.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of `reg.exe` attempting to export Windows registry keys that contain hashed credentials. Adversaries will utilize this technique to capture and perform offline password cracking.'
 search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event,
   "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"),
@@ -22,11 +21,14 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma
   = timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id),
   body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
   | into write_ssa_detected_events(); '
-how_to_implement: You must be ingesting windows endpoint data that tracks process
-  activity, including parent-child relationships from your endpoints.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
 known_false_positives: None identified.
 references:
-- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
+  - https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
 tags:
   analytic_story:
   - Credential Dumping
@@ -43,11 +45,10 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: Malicious actor is dumping stored credentials from the registry sections
-    SAM, Security, or System. Operation is performed at the device $dest_device_id$,
-    by the account $dest_user_id$ via command $cmd_line$
+  message: An attempt to save registry keys storing credentials has been performed on $dest_device_id$ by $dest_user_id$ via process $process_name$.
   mitre_attack_id:
   - T1003
+  - T1003.002
   nist:
   - DE.CM
   observable:
@@ -59,10 +60,10 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
+  - name: process_name
+    type: process
     role:
-    - Others
+    - Child Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -71,6 +72,7 @@ tags:
   - dest_device_id
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 63
   risk_severity: low
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml b/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml
new file mode 100644
index 0000000000..7b19775d61
--- /dev/null
+++ b/detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml
@@ -0,0 +1,84 @@
+name: BCDEdit Failure Recovery Modification
+id: 76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This search looks for flags passed to bcdedit.exe modifications to the
+  built-in Windows error recovery boot configurations. This is typically used by ransomware
+  to prevent recovery.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bcdedit.exe" AND
+  (like (cmd_line, "%recoveryenabled%") AND like (cmd_line, "%no%"))
+  | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: Administrators may modify the boot configuration.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
+tags:
+  analytic_story:
+  - Ryuk Ransomware
+  - Ransomware
+  cis20:
+  - CIS 8
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Impact
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+  impact: 100
+  kill_chain_phases:
+  - Actions on Objectives
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting disable the ability to recover the
+    endpoint.
+  mitre_attack_id:
+  - T1490
+  nist:
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  risk_severity: high
+  security_domain: endpoint
diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml
index 0d8c7562fe..04281188df 100644
--- a/detections/endpoint/ssa___delete_a_net_user.yml
+++ b/detections/endpoint/ssa___delete_a_net_user.yml
@@ -5,7 +5,7 @@ date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint_Processes
+  - Endpoint_Processes
 description: This analytic will detect a suspicious net.exe/net1.exe command-line
   to delete a user on a system. This technique may be use by an administrator for
   legitimate purposes, however this behavior has been used in the wild to impair some
@@ -18,14 +18,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND like(cmd_line, "%user%")
-  AND (process_name="net1.exe" OR process_name="net.exe") | eval start_time=timestamp,
-  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
-  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
-  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
-  "parent_process_name", parent_process_name, "process_path", process_path]) | into
-  write_ssa_detected_events();'
-how_to_implement: o successfully implement this search, you need to be ingesting logs
+  cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
+  OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting logs
   with the process name, parent process, and command-line executions from your endpoints.
   If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
   Tune and filter known instances where renamed net.exe may be used.
diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
index 99f240479b..2ffee7990f 100644
--- a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
+++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
@@ -1,15 +1,12 @@
 name: Deny Permission using Cacls Utility
 id: b76eae28-cd25-11eb-9c92-acde48001122
-version: 2
-date: '2021-06-14'
+version: 3
+date: '2021-11-29'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: This analytic identifies a potential adversary that changes the security
-  permission of a specific file or directory. This technique is commonly seen in APT
-  tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection
-  and prevent access to their component files.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of `cacls.exe`, `icacls.exe` or `xcacls.exe` placing the deny permission on a file or directory. Adversaries perform this behavior to prevent responders from reviewing or gaining access to adversary files on disk.' 
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
   null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
@@ -26,8 +23,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
-known_false_positives: network administrator may use this windows utility but this
-  is not a common practice.
+known_false_positives: System administrators may use cacls utilities but this
+  is not a common practice. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
@@ -71,6 +68,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
index 51de8d3da3..e2bf1d6826 100644
--- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
@@ -1,29 +1,29 @@
 name: Detect Dump LSASS Memory using comsvcs
 id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
 version: 2
-date: '2020-09-15'
+date: '2021-11-29'
 author: Jose Hernandez, Splunk
 type: TTP
-datamodel:
-- Endpoint_Processes
-description: This search detects the memory of lsass.exe being dumped for offline
-  credential theft attack.
-search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
-  | eval dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
-  process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)),
-  timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process=lower(ucast(map_get(input_event,
-  "process"), "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string",
-  null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
-  | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id)
-  | eval body=create_map(["event_id", event_id, "process_name", process_name, "process",
-  process]) | into write_ssa_detected_events();'
+datamodel: 
+  - Endpoint_Processes
+description: 'The following analytic identifies credential dumping using comsvcs.dll with `regsvr32.exe`. This technique is common with adversaries who would like to dump the memory of lsass.exe and perform offline password cracking.'
+search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event,
+  "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
+  "string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
+  null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
+  "event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process,
+  /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time =
+  timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id,
+  "process_name", process_name, "process", process]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including Windows command line logging. You can see how we test this with [Event
   Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)
   on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml).
-known_false_positives: None identified.
+known_false_positives: False positives should be limited, filter as needed.
 references:
-- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+  - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll
 tags:
   analytic_story:
   - Credential Dumping
@@ -41,9 +41,7 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: Malicious actor is dumping encoded credentials via Microsoft's native comsvc
-    DLL. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
-    via command $cmd_line$
+  message: A dump of lsass.exe was attempted using comsvcs.dll on endpoint $dest_device_id$ by user $dest_device_user$.
   mitre_attack_id:
   - T1003.003
   - T1003
@@ -58,10 +56,6 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: cmd_line
-    type: processname
-    role:
-    - Others
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -72,4 +66,4 @@ tags:
   - process
   risk_score: 70
   risk_severity: low
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml
new file mode 100644
index 0000000000..f88b4a2fb7
--- /dev/null
+++ b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml
@@ -0,0 +1,90 @@
+name: Detect RClone Command-Line Usage
+id: e8b74268-5454-11ec-a799-acde48001122
+version: 1
+date: '2021-12-03'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This analytic identifies commonly used command-line arguments used by
+  `rclone.exe` to initiate a file transfer. Some arguments were negated as they are
+  specific to the configuration used by adversaries. In particular, an adversary may
+  list the files or directories of the remote file share using `ls` or `lsd`, which
+  is not indicative of malicious behavior. During triage, at this stage of a ransomware
+  event, exfiltration is about to occur or has already. Isolate the endpoint and continue
+  investigating by review file modifications and parallel processes.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rclone.exe" AND
+  (like (cmd_line, "%copy%") OR like (cmd_line, "%mega%")OR like (cmd_line, "%pcloud%")
+  OR like (cmd_line, "%ftp%") OR like (cmd_line, "%--config%") OR like (cmd_line, "%--progress%")
+  OR like (cmd_line, "%--no-check-certificate%") OR like (cmd_line, "%--ignore-existing%") OR like (cmd_line, "%--auto-confirm%")
+  OR like (cmd_line, "%--transfers%") OR like (cmd_line, "%--multi-thread-streams%"))
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: False positives should be limited as this is restricted to
+  the Rclone process name. Filter or tune the analytic as needed.
+references:
+  - https://redcanary.com/blog/rclone-mega-extortion/
+  - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+  - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
+  - https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
+tags:
+  analytic_story:
+  - DarkSide Ransomware
+  - Ransomware
+  automated_detection_testing: passed
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
+  impact: 50
+  kill_chain_phases:
+  - Exfiltration
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to connect to a remote cloud service
+    to move files or folders.
+  mitre_attack_id:
+  - T1020
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml
index 0948312f9f..23b8d7ef16 100644
--- a/detections/endpoint/ssa___disable_net_user_account.yml
+++ b/detections/endpoint/ssa___disable_net_user_account.yml
@@ -1,15 +1,14 @@
 name: Disable Net User Account
 id: ba858b08-d26c-11eb-af9b-acde48001122
 version: 3
-date: '2021-12-01'
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
+  - Endpoint_Processes
 description: This analytic will identify a suspicious command-line that disables a
-  user account using the native `net.exe` or `net1.exe` utility to Windows. This technique
-  may used by the adversaries to interrupt availability of accounts and continue the
-  impact against the organization.
+  user account using the native `net.exe` or `net1.exe` utility to Windows. This technique may used
+  by the adversaries to interrupt availability of accounts and continue the impact against the organization.
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -28,8 +27,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be
   used.
-known_false_positives: System administrators or automated scripts may disable an account
-  but not a common practice. Filter as needed.
+known_false_positives: System administrators or automated scripts may disable an
+  account but not a common practice. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
@@ -52,6 +51,7 @@ tags:
     on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts.
   mitre_attack_id:
   - T1489
+  - T1078
   nist:
   - PR.AC
   - PR.IP
@@ -83,6 +83,6 @@ tags:
   - dest_user_id
   - process
   - cmd_line
-  risk_score: 49
   risk_severity: medium
-  security_domain: endpoint
+  risk_score: 49
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml
new file mode 100644
index 0000000000..95d44c07d3
--- /dev/null
+++ b/detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml
@@ -0,0 +1,86 @@
+name: DNS Exfiltration Using Nslookup App
+id: 2452e632-9e0d-11eb-34ba-acde48001122
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This search is to detect potential DNS exfiltration using nslookup application.
+  This technique are seen in couple of malware and APT group to exfiltrated collected
+  data in a infected machine or infected network. This detection is looking for unique
+  use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are
+  commonly used by attacker and also the retry parameter which is designed to query
+  C2 DNS multiple tries.
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="nslookup.exe" AND
+  (like (cmd_line, "%-querytype=%") OR like (cmd_line, "%-qt=%") OR like (cmd_line, "%-q=%")
+  OR like (cmd_line, "%-type=%") OR like (cmd_line, "%-retry=%")) 
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: It is possible for some legitimate administrative utilities to use similar cmd_line parameters. Filter as needed.
+references:
+- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
+- https://www.varonis.com/blog/dns-tunneling/
+- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
+tags:
+  analytic_story:
+  - Suspicious DNS Traffic
+  - Dynamic DNS
+  - Command and Control
+  - Data Exfiltration
+  automated_detection_testing: passed
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related to DNS exfiltration.
+  mitre_attack_id:
+  - T1048
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 72
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml
index 05bdaabafe..554d4d973e 100644
--- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml
+++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml
@@ -1,14 +1,15 @@
 name: First time seen command line argument
 id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23
-version: 3
-date: 2021-2-1
+version: 4
+date: '2021-11-30'
 author: Ignacio Bermudez Corrales, Splunk
 type: Anomaly
 datamodel:
-- Endpoint_Processes
+  - Endpoint_Processes
 description: This search looks for command-line arguments that use a `/c` parameter
   to execute a command that has not previously been seen. This is an implementation
   on SPL2 of the rule `First time seen command line argument` by @bpatel.
+  'The following analytic identifies first time seen command-line arguments on a single endpoint. The analytic looks for arguments instantiated by `cmd.exe /c` and the associated command-line. Adversaries automate or spawn multiple processes using this method, this analytic may assist with identifying the first time it's been found on this endpoint.'
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"),
   "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string",
@@ -26,12 +27,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
   dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name]) | into write_ssa_detected_events();'
-how_to_implement: You must be populating the endpoint data model for SSA and specifically
-  the process_name and the process fields
-known_false_positives: Legitimate programs can also use command-line arguments to
-  execute. Please verify the command-line arguments to check what command/program
-  is being executed. We recommend customizing the `first_time_seen_cmd_line_filter`
-  macro to exclude legitimate parent_process_name
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Legitimate programs use command-line arguments to
+  execute. Verify the command-line arguments to check what command/program
+  is being executed. Filtering will be needed.
 references: []
 tags:
   analytic_story:
@@ -47,11 +49,9 @@ tags:
   kill_chain_phases:
   - Command and Control
   - Actions on Objectives
-  message: A cmd process $process_name$ with commandline $cmd_line$ try to execute
-    command has not previously seen in host $dest_device_id$
+  message: A process $process_name$ ha been identified in the environment with a command-line $cmd_line$ not previously seen before on host $dest_device_id$
   mitre_attack_id:
   - T1059
-  - T1117
   - T1202
   nist:
   - PR.PT
@@ -74,6 +74,7 @@ tags:
   - dest_device_id
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 30
   risk_severity: low
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___fsutil_zeroing_file.yml b/detections/endpoint/ssa___fsutil_zeroing_file.yml
new file mode 100644
index 0000000000..4d2c223974
--- /dev/null
+++ b/detections/endpoint/ssa___fsutil_zeroing_file.yml
@@ -0,0 +1,83 @@
+name: Fsutil Zeroing File
+id: f792cdc9-43ee-4429-a3c0-ffce4fed1a85
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This search is to detect a suspicious fsutil process to zeroing a target
+  file. This technique was seen in lockbit ransomware where it tries to zero out its
+  malware path as part of its defense evasion after encrypting the compromised host.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="fsutil.exe" AND
+  (like (cmd_line, "%setzerodata%"))
+  | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting logs
+  with the process name, parent process, and command-line executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+  Tune and filter known instances where renamed net.exe may be used.
+known_false_positives: System administrators or scripts may delete user accounts via
+  this technique. Filter as needed.
+references:
+  - https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/
+  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
+tags:
+  analytic_story:
+  - Ransomware
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  dataset: []
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file deletion.
+  mitre_attack_id:
+  - T1070
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 54
+  risk_severity: high
+  security_domain: endpoint
diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
index 8356803542..93a6d31601 100644
--- a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
+++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
@@ -1,15 +1,12 @@
 name: Grant Permission Using Cacls Utility
 id: c6da561a-cd29-11eb-ae65-acde48001122
-version: 2
-date: '2021-06-14'
+version: 3
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
-- Endpoint_Processes
-description: This analytic identifies potential adversaries that modify the security
-  permission of a specific file or directory. This technique is commonly seen in APT
-  tradecraft, ransomware and coinminer scripts to evade detections and restrict access
-  to their component files.
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of `cacls.exe`, `icacls.exe` or `xcacls.exe` placing the grant permission on a file or directory. Adversaries perform this behavior to allow components of their files to run, however it allows responders to review or gaining access to adversary files on disk.' 
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
   null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
@@ -26,8 +23,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
-known_false_positives: network administrator may use this windows utility but this
-  is not a common practice.
+known_false_positives: System administrators may use cacls utilities but this
+  is not a common practice. Filter as needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
@@ -71,6 +68,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
index 872c2a90b7..944c08e1bf 100644
--- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
@@ -1,7 +1,7 @@
 name: Modify ACLs Permission Of Files Or Folders
 id: 9ae9a48a-cdbe-11eb-875a-acde48001122
-version: 1
-date: '2021-06-15'
+version: 2
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
@@ -10,7 +10,7 @@ description: This analytic identifies suspicious modification of ACL permission
   a files or folder to make it available to everyone or to a specific user. This technique
   may be used by the adversary to evade ACLs or protected files access. This changes
   is commonly configured by the file or directory owner with appropriate permission.
-  This behavior is a good indicator if this command seen on a machine utilized by
+  This behavior raises suspicion if this command is seen on an endpoint utilized by
   an account with no permission to do so.
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
@@ -29,7 +29,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
-known_false_positives: network administrator may use this windows utility. filter
+known_false_positives: System administrators may use this windows utility. filter
   is needed.
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -74,6 +74,7 @@ tags:
   - process_path
   - dest_user_id
   - process
+  - cmd_line
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
index 26609a21e8..c557ace1ce 100644
--- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
@@ -4,15 +4,11 @@ version: 2
 date: '2020-11-10'
 author: Ignacio Bermudez Corrales, Splunk
 type: Anomaly
-datamodel:
-- Endpoint_Processes
-description: The following analytic identifies parent processes, browsers, Windows
-  terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
-  many applications spawn cmd.exe natively or built into macros. Much of this will
-  need to be tuned to further enhance the risk. During triage, review parallel process
-  execution and identify any file modifications that may have occurred. Capture any
-  artifacts and review further.
-search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+datamodel: 
+  - Endpoint_Processes
+description: 'The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk.'
+search: '| from read_ssa_enriched_events()
+
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
   | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
   parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
@@ -82,6 +78,7 @@ tags:
   - _time
   - dest_device_id
   - dest_user_id
+  - cmd_line
   risk_score: 35
   risk_severity: low
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
index 300cb649b0..9337d767fe 100644
--- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
+++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
@@ -1,13 +1,13 @@
 name: Potential Pass the Token or Hash Observed at the Destination Device
 id: 82e76b80-5cdb-4899-9b43-85dbe777b36d
-version: 2
-date: '2021-11-05'
+version: 3
+date: '2021-11-30'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel:
 - Authentication
 description: This detection identifies potential Pass the Token or Pass the Hash credential
-  exploits. We detect the main side effect of these attacks, which is a transition
+  stealing. We detect the main side effect of these attacks, which is a transition
   from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
   by a detination device.
 search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels)
@@ -45,10 +45,11 @@ how_to_implement: You must be ingesting Windows Security logs from endpoint devi
 known_false_positives: Environments in which NTLM is used extremely rarely and for
   benign purposes (such as a rare use of SMB shares).
 references:
-- https://attack.mitre.org/techniques/T1550/002/
+  - https://attack.mitre.org/techniques/T1550/002/
+  - https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Windows
   cis20:
   - CIS 16
diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
index f8bd23739e..c771240784 100644
--- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
+++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
@@ -7,7 +7,7 @@ type: TTP
 datamodel:
 - Authentication
 description: This detection identifies potential Pass the Token or Pass the Hash credential
-  exploits. We detect the main side effect of these attacks, which is a transition
+  stealing. We detect the main side effect of these attacks, which is a transition
   from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
   by an event-collecting device (i.e., a specific domain controller or an endpoint
   destination).
@@ -47,10 +47,11 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
 known_false_positives: Environments in which NTLM is used extremely rarely and for
   benign purposes (such as a rare use of SMB shares).
 references:
-- https://attack.mitre.org/techniques/T1550/002/
+  - https://attack.mitre.org/techniques/T1550/002/
+  - https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Windows
   cis20:
   - CIS 16
diff --git a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
index 17cfa4730e..a6faed82d7 100644
--- a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
+++ b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
@@ -1,13 +1,13 @@
 name: Rare Parent-Child Process Relationship
 id: cf090c78-bcc6-11eb-8529-0242ac130003
-version: 1
-date: '2021-05-20'
+version: 2
+date: '2021-11-30'
 author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk
 type: Anomaly
 datamodel:
 - Endpoint_Processes
 description: An attacker may use LOLBAS tools spawned from vulnerable applications
-  not typically used by system administrators. This search leverages the Splunk Streaming
+  not typically used by system administrators. This analytic leverages the Splunk Streaming
   ML DSP plugin to find rare parent/child relationships. The list of application has
   been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
@@ -52,12 +52,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "input", input, "mean", mean, "variance", variance, "output", output, "cmd_line",
   cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
-known_false_positives: 'Some custom tools used by admins could be used rarely to launch
+known_false_positives: 'Some custom tools used by administrators could be used rarely to launch
   remotely applications. This might trigger false positives at the beginning when
-  it hasn''t collected yet enough data to construct the baseline.
-
-  '
-references: []
+  it has not collected yet enough data to construct the baseline.'
+references: 
+  - https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
 tags:
   analytic_story:
   - Unusual Processes
@@ -82,5 +81,6 @@ tags:
   - _time
   - dest_device_id
   - dest_user_id
+  - cmd_line
   risk_severity: low
   security_domain: endpoint
diff --git a/detections/endpoint/ssa___resize_shadowstorage_volume.yml b/detections/endpoint/ssa___resize_shadowstorage_volume.yml
index 57327daab1..f9da11fb80 100644
--- a/detections/endpoint/ssa___resize_shadowstorage_volume.yml
+++ b/detections/endpoint/ssa___resize_shadowstorage_volume.yml
@@ -1,17 +1,13 @@
 name: Resize Shadowstorage Volume
 id: dbc30554-d27e-11eb-9e5e-acde48001122
-version: 2
-date: '2021-06-21'
+version: 3
+date: '2021-11-30'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint_Processes
-description: The following analytics identifies the resizing of shadowstorage by ransomware
-  malware to avoid the shadow volumes being made again. this technique is an alternative
-  by ransomware attacker than deleting the shadowstorage which is known alert in defensive
-  team. one example of ransomware that use this technique is CLOP ransomware where
-  it drops a .bat file that will resize the shadowstorage to minimum size as much
-  as possible
+description: The following analytic identifies the resizing of shadowstorage using vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event 
+  and a precursor to deleting the shadowstorage. 
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -29,8 +25,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
-known_false_positives: System administrators may resize the shadowstorage for valid
-  purposes. Filter as needed.
+known_false_positives: System administrators may resize the shadowstorage for valid purposes. Filter as needed.
 references:
 - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
 - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
@@ -88,4 +83,4 @@ tags:
   - cmd_line
   risk_score: 64
   risk_severity: high
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___sdelete_application_execution.yml b/detections/endpoint/ssa___sdelete_application_execution.yml
index 2ccd153f23..8aca4bc53b 100644
--- a/detections/endpoint/ssa___sdelete_application_execution.yml
+++ b/detections/endpoint/ssa___sdelete_application_execution.yml
@@ -5,34 +5,30 @@ date: '2021-11-15'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
-- Endpoint_Processes
-description: This analytic will detect the execution of sdelete.exe attempting to
-  delete potentially important files that may related to adversary or insider threats
-  to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
-  to securely delete files on disk. This tool is commonly used to clear tracks and
-  artifact on the targeted host.
-search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
-  "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string",
-  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
-  null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
-  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null),
-  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
-  IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") AND
-  (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %")
-  OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") OR like (cmd_line, "%-s
-  %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") OR like (cmd_line,
-  "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line,
-  "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line,
-  "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line,
-  "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line,
-  "%.bmp%") OR like (cmd_line, "%.7z%")  OR like (cmd_line, "%.zip%") OR like (cmd_line,
-  "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line,
-  "%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
-  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
-  process_name, "process_path", process_path, "parent_process_name", parent_process_name,
-  "parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();'
+  - Endpoint_Processes
+description: This analytic will detect the execution of sdelete.exe attempting to delete potentially important files 
+  that may related to adversary or insider threats to destroy evidence or information sabotage. Sdelete is a SysInternals utility
+  meant to securely delete files on disk. This tool is commonly used to clear tracks and artifact on the targeted host.
+search: '| from read_ssa_enriched_events()
+  | eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)), 
+  cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), 
+  process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), 
+  process_path=ucast(map_get(input_event, "process_path"), "string", null), 
+  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null), 
+  parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null), 
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") 
+  AND (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %") OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %")
+  OR like (cmd_line, "%-s %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") 
+  OR like (cmd_line, "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") 
+  OR like (cmd_line, "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") 
+  OR like (cmd_line, "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") 
+  OR like (cmd_line, "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") 
+  OR like (cmd_line, "%.bmp%") OR like (cmd_line, "%.7z%")  OR like (cmd_line, "%.zip%") 
+  OR like (cmd_line, "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line, "%.xls%"))
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)), 
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "process_path", process_path, "parent_process_name", parent_process_name, "parent_cmd_line", parent_cmd_line]) 
+  | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -52,27 +48,32 @@ tags:
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
   impact: 60
+  risk_score: 42
   kill_chain_phases:
   - Exploitation
-  message: sdelete process $process_name$ executed on $dest$ attempting to permanently
-    delete files.
-  mitre_attack_id:
-  - T1485
-  - T1070.004
-  - T1070
+  message: Sdelete process $process_name$ executed on $dest_device_id$ attempting to permanently
+    delete files by $dest_user_id$.
   observable:
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: user
+  - name: dest_user_id
     type: User
     role:
     - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process
+    type: Parent Process
+    role:
+    - Parent Process
   - name: process_name
     type: Process
     role:
     - Child Process
+  mitre_attack_id:
+  - T1485
+  - T1070.004
+  - T1070
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -85,5 +86,5 @@ tags:
   - process
   - process_id
   - process_path
-  risk_score: 42
-  security_domain: endpoint
+  - cmd_line
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___wbadmin_delete_system_backups.yml b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml
new file mode 100644
index 0000000000..7c18a2e2ca
--- /dev/null
+++ b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml
@@ -0,0 +1,86 @@
+name: WBAdmin Delete System Backups
+id: 71efbf52-4dbb-4c00-a520-306aa546cbb7
+version: 1
+date: '2021-12-07'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
+  Tool) that delete backup files. This is typically used by ransomware to prevent
+  recovery.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="wbadmin.exe" AND
+  like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line, "%systemstatebackup%")  
+  | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: Administrators may modify the boot configuration.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
+  - https://thedfirreport.com/2020/10/08/ryuks-return/
+  - https://attack.mitre.org/techniques/T1490/
+  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
+tags:
+  analytic_story:
+  - Ryuk Ransomware
+  - Ransomware
+  cis20:
+  - CIS 8
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - stage:Defense Evasion
+  dataset: []
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system backups.
+  mitre_attack_id:
+  - T1490
+  nist:
+  - PR.AC
+  - PR.IP
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 15
+  risk_severity: high
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml
new file mode 100644
index 0000000000..c77d32a57e
--- /dev/null
+++ b/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml
@@ -0,0 +1,98 @@
+name: Windows Curl Upload to Remote Destination
+id: cc8d046a-543b-11ec-b864-acde48001122
+version: 1
+date: '2021-12-03'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+  - Endpoint_Processes
+description: 'The following analytic identifies the use of Windows Curl.exe uploading
+  a file to a remote destination. \
+
+  `-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination.
+  \
+
+  `-d` or `--data` POST is the HTTP method that was invented to send data to a receiving
+  web application, and it is, for example, how most common HTML forms on the web work.
+  \
+
+  HTTP multipart formposts are done with `-F`, but this appears to not be compatible
+  with the Windows version of Curl. Will update if identified adversary tradecraft.
+  \
+
+  Adversaries may use one of the three methods based on the remote destination and
+  what they are attempting to upload (zip vs txt). During triage, review parallel
+  processes for further behavior. In addition, identify if the upload was successful
+  in network logs. If a file was uploaded, isolate the endpoint and review.'
+search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
+  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
+  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
+  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
+  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="curl.exe" AND
+  (like (cmd_line, "%-T %") OR like (cmd_line, "%--upload-file %")OR like (cmd_line, "%-d %")
+  OR like (cmd_line, "%--data %") OR like (cmd_line, "%-F %"))
+
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
+  "process_name", process_name, "parent_process_name", parent_process_name, "process_path",
+  process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint_Processess` datamodel.
+known_false_positives: False positives may be limited to source control applications
+  and may be required to be filtered out.
+references:
+  - https://everything.curl.dev/usingcurl/uploads
+  - https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
+  - https://twitter.com/d1r4c/status/1279042657508081664?s=20
+tags:
+  analytic_story:
+  - Ingress Tool Transfer
+  automated_detection_testing: passed
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log
+  impact: 80
+  kill_chain_phases:
+  - Exfiltration
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ uploading a file to a remote destination.
+  mitre_attack_id:
+  - T1105
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  security_domain: endpoint
diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
index a647523f9c..e4ff7baa92 100644
--- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
@@ -9,7 +9,7 @@ datamodel:
 description: The following analytic identifies `svchost.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing the Task Scheduler
   and creating a malicious remote scheduled task, the executed command is spawned
-  as a child processs of `svchost.exe`. The LOLBAS project documents Windows native
+  as a child process of `svchost.exe`. The LOLBAS project documents Windows native
   binaries that can be abused by threat actors to perform tasks like executing malicious
   code. Looking for child processes of svchost.exe that are part of the LOLBAS project
   can help defenders identify lateral movement activity.
@@ -39,7 +39,7 @@ references:
 - https://lolbas-project.github.io/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml
index 63dfff09af..c3fa2d88f7 100644
--- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml
+++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml
@@ -28,7 +28,7 @@ references:
 tags:
   analytic_story:
   - Clop Ransomware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 80
   context:
diff --git a/detections/endpoint/windows_service_created_within_public_path.yml b/detections/endpoint/windows_service_created_within_public_path.yml
index 94cc1e0dee..483bbb5954 100644
--- a/detections/endpoint/windows_service_created_within_public_path.yml
+++ b/detections/endpoint/windows_service_created_within_public_path.yml
@@ -26,7 +26,7 @@ references:
 - https://pentestlab.blog/2020/07/21/lateral-movement-services/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
index 1067c551d7..ee54cbec60 100644
--- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
+++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
@@ -28,7 +28,7 @@ references:
 - https://attack.mitre.org/techniques/T1543/003/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml
index 72ec8412e9..bf0a3f099e 100644
--- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml
+++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml
@@ -26,7 +26,7 @@ references:
 - https://attack.mitre.org/techniques/T1543/003/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
index 0091f8b44b..ff59f2304b 100644
--- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
@@ -47,7 +47,7 @@ tags:
   - Ransomware
   - Ryuk Ransomware
   - IcedID
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 100
   context:
diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
index d8c382523d..e97f6960b8 100644
--- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
@@ -8,7 +8,7 @@ datamodel:
 - Endpoint
 description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing Windows Management
-  Instrumention (WMI), the executed command is spawned as a child processs of `wmiprvse.exe`.
+  Instrumentation (WMI), the executed command is spawned as a child process of `wmiprvse.exe`.
   The LOLBAS project documents Windows native binaries that can be abused by threat
   actors to perform tasks like executing malicious code. Looking for child processes
   of wmiprvse.exe that are part of the LOLBAS project can help defenders identify
@@ -40,7 +40,7 @@ references:
 - https://lolbas-project.github.io/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
index f3884c6b51..f7a2261b11 100644
--- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
@@ -40,7 +40,7 @@ references:
 - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
 tags:
   analytic_story:
-  - Lateral Movement
+  - Active Directory Lateral Movement
   automated_detection_testing: passed
   confidence: 60
   context:
diff --git a/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml
new file mode 100644
index 0000000000..ddb0436bae
--- /dev/null
+++ b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml
@@ -0,0 +1,63 @@
+name: Randomly Generated Scheduled Task Name
+id: 9d22a780-5165-11ec-ad4f-3e22fbd008af
+version: 1
+date: '2021-11-29'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic leverages Event ID 4698, `A scheduled task was created`, 
+ to identify the creation of a Scheduled Task with a suspicious, high entropy, Task Name. To achieve this,
+ this analytic also leverages the `ut_shannon` function from the URL ToolBox Splunk application.
+ Red teams and adversaries alike may abuse the Task Scheduler to create and start a remote Scheduled Task
+ and obtain remote code execution. To achieve this goal, tools like Impacket or Crapmapexec,
+ typically create a Scheduled Task with a random task name on the victim host. This hunting analytic may help
+ defenders identify Scheduled Tasks created as part of a lateral movement attack. The entropy threshold `ut_shannon > 3` 
+ should be customized by users. The Command field can be used to determine if the task has malicious intent or not. 
+search: ' `wineventlog_security` EventCode=4698 | xmlkv Message 
+| lookup ut_shannon_lookup word as Task_Name
+| where ut_shannon > 3
+| table  _time, dest, Task_Name, ut_shannon, Command, Author, Enabled, Hidden | `randomly_generated_scheduled_task_name_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Security Event Logs with 4698 EventCode enabled. The Windows TA as well as the URL ToolBox application are also
+  required.
+known_false_positives: Legitimate applications may use random Scheduled Task names.
+references:
+- https://attack.mitre.org/techniques/T1053/005/ 
+- https://splunkbase.splunk.com/app/2734/
+- https://en.wikipedia.org/wiki/Entropy_(information_theory) 
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  kill_chain_phases:
+  - Privilege Escalation
+  - Lateral Movement
+  - Persistence
+  mitre_attack_id:
+  - T1053
+  - T1053.005
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - Task_Name
+  - Description
+  - Command
+  security_domain: endpoint
+  impact: 90
+  confidence: 50
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Lateral Movement
+  message: 'A windows scheduled task with a suspicious task name was created on $dest$'
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  
\ No newline at end of file
diff --git a/detections/experimental/endpoint/randomly_generated_windows_service_name.yml b/detections/experimental/endpoint/randomly_generated_windows_service_name.yml
new file mode 100644
index 0000000000..af39d3a77f
--- /dev/null
+++ b/detections/experimental/endpoint/randomly_generated_windows_service_name.yml
@@ -0,0 +1,65 @@
+name: Randomly Generated Windows Service Name
+id: 2032a95a-5165-11ec-a2c3-3e22fbd008af
+version: 1
+date: '2021-11-29'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic leverages Event ID 7045, `A new service was installed in the system`, 
+ to identify the installation of a Windows Service with a suspicious, high entropy, Service Name. To achieve this,
+ this analytic also leverages the `ut_shannon` function from the URL ToolBox Splunk application.
+ Red teams and adversaries alike may abuse the Service Control Manager to create and start a remote Windows Service
+ and obtain remote code execution. To achieve this goal, some tools like Metasploit, Cobalt Strike and Impacket,
+ typically create a Windows Service with a random service name on the victim host. This hunting analytic may help
+ defenders identify Windows Services installed as part of a lateral movement attack. The entropy threshold `ut_shannon > 3` 
+ should be customized by users. The Service_File_Name field can be used to determine if the Windows Service has malicious intent or not. 
+search: ' `wineventlog_system` EventCode=7045  
+| lookup ut_shannon_lookup word as Service_Name
+| where ut_shannon > 3
+| table EventCode ComputerName Service_Name ut_shannon Service_Start_Type Service_Type Service_File_Name | `randomly_generated_windows_service_name_filter` '
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the Service name, Service File Name Service Start type, and Service Type
+  from your endpoints. The Windows TA as well as the URL ToolBox application are also
+  required.
+known_false_positives: Legitimate applications may use random Windows Service names.
+references:
+- https://attack.mitre.org/techniques/T1543/003/ 
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  kill_chain_phases:
+  - Privilege Escalation
+  - Lateral Movement
+  mitre_attack_id:
+  - T1543
+  - T1543.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - ComputerName
+  - Service_File_Name
+  - Service_Type
+  - Service_Name
+  - Service_Start_Type
+  security_domain: endpoint
+  impact: 90
+  confidence: 50
+  risk_score: 45
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: A Windows Service with a suspicious service name was installed on $ComputerName$
+  observable:
+  - name: Service_File_Name
+    type: Other
+    role:
+    - Other
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml b/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml
index 512846226c..d9c7c0dda1 100644
--- a/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml
+++ b/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml
@@ -28,7 +28,7 @@ references: []
 tags:
   analytic_story:
   - Hidden Cobra Malware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml b/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml
new file mode 100644
index 0000000000..0072e766ee
--- /dev/null
+++ b/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml
@@ -0,0 +1,70 @@
+name: Unusual Number of Computer Service Tickets Requested
+id: ac3b81c0-52f4-11ec-ac44-acde48001122
+version: 1
+date: '2021-12-01'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic leverages Event ID 4769, `A Kerberos service ticket was requested`, 
+ to identify an unusual number of computer service ticket requests from one source. When a domain joined endpoint connects 
+ to a remote endpoint, it first will request a Kerberos Ticket with the computer name as the Service Name. An endpoint
+ requesting a large number of computer service tickets for different endpoints could represent malicious behavior like 
+ lateral movement, malware staging, reconnaissance, etc.\
+
+ The detection calculates the standard deviation for each host and leverages the
+ 3-sigma statistical rule to identify an unusual number of service requests. To customize this
+ analytic, users can try different combinations of the `bucket` span time,  the
+ calculation of the `upperBound` field as well as the Outlier calculation. 
+ This logic can be used for real time security monitoring as well as threat hunting exercises.\
+
+search: ' `wineventlog_security` EventCode=4769 Service_Name="*$" Account_Name!="*$*"
+| bucket span=2m _time 
+| stats dc(Service_Name) AS unique_targets values(Service_Name) as host_targets by _time, Client_Address, Account_Name
+| eventstats avg(unique_targets) as comp_avg , stdev(unique_targets) as comp_std by Client_Address, Account_Name
+| eval upperBound=(comp_avg+comp_std*3)
+| eval isOutlier=if(unique_targets >10 and unique_targets >= upperBound, 1, 0)
+| `unusual_number_of_computer_service_tickets_requested_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+known_false_positives: An single endpoint requesting a large number of computer service tickets 
+  is not common behavior. Possible false positive scenarios include but are not limited
+  to vulnerability scanners, administration systeams and missconfigured systems.
+references:
+- https://attack.mitre.org/techniques/T1078/
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  kill_chain_phases:
+  - Reconnaissance
+  - Exploitation
+  - Lateral Movement
+  mitre_attack_id:
+  - T1078
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Ticket_Options
+  - Ticket_Encryption_Type
+  - dest
+  - service
+  - service_id
+  security_domain: endpoint
+  impact: 70
+  confidence: 60
+  risk_score: 42
+  context:
+  - Source:Endpoint
+  - Stage:Lateral Movement
+  message: 
+  observable:
+  - name: Client_Address
+    type: Endpoint
+    role:
+    - Victim
+  
\ No newline at end of file
diff --git a/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml b/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml
new file mode 100644
index 0000000000..0fc6e072e6
--- /dev/null
+++ b/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml
@@ -0,0 +1,70 @@
+name: Unusual Number of Remote Endpoint Authentication Events
+id: acb5dc74-5324-11ec-a36d-acde48001122
+version: 1
+date: '2021-12-01'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic leverages Event ID 4624, `An account was successfully logged on`, 
+ to identify an unusual number of remote authentication attempts coming from one source. An endpoint
+ authenticating to a large number of remote endpoints could represent malicious behavior like 
+ lateral movement, malware staging, reconnaissance, etc.\
+
+ The detection calculates the standard deviation for each host and leverages the
+ 3-sigma statistical rule to identify an unusual high number of authentication events. To customize this
+ analytic, users can try different combinations of the `bucket` span time,  the
+ calculation of the `upperBound` field as well as the Outlier calculation. 
+ This logic can be used for real time security monitoring as well as threat hunting exercises.\
+
+search: ' `wineventlog_security` EventCode=4624 Logon_Type=3 Account_Name!="*$"
+| eval Source_Account = mvindex(Account_Name, 1) 
+| bucket span=2m _time 
+| stats dc(ComputerName) AS unique_targets values(ComputerName) as target_hosts by _time, Source_Network_Address, Source_Account
+| eventstats avg(unique_targets) as comp_avg , stdev(unique_targets) as comp_std by Source_Network_Address, Source_Account
+| eval upperBound=(comp_avg+comp_std*3)
+| eval isOutlier=if(unique_targets >10 and unique_targets >= upperBound, 1, 0)
+ `unusual_number_of_remote_endpoint_authentication_events_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Event Logs from domain controllers aas well as member servers and workstations.
+  The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
+  to be enabled.
+known_false_positives: An single endpoint authenticating to a large number of hosts 
+  is not common behavior. Possible false positive scenarios include but are not limited
+  to vulnerability scanners, jump servers and missconfigured systems.
+references:
+- https://attack.mitre.org/techniques/T1078/
+tags:
+  analytic_story:
+  - Active Directory Lateral Movement
+  kill_chain_phases:
+  - Reconnaissance
+  - Lateral Movement
+  mitre_attack_id:
+  - T1078
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Logon_Type
+  - Caller_Process_Name
+  - Security_ID
+  - Account_Name
+  - ComputerName
+  security_domain: endpoint
+  impact: 70
+  confidence: 60
+  risk_score: 42
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  - Stage:Lateral Movement
+  message: 
+  observable:
+  - name: ComputerName
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/experimental/network/remote_desktop_network_traffic.yml b/detections/experimental/network/remote_desktop_network_traffic.yml
index a3148b01dd..e08cb53592 100644
--- a/detections/experimental/network/remote_desktop_network_traffic.yml
+++ b/detections/experimental/network/remote_desktop_network_traffic.yml
@@ -32,7 +32,7 @@ tags:
   - SamSam Ransomware
   - Ryuk Ransomware
   - Hidden Cobra Malware
-  - Lateral Movement
+  - Active Directory Lateral Movement
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/requirements.txt b/requirements.txt
index 0c33c9467b..81f151cd5b 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -8,12 +8,12 @@ CacheControl==0.12.10
 certifi==2021.10.8
 cfgv==3.3.1
 chardet==4.0.0
-charset-normalizer==2.0.7
+charset-normalizer==2.0.9
 colorama==0.4.4
 coloredlogs==15.0.1
 configparser==5.2.0
 contextlib2==21.6.0
-distlib==0.3.3
+distlib==0.3.4
 distro==1.6.0
 filelock==3.4.0
 fire==0.4.0
@@ -38,7 +38,7 @@ pendulum==2.1.2
 pep517==0.12.0
 Pillow==8.4.0
 platformdirs==2.4.0
-pre-commit==2.14.1
+pre-commit==2.16.0
 progress==1.6
 prompt-toolkit==1.0.14
 pycvesearch==1.0.1
@@ -57,7 +57,7 @@ requests==2.26.0
 retrying==1.3.3
 scandir==1.10.0
 semantic-version==2.8.5
-simplejson==3.17.5
+simplejson==3.17.6
 six==1.16.0
 sly==0.4
 smmap==5.0.0
diff --git a/stories/lateral_movement.yml b/stories/active_directory_lateral_movement.yml
similarity index 76%
rename from stories/lateral_movement.yml
rename to stories/active_directory_lateral_movement.yml
index b245f947c7..c54c881974 100644
--- a/stories/lateral_movement.yml
+++ b/stories/active_directory_lateral_movement.yml
@@ -1,19 +1,20 @@
-name: Lateral Movement
+name: Active Directory Lateral Movement
 id: 399d65dc-1f08-499b-a259-aad9051f38ad
-version: 2
-date: '2021-11-23'
+version: 3
+date: '2021-12-09'
 author: David Dorsey, Mauricio Velazco Splunk
 description: Detect and investigate tactics, techniques, and procedures around how
-  attackers move laterally within the enterprise. Because lateral movement can expose
-  the adversary to detection, it should be an important focus for security analysts.
+  attackers move laterally within an Active Directory environment. Since lateral movement 
+  is often a necessary step in a breach, it is important for cyber defenders to deploy 
+  detection coverage.
 narrative: "Once attackers gain a foothold within an enterprise, they will seek to\
   \ expand their accesses and leverage techniques that facilitate lateral movement.\
   \ Attackers will often spend quite a bit of time and effort moving laterally. Because\
   \ lateral movement renders an attacker the most vulnerable to detection, it's an\
   \ excellent focus for detection and investigation.\\\nIndications of lateral movement\
-  \ can include the abuse of system utilities (such as `psexec.exe`), unauthorized\
-  \ use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash,\
-  \ or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting\
+  \ in an Active Directory network can include the abuse of system utilities (such as `psexec.exe`), unauthorized\
+  \ use of remote desktop services, `file/admin$` shares, WMI, PowerShell, Service Control Manager,\
+  \ the DCOM protocol, WinRM or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting\
   \ lateral movement techniques and look for suspicious activity in and around high-value\
   \ strategic network assets, such as Active Directory, which are often considered\
   \ the primary target or \"crown jewels\" to a persistent threat actor.\\\nAn adversary\
@@ -32,9 +33,9 @@ narrative: "Once attackers gain a foothold within an enterprise, they will seek
   \ for all processes to ensure that the attackers did not install unauthorized software."
 references:
 - https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html
-- https://www.youtube.com/watch?v=hVTkkkM9XDg
+- http://www.irongeek.com/i.php?page=videos/derbycon7/t405-hunting-lateral-movement-for-fun-and-profit-mauricio-velazco
 tags:
-  analytic_story: Lateral Movement
+  analytic_story: Active Directory Lateral Movement
   category:
   - Adversary Tactics
   product:
diff --git a/tests/endpoint/possible_lateral_movement_powershell_spawn.test.yml b/tests/endpoint/possible_lateral_movement_powershell_spawn.test.yml
new file mode 100644
index 0000000000..96d82a8249
--- /dev/null
+++ b/tests/endpoint/possible_lateral_movement_powershell_spawn.test.yml
@@ -0,0 +1,12 @@
+name: Possible Lateral Movement PowerShell Spawn Unit Test
+tests:
+- name: Possible Lateral Movement PowerShell Spawn
+  file: endpoint/possible_lateral_movement_powershell_spawn.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/lateral_movement_powershell/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/short_lived_scheduled_task.test.yml b/tests/endpoint/short_lived_scheduled_task.test.yml
new file mode 100644
index 0000000000..5cc0192b87
--- /dev/null
+++ b/tests/endpoint/short_lived_scheduled_task.test.yml
@@ -0,0 +1,12 @@
+name: Short Lived Scheduled Task Unit Test
+tests:
+- name: Short Lived Scheduled Task
+  file: endpoint/short_lived_scheduled_task.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/lateral_movement/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
\ No newline at end of file
diff --git a/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml b/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml
new file mode 100644
index 0000000000..0127db21ec
--- /dev/null
+++ b/tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml
@@ -0,0 +1,10 @@
+name: BCDEdit Failure Recovery Modification - SSA Unit Test
+tests:
+  - name: BCDEdit Failure Recovery Modification
+    file: endpoint/ssa___bcdedit_failure_recovery_modification.yml
+    pass_condition: '@count_gt(0)'
+    description: Test detection of BCDEdit Failure Recovery Modification
+    attack_data:
+      - file_name: windows-sysmon.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+        source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
diff --git a/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml b/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml
new file mode 100644
index 0000000000..26bdade65a
--- /dev/null
+++ b/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml
@@ -0,0 +1,9 @@
+name: Detect RClone Command-Line Usage Unit Test
+tests:
+- name: Detect RClone Command-Line Usage
+  file: endpoint/ssa___detect_rclone_command_line_usage.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
diff --git a/tests/endpoint/ssa___dns_exfiltration_using_nslookup_app.test.yml b/tests/endpoint/ssa___dns_exfiltration_using_nslookup_app.test.yml
new file mode 100644
index 0000000000..cb4664986f
--- /dev/null
+++ b/tests/endpoint/ssa___dns_exfiltration_using_nslookup_app.test.yml
@@ -0,0 +1,9 @@
+name: DNS Exfiltration Using Nslookup App Unit Test
+tests:
+- name: DNS Exfiltration Using Nslookup App
+  file: endpoint/ssa_dns_exfiltration_using_nslookup_app.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
diff --git a/tests/endpoint/ssa___fsutil_zeroing_file.test.yml b/tests/endpoint/ssa___fsutil_zeroing_file.test.yml
new file mode 100644
index 0000000000..11edb21baf
--- /dev/null
+++ b/tests/endpoint/ssa___fsutil_zeroing_file.test.yml
@@ -0,0 +1,10 @@
+name: FSUtil Zeroing File - SSA Unit Test
+tests:
+  - name: FSUtil Zeroing File
+    file: endpoint/ssa___fsutil_zeroing_file.yml
+    pass_condition: '@count_gt(0)'
+    description: Test detection of FSUtil Zeroing File
+    attack_data:
+    - file_name: windows-sysmon.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log
+      source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
diff --git a/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml b/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml
new file mode 100644
index 0000000000..84a6b071df
--- /dev/null
+++ b/tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml
@@ -0,0 +1,10 @@
+name: WBAdmin Delete System Backups - SSA Unit Test
+tests:
+  - name: WBAdmin Delete System Backups
+    file: endpoint/ssa___wbadmin_delete_system_backups.yml
+    pass_condition: '@count_gt(0)'
+    description: Test detection of WBAdmin Delete System Backups
+    attack_data:
+      - file_name: windows-sysmon.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
+        source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml b/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml
new file mode 100644
index 0000000000..57cd2b8000
--- /dev/null
+++ b/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml
@@ -0,0 +1,9 @@
+name: Windows Curl Upload to Remote Destination Unit Test
+tests:
+- name: Windows Curl Upload to Remote Destination
+  file: endpoint/ssa___windows_curl_upload_to_remote_destination.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: windows-sysmon_curl_upload.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file