Merge branch 'develop' into analytic_types

2026-06-08 17:32:49 +00:00 · 2021-08-10 11:02:18 +02:00
parent 59dc3ee87f da6a9c2d0f
commit 6607ca9508
117 changed files with 38136 additions and 28931 deletions
@@ -1,7 +1,7 @@
 variables:
  GIT_SUBMODULE_STRATEGY: recursive
  K8S_PLAYGROUND_ROLE: k8s:v1/app-play1/namespace/threat-research/role/deployer
-  K8S_STAGING_ROLE: k8s:v1/app-stage1/namespace/tr-st-deploy/role/deployer
+  K8S_GSTAGING_ROLE: k8s:v1/kube-wicket-iad10/namespace/tr-st-deploy/role/deployer
  DOCKER_ROLE: docker:v1/registry/prefix/threat-research
  K8_DEPLOYER_CONTAINER: docker.repo.splunkdev.net/threat-research/k8-deployer
  SMOKETEST_RUNNER: docker.repo.splunkdev.net/threat-research/smoketest-runner
@@ -48,13 +48,13 @@ smoketest_staging:
    - publish_deployer
  image: ${K8_DEPLOYER_CONTAINER}:${CI_COMMIT_SHORT_SHA}
  script:
-    - eval $(go-go vault -a ${K8S_STAGING_ROLE})
+    - eval $(go-go vault -a ${K8S_GSTAGING_ROLE})
    - eval $(go-go vault -a ${DOCKER_ROLE})
    - cd /deployer/k8s
    - ./deployer.sh
    - ./check_deploy_status.sh
  variables:
-    SCSENV: app_staging1
+    SCSENV: app_gstaging1
    SMOKETEST_RUNNER_IMAGE: ${SMOKETEST_RUNNER}:${CI_COMMIT_SHORT_SHA}
  only:
    - /^ssa.*$/
@@ -340,8 +340,8 @@ def add_rba(detection):
    #     detection['risk_object'] = detection['tags']['risk_object']
    # if 'risk_object_type' in detection['tags']:
    #    detection['risk_object_type'] = detection['tags']['risk_object_type']
-    if 'risk_score' in detection['tags']:
-        detection['risk_score'] = detection['tags']['risk_score']
+    # if 'risk_score' in detection['tags']:
+    #     detection['risk_score'] = detection['tags']['risk_score']

    # grab risk message
    if 'message' in detection['tags']:
@@ -350,31 +350,34 @@ def add_rba(detection):
    risk_objects = []
    risk_object_user_types = {'user', 'username', 'email address'}
    risk_object_system_types = {'device', 'endpoint', 'hostname', 'ip address'}
-    if 'observable' in detection['tags']:
+    if 'observable' in detection['tags'] and 'risk_score' in detection['tags']:
+
        # go through each obervable
        for entity in detection['tags']['observable']:
+
            risk_object = dict()

-            # determine if is a user type
+            # determine if is a user type, create risk
            if entity['type'].lower() in risk_object_user_types:
-                risk_object['risk_object_type'] = 'user'
-                detection['risk_object_type'] = 'user'
+                
                for r in entity['role']:
                    if 'attacker' == r.lower():
-                        # if the role is an attacker this entity is also a threat object
-                        risk_object['threat_object_field'] = entity['name']
-                        risk_object['threat_object_type'] = entity['type'].lower()
+
+                        risk_object['risk_object_type'] = 'user'
+                        risk_object['risk_object_field'] = entity['name']
+                        risk_object['risk_score'] = detection['tags']['risk_score']
+
                        risk_objects.append(risk_object)

-            # determine if is a system type
+            # determine if is a system type, create risk
            elif entity['type'].lower() in risk_object_system_types:
-                risk_object['risk_object_type'] = 'system'
-                detection['risk_object_type'] = 'system'
+                
                for r in entity['role']:
                    if 'attacker' == r.lower():
-                        # if the role is an attacker this entity is also a threat object
-                        risk_object['threat_object_field'] = entity['name']
-                        risk_object['threat_object_type'] = entity['type'].lower()
+                        
+                        risk_object['risk_object_type'] = 'system'
+                        risk_object['risk_object_field'] = entity['name']
+                        risk_object['risk_score'] = detection['tags']['risk_score']
                        risk_objects.append(risk_object)

            # if is not a system or user, it is a threat object
@@ -384,11 +387,8 @@ def add_rba(detection):
                risk_objects.append(risk_object)
                continue

-            detection['risk_object'] = entity['name']
-            risk_object['risk_object_field'] = entity['name']
-            risk_object['risk_score'] = detection['risk_score']
-            risk_objects.append(risk_object)
    detection['risk'] = risk_objects
+    
    return detection

 def prepare_detections(detections, deployments, OUTPUT_PATH):
@@ -45,11 +45,8 @@ action.escu.providing_technologies = []
 {% endif %}
 {% if detection.tags.analytic_story is defined %}
 action.escu.analytic_story = {{ detection.tags.analytic_story | tojson }}
-{% if detection.risk_score is defined %}
+{% if detection.tags.risk_score is defined %}
 action.risk = 1
-action.risk.param._risk_object = {{ detection.risk_object }}
-action.risk.param._risk_object_type = {{ detection.risk_object_type }}
-action.risk.param._risk_score = {{ detection.risk_score }}
 action.risk.param._risk_message = {{ detection.risk_message }}
 action.risk.param._risk = {{ detection.risk | tojson }}
 action.risk.param.verbose = 0
@@ -5,7 +5,7 @@ local base = import './base.libsonnet';
 base {
  components +: {
    serviceAccountName: "sa-tr-staging",
-    vaultReadPath: 'scpauth-app-stage1/token/threat-research-test.app-stage1',
+    vaultReadPath: 'scpauth-kube-wicket-iad10/token/threat-research-test.app-gstage1',
    tenant: 'research',
    dspEnv: 'staging',
  }
@@ -6,7 +6,7 @@ local env = std.extVar('qbec.io/env');
 local paramsMap = {
  _: import './environments/base.libsonnet',
  app_play1: import './environments/smoke-test-playground.libsonnet',
-  app_staging1: import './environments/smoke-test-staging.libsonnet',
+  app_gstaging1: import './environments/smoke-test-gstaging.libsonnet',
 };

 if std.objectHas(paramsMap, env) then paramsMap[env] else error 'environment ' + env + ' not defined in ' + std.thisFile
@@ -7,9 +7,9 @@ spec:
    app_play1:
      defaultNamespace: threat-research
      server: https://internal.api.app-play1.dev.us-west-2.splunk8s.io
-    app_staging1:
+    app_gstaging1:
      defaultNamespace: tr-st-deploy
-      server: https://internal.api.app-stage1.stage.us-west-2.splunk8s.io
+      server: https://internal.api.kube-wicket-iad10.stage.splunk8s.io
  vars:
    external:
      - name: SCBRANCH
@@ -35,6 +35,7 @@ class GithubService:
        branch2 = 'develop'
        g = git.Git('security_content')
        changed_ssa_test_files = []
+        ci_changes = False

        if branch1 != 'develop':
            differ = g.diff('--name-only', branch1, branch2)
@@ -55,6 +56,10 @@ class GithubService:
                        if file_path_new not in changed_ssa_test_files:
                            changed_ssa_test_files.append(file_path_new)

+                # changed CI code
+                if file_path == '.gitlab-ci.yml' or file_path.startswith('bin/ssa-end-to-end-testing'):
+                    ci_changes = True
+
        # all SSA test files for nightly build
        else:
            changed_files = sorted(glob.glob('security_content/tests/*/*.yml'))
@@ -64,7 +69,11 @@ class GithubService:
                if os.path.basename(file_path).startswith('ssa'):
                    changed_ssa_test_files.append(file_path)

-        return changed_ssa_test_files
+                # changed CI code
+                if file_path == '.gitlab-ci.yml' or file_path.startswith('bin/ssa-end-to-end-testing'):
+                    ci_changes = True
+
+        return changed_ssa_test_files, ci_changes



@@ -8,6 +8,9 @@ import logging
 import os
 import uuid
 import requests
+import time
+import base64
+import json

 from http import HTTPStatus
 #from constants import ML_MODEL_CONNECTOR_UUID
@@ -21,7 +24,7 @@ LOGGER = logging.getLogger(__name__)
 TENANT_PLAYGROUND = f"research2"
 TENANT_STAGING = f"research"
 BASE_URL_PLAYGROUND = f"https://api.playground.scp.splunk.com/"
-BASE_URL_STAGING = f"https://api.staging.scp.splunk.com/"
+BASE_URL_STAGING = f"https://api.staging.scs.splunk.com/"

 # Streaming Pipelines REST endpoints
 CONNECTIONS_ENDPOINT = f"streams/v3beta1/connections"
@@ -36,13 +39,41 @@ SUBMIT_SEARCH_ENDPOINT = f"search/v2beta1/jobs"
 DATASETS_ENDPOINT = f"catalog/v2beta1/datasets"


+class ApiError(Exception):
+    pass
+
+
 class DSPApi:

-    def __init__(self, env, tenant, header_token):
+    def __init__(self, env, tenant, token):
        self.env = env
        self.tenant = tenant
-        self.header_token = header_token
+        self.header_token = f"Bearer {token}"
+        self.validate_token()

+    def validate_token(self):
+        def decode(s):
+            def pad(t):
+                return t + '=' * (len(t) % 4)
+            return json.loads(base64.b64decode(pad(s)))
+
+        token = self.header_token.split()[1]
+        header, payload, signature = token.split('.')
+        payload_data = decode(payload)
+        for k in sorted(payload_data.keys()):
+            LOGGER.info(f"token.payload.{k} = %s", payload_data[k])
+
+        valid_for = payload_data['exp'] - int(time.time())
+        if not valid_for > 0:
+            raise ApiError("Token is expired")
+
+        token_env = payload_data['iss'].split('.')[-4]
+        if self.env != token_env:
+            raise ApiError(f"Env {self.env} was specified but token is for {token_env}")
+
+        token_tenant = payload_data['tenant']
+        if self.tenant != token_tenant:
+            raise ApiError(f"Tenant {self.tenant} was specified but token is for {token_tenant}")

    def return_api_endpoint(self, endpoint):
        if self.env == 'playground':
@@ -70,10 +101,11 @@ class DSPApi:
        #LOGGER.info(f"{spl}")
        response = requests.post(self.return_api_endpoint(PIPELINES_COMPILE_ENDPOINT), json=data, headers=request_headers(self.header_token))
        upl = response.json()
-        #LOGGER.info(f"POST compile response_body is: {upl}")
-        LOGGER.info(f"Successfully compile spl to upl")
-        return upl, response
-
+        if response.status_code == HTTPStatus.OK:
+            LOGGER.info(f"Successfully compiled spl to upl")
+            return upl
+        else:
+            LOGGER.error("SPL compilation failed: %s", response.text)

    def validate_upl(self, upl):
        """
@@ -93,13 +125,12 @@ class DSPApi:
        headers = {"Content-Type": "application/json", "Authorization": self.header_token}
        data = {"upl": upl}
        response = requests.post(self.return_api_endpoint(PIPELINES_VALIDATE_ENDPOINT), json=data, headers=headers)
-        response_body = response.json()
+
        if response.status_code == HTTPStatus.OK:
            LOGGER.info(f"UPL is validated.")
-            return upl, response_body
+            return upl
        else:
-            LOGGER.error(f"UPL validation failed: {response_body}")
-            return response_body
+            LOGGER.error("UPL validation failed: %s", response.text)


    def get_pipelines(self):
@@ -141,6 +172,7 @@ class DSPApi:
            "name": f"ssa_smoke_test_pipeline_helper_{set_test_id}",
            "description": "ssa_test_pipeline_description",
            "bypassValidation": "true",
+            "labels": {"app": "ba"},
            "data": upl
        }
        response = requests.post(self.return_api_endpoint(PIPELINES_ENDPOINT), json=data, headers=headers)
@@ -149,6 +181,8 @@ class DSPApi:
            pipeline_id = response_body.get("id")
            #LOGGER.info(f"Pipeline {pipeline_id} successfully created")
            return pipeline_id
+        else:
+            LOGGER.error(f"Failed to create pipeline: %s", response.text)


    def create_pipeline_from_spl(self, spl):
@@ -156,8 +190,8 @@ class DSPApi:
        helper function to compile and validate from spl text, then create the pipeline

        """
-        upl, _ = self.compile_spl(spl)
-        validated_upl, _ = self.validate_upl(upl)
+        upl = self.compile_spl(spl)
+        validated_upl = self.validate_upl(upl)
        pipeline_id = self.create_pipeline(validated_upl)
        LOGGER.info(f"pipeline id created is: {pipeline_id}")
        return pipeline_id
@@ -182,6 +216,7 @@ class DSPApi:

        headers = {"Content-Type": "application/json", "Authorization": self.header_token}
        pipelines_activate_endpoint = self.return_api_endpoint(PIPELINES_ENDPOINT) + "/" + pipeline_id + "/activate"
+        pipelines_status_endpoint = self.return_api_endpoint(PIPELINES_ENDPOINT) + "/" + pipeline_id

        data = {
            "activateLatestVersion": "true",
@@ -189,16 +224,35 @@ class DSPApi:
            "skipRestoreState": "true"
        }

+        pipeline_activated = False
+        attempts_remaining = 30
+
        response = requests.post(pipelines_activate_endpoint, json=data, headers=headers)
-        response_body = response.json()

        if response.status_code == HTTPStatus.OK:
-            pipeline_id = response_body.get("activated")
-            LOGGER.info(f"Pipeline {pipeline_id} successfully activated")
-        else:
-            LOGGER.error(f"Failed to activate pipeline {pipeline_id}: {response.text}")
+            while attempts_remaining:
+                attempts_remaining -= 1
+                pipeline_status_response = requests.get(pipelines_status_endpoint, headers=headers)
+                if pipeline_status_response.status_code == HTTPStatus.OK:
+                    pipeline_status = pipeline_status_response.json()
+                    status = pipeline_status['status']
+                    if status == 'ACTIVATED':
+                        pipeline_activated = True
+                        LOGGER.info(f"Pipeline {pipeline_id} successfully activated")
+                        break
+                    else:
+                        LOGGER.warning("Current pipeline activation status for %s: %s", pipeline_id, status)
+                else:
+                    LOGGER.error("Failed to check pipeline status for %s: %s", pipeline_id, pipeline_status_response.text)

-        return response_body
+                if attempts_remaining:
+                    time.sleep(60)
+                else:
+                    LOGGER.error("Got tired of waiting for the pipeline to activate")
+        else:
+            LOGGER.error("Failed to request pipeline activation for %: %s", pipeline_id, response.text)
+
+        return pipeline_activated


    def deactivate_pipeline(self, pipeline_id):
@@ -368,8 +422,8 @@ class DSPApi:

        """

-        upl, _ = self.compile_spl(spl)
-        validated_upl, _ = self.validate_upl(upl)
+        upl = self.compile_spl(spl)
+        validated_upl = self.validate_upl(upl)
        preview_id = self.get_preview_id(validated_upl)
        LOGGER.info(f"preview id created is: {preview_id}")
        return preview_id
@@ -390,11 +444,15 @@ class DSPApi:
            response body in JSON format
        """
        data = [{
-            "body": data,
+            "body": event,
            "sourcetype": "WinEventLog"
-            }]
+            } for event in data]
        response = requests.post(self.return_api_endpoint(INGEST_ENDPOINT), json=data, headers=request_headers(self.header_token))
-        return response.json()
+        if response.status_code != HTTPStatus.OK:
+            LOGGER.error(f"Failed to upload data: %s", response.text)
+            return False
+
+        return True


    def submit_search_job(self, module, query):
@@ -420,7 +478,7 @@ class DSPApi:
        LOGGER.info(f"Submit Search Job")
        response = requests.post(self.return_api_endpoint(SUBMIT_SEARCH_ENDPOINT), json=data, headers=request_headers(self.header_token))
        if response.status_code != HTTPStatus.CREATED:
-            LOGGER.error(f"Submit search job failed.")
+            LOGGER.error(f"Submit search job failed: %s", response.text)
            return None
        else:
            response_body = response.json()
@@ -17,20 +17,19 @@ SLEEP_TIME_CREATE_INDEX = 10
 SLEEP_TIME_ACTIVATE_PIPELINE = 10
 SLEEP_TIME_SEND_DATA = 30
 WAIT_CYCLE = 20
-MAX_EXECUTION_TIME_LIMIT = 300  # per detection test
+MAX_EXECUTION_TIME_LIMIT = 600  # per detection test

 TEST_DATASET = 'windows-security_small.txt'


 class SSADetectionTesting:

-    def __init__(self, env, tenant, header_token):
+    def __init__(self, env, tenant, token):
        self.execution_passed = True
        self.max_execution_time = MAX_EXECUTION_TIME_LIMIT
        self.env = env
        self.tenant = tenant
-        self.header_token = f"Bearer {header_token}"
-        self.api = DSPApi(env, tenant, self.header_token)
+        self.api = DSPApi(env, tenant, token)
        self.test_results = {}

    def test_dsp_pipeline(self):
@@ -121,15 +120,21 @@ class SSADetectionTesting:
        spl = manipulate_spl(self.api.env, spl, self.results_index)
        assert spl is not None, "fail to manipulate spl file"

-        pipeline_id = self.api.create_pipeline_from_spl(spl)
+        upl = self.api.compile_spl(spl)
+        assert upl is not None, "failed to compile spl"
+
+        validated_upl = self.api.validate_upl(upl)
+        assert validated_upl is not None, "failed to validate upl"
+
+        pipeline_id = self.api.create_pipeline(validated_upl)
        assert pipeline_id is not None, "failed to create a pipeline"

        _pipeline_status = self.api.pipeline_status(pipeline_id)
        assert _pipeline_status == "CREATED", f"Current status of pipeline {pipeline_id} should be CREATED"
        self.created_pipelines.append(pipeline_id)

-        response_body = self.api.activate_pipeline(pipeline_id)
-        assert response_body.get("activated") == pipeline_id, f"pipeline {pipeline_id} should be successfully activate."
+        pipeline_activated = self.api.activate_pipeline(pipeline_id)
+        assert pipeline_activated, f"pipeline {pipeline_id} should be activated."
        self.activated_pipelines.append(pipeline_id)

        self.wait_time(SLEEP_TIME_ACTIVATE_PIPELINE)
@@ -145,8 +150,8 @@ class SSADetectionTesting:

        assert len(data) > 0, "No events to send, skip to next test."

-        for d in data:
-            response_body = self.api.ingest_data(d)
+        data_uploaded = self.api.ingest_data(data)
+        assert data_uploaded, "Failed to upload test data"

        self.wait_time(SLEEP_TIME_SEND_DATA)

@@ -197,7 +202,7 @@ class SSADetectionTesting:
        self.activated_pipelines = [p for p in self.activated_pipelines if not deactivate_pipeline(p)]
        self.created_pipelines = [p for p in self.created_pipelines if not delete_pipeline(p)]
        if len(self.activated_pipelines) > 0 or len(self.created_pipelines) > 0 or not delete_index(self.results_index):
-            LOGGER.warning("Not all SCS resources fred up")
+            LOGGER.warning("Not all SCS resources freed up")
            LOGGER.info(f"Created Pipelines: {','.join(self.created_pipelines)}")
            LOGGER.info(f"Active Pipelines: {','.join(self.activated_pipelines)}")
            LOGGER.info(f"Result Indexes: {self.results_index}")
@@ -14,12 +14,11 @@ LOGGER = logging.getLogger(__name__)
 # Macros
 PULSAR_SOURCE_CONNECTION_ID_PLAYGROUND = f"29fb61f1-9342-48f5-9793-1afa008c377b"
 PULSAR_SOURCE_TOPIC_PLAYGROUND = f"persistent://ssa/egress/decorated-events-research2"
-PULSAR_SOURCE_CONNECTION_ID_STAGING = f"b8c81601-a7e0-4501-802c-cb2831c72b6f"
+PULSAR_SOURCE_CONNECTION_ID_STAGING = f"d156ed3a-1254-469a-bffc-9dd6eda97ac6"
 PULSAR_SOURCE_TOPIC_STAGING = f"persistent://ssa/egress/decorated-events-research"

-READ_SSA_ENRICHED_EVENTS = f"| from read_ssa_enriched_events()"
 READ_SSA_ENRICHED_EVENTS_EXPANDED = (
-    f"| from pulsar(\"__PULSAR_SOURCE_CONNECTION_ID__\", \"__PULSAR_SOURCE_TOPIC__\")"
+    f"pulsar(\"__PULSAR_SOURCE_CONNECTION_ID__\", \"__PULSAR_SOURCE_TOPIC__\")"
    f"| eval input_event=deserialize_json_object(value)"
    f"| select input_event"
    f"| eval _datamodels=ucast(map_get(input_event, \"_datamodels\"), \"collection<string>\", [])"
@@ -29,7 +28,6 @@ READ_SSA_ENRICHED_EVENTS_EXPANDED = (
 # not used in the moment
 # PULSAR_SINK_CONNECTION_ID = f"29fb61f1-9342-48f5-9793-1afa008c377b"
 # PULSAR_SINK_TOPIC = f"persistent://ssa/ingress/detection-events-research2"
-WRITE_SSA_DETECTED_EVENTS = f"| into write_ssa_detected_events();"

 # ## dummy values ##
 # DETECTION_TYPE = f"anomaly"
@@ -87,11 +85,12 @@ def manipulate_spl(env, spl, results_index):
        .replace("__PULSAR_SOURCE_CONNECTION_ID__", pulsar_source_connection_id)\
        .replace("__PULSAR_SOURCE_TOPIC__", pulsar_source_topic)
    # Obtain the test sink
-    sink = ";"
    if results_index is not None:
        module = results_index["module"]
        index = results_index["name"]
-        sink = f"| into index(\"{module}\", \"{index}\");"
+        sink = f"index(\"{module}\", \"{index}\")"
+    else:
+        sink = "write_null()"
    # Replace spl template with its `source` and `sink`
    spl = replace_ssa_macros(source, sink, spl)
    LOGGER.info(f"spl: {spl}")
@@ -105,8 +104,8 @@ def read_spl(file_path, file_name):


 def replace_ssa_macros(source, sink, spl):
-    spl = spl.replace(READ_SSA_ENRICHED_EVENTS, source)
-    spl = spl.replace(WRITE_SSA_DETECTED_EVENTS, sink)
+    spl = re.sub(r'read_ssa_enriched_events\(\s*\)', source, spl, flags=re.IGNORECASE)
+    spl = re.sub(r'write_ssa_detected_events\(\s*\)', sink, spl, flags=re.IGNORECASE)
    return spl


@@ -121,7 +120,7 @@ def read_data(file_path):
    tmp_counter = 0
    for line in fileinput.input(files=modified_file):
        i = i + 1
-        if event != "" and re.match(date_rex, line):
+        if event.strip() != "" and re.match(date_rex, line):
            data.append(event)
            tmp_counter = 0
            event = line
@@ -39,22 +39,30 @@ def main(args):

    # Retrieve Security Content
    github_service = GithubService(branch)
+    ci_changes = False
    if test_file:
        if not os.path.isfile('security_content/tests/' + test_file):
            LOGGER.error('Can not find specified test file')
            sys.exit(1)
        test_files_ssa = [str("tests/" + test_file)]
    else:
-        test_files_ssa = github_service.get_changed_test_files_ssa()
+        test_files_ssa, ci_changes = github_service.get_changed_test_files_ssa()
    
    LOGGER.info('changed/added GitHub files:')
    for test_file in test_files_ssa:
        LOGGER.info(test_file)

-    if len(test_files_ssa) == 0:
+    if ci_changes:
+        LOGGER.info('CI code has changed')
+
+    if len(test_files_ssa) == 0 and not ci_changes:
        LOGGER.info('Nothing to test for SSA smoke test.')
        sys.exit(0)

+    if len(test_files_ssa) == 0 and ci_changes and fast:
+        LOGGER.error('Cannot test CI changes since no detections/tests have changed and running in fast mode.')
+        sys.exit(-1)
+
    # test DSP and SSA pipeline
    ssa_detection_testing = SSADetectionTesting(env, tenant, token)
    if not fast:
@@ -0,0 +1,108 @@
+import os
+import sys
+import base64
+import configparser
+import time
+import yaml
+import argparse
+from modules.ssa_utils import *
+from modules.utils import manipulate_spl
+from modules.streams_service_api_helper import DSPApi
+
+
+def main(args):
+    parser = argparse.ArgumentParser()
+    parser.add_argument('detection', nargs='+', type=str, help='detection yaml to be checked')
+    opts = parser.parse_args(args)
+
+    api = get_api()
+    if api is None:
+        print("No valid tokens found")
+        sys.exit(-1)
+
+    results = {}
+    for detection_path in opts.detection:
+        if not os.path.exists(detection_path):
+            print(f"File {detection_path} does not exist")
+            continue
+
+        with open(detection_path, 'rt') as f:
+            detection = yaml.safe_load(f)
+        name = os.path.basename(detection_path)
+
+        spl = manipulate_spl(api, detection['search'], None)
+        if spl is None:
+            results[name] = 'failed to manipulate SPL'
+            continue
+
+        upl = api.compile_spl(spl)
+        if upl is None:
+            results[name] = 'failed to compile SPL'
+            continue
+
+        validated_upl = api.validate_upl(upl)
+        if validated_upl is None:
+            results[name] = 'failed to validate UPL'
+            continue
+
+        results[name] = 'success'
+
+    for name, result in results.items():
+        if result == 'success':
+            print(f"{name}: {result}")
+
+    for name, result in results.items():
+        if result != 'success':
+            print(f"{name} FAILED!!: {result}")
+
+
+def get_api():
+    for token in get_scloud_tokens():
+        env, tenant, good = parse_token(token)
+        if good:
+            return DSPApi(env, tenant, token)
+
+
+def parse_token(token):
+    def decode(s):
+        def pad(t):
+            return t + '=' * (len(t) % 4)
+        return json.loads(base64.b64decode(pad(s)))
+
+    header, payload, signature = token.split('.')
+    payload_data = decode(payload)
+    for k in sorted(payload_data.keys()):
+        print(f"token.payload.{k} = {payload_data[k]}")
+
+    token_env = payload_data['iss'].split('.')[-4]
+    print(f"token env: {token_env}")
+
+    token_tenant = payload_data['tenant']
+    print(f"token tenant: {token_tenant}")
+
+    valid_for = payload_data['exp'] - int(time.time())
+    if valid_for > 60:
+        print("Token is good")
+        token_good = True
+    else:
+        print("Token is expired")
+        token_good = False
+
+    return token_env, token_tenant, token_good
+
+
+def get_scloud_tokens():
+    tokens = []
+    config = configparser.ConfigParser()
+    context_path = os.path.expanduser('~/.scloud_context')
+    config.read(context_path)
+    config.sections()
+    for section in config.sections():
+        token = config[section].get('access_token')
+        if token is not None:
+            tokens.append(token.strip('"'))
+    return tokens
+
+
+if __name__ == '__main__':
+    main(sys.argv[1:])
@@ -51,7 +51,7 @@ tags:
  - ID.AM
  observable:
  - name: user
-    type: user
+    type: User
    role:
    - Attacker
  product:
@@ -48,6 +48,10 @@ tags:
  nist:
  - ID.AM
  observable:
+  - name: user
+    type: User
+    role:
+    - Attacker
  - name: dest
    type: Endpoint
    role:
@@ -13,8 +13,8 @@ search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex
  | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers")
  | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") |
  rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime
-  max(_time) as lastTime by user_arn userIdentity.principalId userAgent
-  uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  max(_time) as lastTime by user_arn userIdentity.principalId userAgent uri permission
+  bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | `detect_new_open_s3_buckets_filter` '
 how_to_implement: You must install the AWS App for Splunk.
 known_false_positives: While this search has no known false positives, it is possible
@@ -40,8 +40,8 @@ tags:
  impact: 60
  kill_chain_phases:
  - Actions on Objectives
-  message: User $user_arn$ has created an open/public bucket $bucketName$ with the following
-    permissions $permission$
+  message: User $user_arn$ has created an open/public bucket $bucketName$ with the
+    following permissions $permission$
  mitre_attack_id:
  - T1530
  nist:
@@ -73,4 +73,4 @@ tags:
  - uri
  - permission
  risk_score: 48
-  security_domain: threat
+  security_domain: threat
@@ -5,8 +5,9 @@ date: '2021-07-20'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel: []
-description: The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions
-  are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot. 
+description: The following analytic utilizes AWS CloudTrail events to identify when
+  an EC2 snapshot permissions are modified to be shared with a different AWS account.
+  This method is used by adversaries to exfiltrate the EC2 snapshot.
 search: '`cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId
  as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No
  Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id
@@ -22,16 +23,38 @@ tags:
  - Suspicious Cloud Instance Activities
  - Data Exfiltration
  asset_type: EC2 Snapshot
+  automated_detection_testing: passed
  cis20:
  - CIS 13
+  confidence: 80
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  - Stage:Exfiltration
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json
+  impact: 60
  kill_chain_phases:
  - Actions on Objectives
+  message: AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$
+    by user $user_arn$ from $src_ip$
  mitre_attack_id:
  - T1537
  nist:
  - PR.DS
  - PR.AC
  - DE.CM
+  observable:
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
  product:
  - Splunk Security Analytics for AWS
  - Splunk Enterprise
@@ -46,27 +69,5 @@ tags:
  - aws_account_id
  - vendor_region
  - user_agent
-  impact: 60
-  confidence: 80
  risk_score: 48
-  context:
-  - Source:Cloud Data
-  - Scope:External
-  - Outcome:Allowed
-  - Stage:Execution
-  - Stage:Exfiltration
-  message: AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$
-    by user $user_arn$ from $src_ip$
-  observable:
-  - name: user_arn
-    type: User
-    role:
-    - Attacker
-  - name: src_ip
-    type: IP Address
-    role:
-    - Attacker
  security_domain: threat
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json
@@ -27,11 +27,21 @@ tags:
  automated_detection_testing: passed
  cis20:
  - CIS 13
+  confidence: 50
+  context:
+  - Source:Cloud Data
+  - Stage:Execution
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/security_hub_ec2_spike/security_hub_ec2_spike.json
+  impact: 30
+  message: Spike in AWS security Hub alerts with title $Title$ for EC2 instance $dest$
  nist:
  - DE.DP
-  - DE.AE
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
  product:
  - Splunk Security Analytics for AWS
  - Splunk Enterprise
@@ -46,7 +56,5 @@ tags:
  - vendor_region
  - severity
  - dest
-  risk_object: dest
-  risk_object_type: system
-  risk_score: 20
-  security_domain: network
+  risk_score: 15
+  security_domain: endpoint
@@ -8,31 +8,53 @@ datamodel: []
 description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
  to identify suspicious PowerShell execution. Script Block Logging captures the command
  sent to PowerShell, the full command to be executed. Upon enabling, logs will output
-  to Windows event logs. Dependent upon volume, enable no critical endpoints or all. 
+  to Windows event logs. Dependent upon volume, enable no critical endpoints or all.
  \

-  This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in
-  script block. This will catch the most basic use cases for credentials being taken for offline cracking. \
+  This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture
+  the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the
+  most basic use cases for credentials being taken for offline cracking. \

  During triage, review parallel processes using an EDR product or 4688 events. It
  will be important to understand the timeline of events around this activity. Review
  the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message IN ("*copy*","*[System.IO.File]::Copy*") AND Message IN ("*System32\\config\\SAM*", "*System32\\config\\SYSTEM*","*System32\\config\\SECURITY*") | stats count min(_time) as firstTime max(_time)
-  as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `detect_copy_of_shadowcopy_with_script_block_logging_filter`'
-how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives.
-references: 
-  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
-  - https://github.com/GossiTheDog/HiveNightmare
-  - https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions
+search: '`powershell` EventCode=4104 Message IN ("*copy*","*[System.IO.File]::Copy*")
+  AND Message IN ("*System32\\config\\SAM*", "*System32\\config\\SYSTEM*","*System32\\config\\SECURITY*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName
+  User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `detect_copy_of_shadowcopy_with_script_block_logging_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Limited false positives as the scope is limited to SAM, SYSTEM
+  and SECURITY hives.
+references:
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
+- https://github.com/GossiTheDog/HiveNightmare
+- https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions
 tags:
  analytic_story:
  - Credential Dumping
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  impact: 80
  kill_chain_phases:
  - Exploitation
+  message: PowerShell was identified running a script to capture the SAM hive on endpoint
+    $ComputerName$ by user $user$.
  mitre_attack_id:
  - T1003.002
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -44,21 +66,5 @@ tags:
  - ComputerName
  - User
  - EventCode
-  security_domain: endpoint
-  impact: 80
-  confidence: 100
-  # (impact * confidence)/100
  risk_score: 80
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  message: PowerShell was identified running a script to capture the SAM hive on endpoint $ComputerName$ by user $user$.
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: ComputerName
-    type: Hostname
-    role:
-    - Victim
+  security_domain: endpoint
@@ -12,10 +12,10 @@ description: The following analytic identifies renamed instances of `PsExec.exe`
  In this instance, we are using `OriginalFileName` from Sysmon to identify `PsExec`
  usage. During triage, validate this is the legitimate version of `PsExec` by review
  the PE metadata. In addition, review parallel processes for further suspicious behavior.
-search: '`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe process_name!=PsExec64.exe) |
-  stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name,
-  process_name, OriginalFileName, process_path, CommandLine Product | rename Computer
-  as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe process_name!=PsExec64.exe)
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
+  | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `detect_renamed_psexec_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
@@ -12,11 +12,11 @@ description: The following analtyic identifies renamed instances of `WinRAR.exe`
  In this instance, we are using `OriginalFileName` from Sysmon to determine if the
  process is WinRAR. During triage, validate additional metadata from the binary that
  this is `WinRAR`. Review parallel processes and file modifications.
-search: '`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe process_name!=winrar.exe
-  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
-  parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product
-  | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `detect_renamed_winrar_filter`'
+search: '`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe
+  process_name!=winrar.exe | stats count min(_time) as firstTime max(_time) as lastTime
+  by Computer, User, parent_process_name, process_name, OriginalFileName, process_path,
+  CommandLine Product | rename Computer as dest | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_renamed_winrar_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -6,59 +6,59 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process.
-  This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the 
-  the actual trickbot payload.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.parent_process_name = "mshta.exe"  (Processes.process_name=rundll32.exe OR Processes.process_name=regsvr32.exe) by
-  Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid
-  Processes.user Processes.dest 
-  | `drop_dm_object_name("Processes")` 
-  | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` 
-  | `mshta_spawning_rundll32_or_regsvr32_process_filter`'
+description: This search is to detect a suspicious mshta.exe process that spawn rundll32
+  or regsvr32 child process. This technique was seen in several malware nowadays like
+  trickbot to load its initial .dll stage loader to execute and download the the actual
+  trickbot payload.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  = "mshta.exe"  (Processes.process_name=rundll32.exe OR Processes.process_name=regsvr32.exe)
+  by Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")`
+  | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `mshta_spawning_rundll32_or_regsvr32_process_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
  Sysmon TA. Tune and filter known instances where renamed mshta.exe may be used.
-known_false_positives: limitted. this anomaly behavior is not commonly seen in clean host.
+known_false_positives: limitted. this anomaly behavior is not commonly seen in clean
+  host.
 references:
 - https://twitter.com/cyb3rops/status/1416050325870587910?s=21
 tags:
  analytic_story:
  - Trickbot
+  confidence: 80
+  context:
+  - source:endpoint
+  - stage: executions
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log
+  impact: 70
  kill_chain_phases:
  - Exploitation
+  message: a mshta parent process $parent_process_name$ spawn child process $process_name$
+    in host $dest$
  mitre_attack_id:
  - T1218.005
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
-  - parent_process 
-  - process_name 
-  - process 
-  - process_id 
+  - parent_process
+  - process_name
+  - process
+  - process_id
  - process_guid
-  security_domain: endpoint
-  impact: 70
-  confidence: 80
-  # (impact * confidence)/100
  risk_score: 56
-  context: 
-  - source:endpoint
-  - stage: executions
-  message: a mshta parent process $parent_process_name$ spawn child process $process_name$ in host $dest$
-  observable:
-    - name: dest
-      type: Hostname
-      role:
-      - Victim
-    - name: user
-      type: user
-      role:
-      - Victim 
+  security_domain: endpoint
@@ -6,33 +6,49 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect modification of registry to bypass UAC windows feature. 
-  This technique is to add a payload dll path on .NET COR file path that will be loaded by mmc.exe as soon it was executed.
-  This detection rely on monitoring the registry key and values in the detection area. 
-  It may happened that windows update some dll related to mmc.exe and add dll path in this registry. In this case filtering is needed.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH" Registry.registry_value_name = "*.dll"
-  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `net_profiler_uac_bypass_filter`'
+description: This search is to detect modification of registry to bypass UAC windows
+  feature. This technique is to add a payload dll path on .NET COR file path that
+  will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring
+  the registry key and values in the detection area. It may happened that windows
+  update some dll related to mmc.exe and add dll path in this registry. In this case
+  filtering is needed.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH"
+  Registry.registry_value_name = "*.dll" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `net_profiler_uac_bypass_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: limited false positive. It may trigger by some windows update that will modify this registry.
+known_false_positives: limited false positive. It may trigger by some windows update
+  that will modify this registry.
 references:
 - https://offsec.almond.consulting/UAC-bypass-dotnet.html
 tags:
  analytic_story:
  - Windows Defense Evasion Tactics
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Persistence,
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Incoming
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2.log
+  impact: 70
  kill_chain_phases:
  - Exploitation
+  message: Suspicious modification of registry $registry_path$ with possible payload
+    path $registry_value_name$ in $dest$
  mitre_attack_id:
  - T1548.002
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -42,22 +58,6 @@ tags:
  - Registry.registry_path
  - Registry.registry_key_name
  - Registry.registry_value_name
-  - Registry.dest 
-  security_domain: endpoint
-  impact: 70
-  confidence: 90
-  # (impact * confidence)/100
+  - Registry.dest
  risk_score: 63
-  context:
-  - Source:Endpoint
-  - Stage:Persistence,
-  - Stage:Privilege Escalation
-  - Stage:Defense Evasion
-  - Scope:Incoming
-  message: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  
+  security_domain: endpoint
@@ -6,60 +6,61 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: this search is to detect a suspicious office product process that spawn cmd child process.
-  This is commonly seen in a ms office product having macro to execute shell command to download or execute malicious lolbin 
-  relative to its malicious code. This is seen in trickbot spear phishing doc where it execute shell cmd to run mshta payload.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name= "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") 
-  Processes.process_name=cmd.exe by Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid
-  Processes.user Processes.dest 
-  | `drop_dm_object_name("Processes")` 
-  | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` 
+description: this search is to detect a suspicious office product process that spawn
+  cmd child process. This is commonly seen in a ms office product having macro to
+  execute shell command to download or execute malicious lolbin relative to its malicious
+  code. This is seen in trickbot spear phishing doc where it execute shell cmd to
+  run mshta payload.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
+  = "winword.exe" OR Processes.parent_process_name= "excel.exe" OR Processes.parent_process_name
+  = "powerpnt.exe") Processes.process_name=cmd.exe by Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest
+  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
  | `office_product_spawn_cmd_process_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs with the process name, parent process, and command-line executions from your
  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
-known_false_positives: IT or network admin may create an document automation that will run shell script.
+  Sysmon TA.
+known_false_positives: IT or network admin may create an document automation that
+  will run shell script.
 references:
 - https://twitter.com/cyb3rops/status/1416050325870587910?s=21
 tags:
  analytic_story:
  - Trickbot
+  confidence: 80
+  context:
+  - source:endpoint
+  - stage: executions
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log
+  impact: 70
  kill_chain_phases:
  - Exploitation
+  message: an office product parent process $parent_process_name$ spawn child process
+    $process_name$ in host $dest$
  mitre_attack_id:
  - T1218.005
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: user
+    type: user
+    role:
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
-  - parent_process 
-  - process_name 
-  - process 
-  - process_id 
+  - parent_process
+  - process_name
+  - process
+  - process_id
  - process_guid
-  security_domain: endpoint
-  impact: 70
-  confidence: 80
-  # (impact * confidence)/100
  risk_score: 56
-  context: 
-  - source:endpoint
-  - stage: executions
-  message: an office product parent process $parent_process_name$ spawn child process $process_name$ in host $dest$
-  observable:
-    - name: dest
-      type: Hostname
-      role:
-      - Victim
-    - name: user
-      type: user
-      role:
-      - Victim 
-  
+  security_domain: endpoint
@@ -6,47 +6,42 @@ author: Michael Haag, Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: The following analytic identifies access to SAM, SYSTEM or SECURITY databases' within the file path of `windows\system32\config` using Windows Security EventCode 4663. This particular behavior is related to credential access, an attempt to either use a Shadow Copy or recent CVE-2021-36934 to access the SAM database.
-  The Security Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7, 8.1 and 10 that stores users' passwords.
-search: '`wineventlog_security` (EventCode=4663)  process_name!=*\\dllhost.exe Object_Name IN ("*\\Windows\\System32\\config\\SAM*","*\\Windows\\System32\\config\\SYSTEM*","*\\Windows\\System32\\config\\SECURITY*") 
-  | stats values(Accesses) count by process_name Object_Name  dest user 
-  | `sam_database_file_access_attempt_filter`'
+description: The following analytic identifies access to SAM, SYSTEM or SECURITY databases'
+  within the file path of `windows\system32\config` using Windows Security EventCode
+  4663. This particular behavior is related to credential access, an attempt to either
+  use a Shadow Copy or recent CVE-2021-36934 to access the SAM database. The Security
+  Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7,
+  8.1 and 10 that stores users' passwords.
+search: '`wineventlog_security` (EventCode=4663)  process_name!=*\\dllhost.exe Object_Name
+  IN ("*\\Windows\\System32\\config\\SAM*","*\\Windows\\System32\\config\\SYSTEM*","*\\Windows\\System32\\config\\SECURITY*")
+  | stats values(Accesses) count by process_name Object_Name  dest user | `sam_database_file_access_attempt_filter`'
 how_to_implement: To successfully implement this search, you must ingest Windows Security
-  Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
-known_false_positives: Natively, `dllhost.exe` will access the files. Every environment will have additional native processes that do as well. Filter by process_name. As an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`. 
+  Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
+  Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+known_false_positives: Natively, `dllhost.exe` will access the files. Every environment
+  will have additional native processes that do as well. Filter by process_name. As
+  an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`.
 references:
-  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4663
-  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
-  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
-  - https://github.com/GossiTheDog/HiveNightmare
-  - https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions
-  - https://en.wikipedia.org/wiki/Security_Account_Manager
+- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4663
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
+- https://github.com/GossiTheDog/HiveNightmare
+- https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions
+- https://en.wikipedia.org/wiki/Security_Account_Manager
 tags:
  analytic_story:
  - Credential Dumping
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1003.002
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - process_name 
-  - Object_Name
-  - dest
-  - user 
-  security_domain: endpoint
-  impact: 80
  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
  context:
  - Source:Endpoint
  - Stage:Credential Access
-  message: The following process $process_name$ accessed the object $Object_Name$ attempting to gain access to credentials on $dest$ by user $user$.
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: The following process $process_name$ accessed the object $Object_Name$
+    attempting to gain access to credentials on $dest$ by user $user$.
+  mitre_attack_id:
+  - T1003.002
  observable:
  - name: user
    type: User
@@ -63,4 +58,16 @@ tags:
  - name: Object_Name
    type: File
    role:
-    - Other
+    - Other
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - process_name
+  - Object_Name
+  - dest
+  - user
+  risk_score: 80
+  security_domain: endpoint
@@ -6,17 +6,17 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious sdclt.exe registry modification. 
-  This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe application by modifying some registry 
-  that sdclt.exe tries to open or query with payload file path on it to be executed.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where (Registry.registry_path= "*\\Windows\\CurrentVersion\\App Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*") 
+description: This search is to detect a suspicious sdclt.exe registry modification.
+  This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe
+  application by modifying some registry that sdclt.exe tries to open or query with
+  payload file path on it to be executed.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\Windows\\CurrentVersion\\App
+  Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*")
  (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "IsolatedCommand")
-  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `sdclt_uac_bypass_filter`'
+  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
+  Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `sdclt_uac_bypass_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -28,12 +28,27 @@ references:
 tags:
  analytic_story:
  - Windows Defense Evasion Tactics
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Persistence,
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Incoming
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log
+  impact: 70
  kill_chain_phases:
  - Exploitation
+  message: Suspicious modification of registry $registry_path$ with possible payload
+    path $registry_value_name$ in $dest$
  mitre_attack_id:
  - T1548.002
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -44,21 +59,5 @@ tags:
  - Registry.registry_key_name
  - Registry.registry_value_name
  - Registry.dest
-  security_domain: endpoint
-  impact: 70
-  confidence: 90
-  # (impact * confidence)/100
  risk_score: 63
-  context:
-  - Source:Endpoint
-  - Stage:Persistence,
-  - Stage:Privilege Escalation
-  - Stage:Defense Evasion
-  - Scope:Incoming
-  message: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  
+  security_domain: endpoint
@@ -6,15 +6,15 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious modification of registry that may related to UAC bypassed.
-  This registry will be trigger once the attacker abuse the silentcleanup task schedule to gain high privilege execution that will bypass User control account.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\Environment\\windir" Registry.registry_value_name = "*.exe*"
-  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `silentcleanup_uac_bypass_filter`'
+description: This search is to detect a suspicious modification of registry that may
+  related to UAC bypassed. This registry will be trigger once the attacker abuse the
+  silentcleanup task schedule to gain high privilege execution that will bypass User
+  control account.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\windir"
+  Registry.registry_value_name = "*.exe*" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `silentcleanup_uac_bypass_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
@@ -26,12 +26,27 @@ references:
 tags:
  analytic_story:
  - Windows Defense Evasion Tactics
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Persistence,
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Incoming
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log
+  impact: 70
  kill_chain_phases:
  - Exploitation
+  message: Suspicious modification of registry $registry_path$ with possible payload
+    path $registry_value_name$ in $dest$
  mitre_attack_id:
  - T1548.002
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -41,22 +56,6 @@ tags:
  - Registry.registry_path
  - Registry.registry_key_name
  - Registry.registry_value_name
-  - Registry.dest 
-  security_domain: endpoint
-  impact: 70
-  confidence: 90
-  # (impact * confidence)/100
+  - Registry.dest
  risk_score: 63
-  context:
-  - Source:Endpoint
-  - Stage:Persistence,
-  - Stage:Privilege Escalation
-  - Stage:Defense Evasion
-  - Scope:Incoming
-  message: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  
+  security_domain: endpoint
@@ -9,13 +9,14 @@ description: This detection indicates use of Mimikatz modules that facilitate Pa
  attack, Golden or Silver kerberos ticket attack, and Skeleton key attack.
 search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
  "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
-  null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true
  OR match_regex(cmd_line, /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true
  OR match_regex(cmd_line, /(?i)misc::skeleton/)=true )

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -12,7 +12,8 @@ description: Stolen credentials are applied by methods such as user impersonatio
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Invoke-CredentialInjection/)=true OR match_regex(cmd_line,
  /(?i)Invoke-TokenManipulation/)=true OR match_regex(cmd_line, /(?i)Invoke-UserImpersonation/)=true
  OR match_regex(cmd_line, /(?i)Get-System/)=true OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true
@@ -20,7 +21,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,12 +10,13 @@ description: This detection identifies use of DSInternals modules that verify pa
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Test-PasswordQuality/)=true )

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -15,10 +15,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null) | where cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name
  = "sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
  "parent_process_name", parent_process_name, "process_path", process_path]) | into
  write_ssa_detected_events();'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -16,10 +16,11 @@ search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(inpu
  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null) | where cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line,
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line,
  "%config%") AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp,
  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
-  "dest_device_id"), "string", null)), body=create_map(["cmd_line", cmd_line, "process_name",
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
  | into write_ssa_detected_events();'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -11,14 +11,15 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma
  "_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event,
  "process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"),
  "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
-  null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
+  null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null)
  | where process_name="cmd.exe" OR process_name="reg.exe" | where cmd_line != null  AND
  match_regex(cmd_line, /(?i)save\s+/)=true AND ( match_regex(cmd_line, /(?i)HKLM\\Security/)=true
  OR match_regex(cmd_line, /(?i)HKLM\\SAM/)=true OR match_regex(cmd_line, /(?i)HKLM\\System/)=true
  OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line,
  /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true
  ) | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
-  dest_user_id), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
+  dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
  | into write_ssa_detected_events(); '
 how_to_implement: You must be ingesting windows endpoint data that tracks process
  activity, including parent-child relationships from your endpoints.
@@ -16,7 +16,8 @@ search: '| from read_ssa_enriched_events()
  process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
  "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
-  "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true
  OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line,
  /(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true
  OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line,
@@ -26,7 +27,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
  | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
@@ -15,7 +15,8 @@ search: '| from read_ssa_enriched_events()
  process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
  "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
-  "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true
  OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line,
  /(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true
  OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line,
@@ -27,7 +28,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
  | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
@@ -17,14 +17,15 @@ search: ' | from read_ssa_enriched_events()
  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
-  "string", null) | where cmd_line != null AND process_name != null AND parent_process_name
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND process_name != null AND parent_process_name
  != null AND match_regex(parent_process_name, /(?i)System32\\services.exe/)=true
  AND match_regex(process_name, /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path,
  /(?i)\\Temp/)=true AND match_regex(cmd_line, /(?i)\-s/)=true

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
  "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
@@ -16,13 +16,14 @@ search: ' | from read_ssa_enriched_events()
  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
  "process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
-  "string", null) | where cmd_line != null AND process_name != null AND process_path
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND process_name != null AND process_path
  != null AND match_regex(process_name, /(?i)cachedump\d{0,2}.exe/)=true AND match_regex(process_path,
  /(?i)\\Temp/)=true AND match_regex(cmd_line, /(?i)\-v/)=true

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
  | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
@@ -14,13 +14,14 @@ description: Credential extraction is often an illegal recovery of credential ma
 search: ' | from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND match_regex(cmd_line, /(?i)Get-ADDBAccount/)=true AND match_regex(cmd_line,
  /(?i)\-dbpath[\s;:\.\|]+/)=true

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -13,12 +13,13 @@ description: Credential extraction is often an illegal recovery of credential ma
 search: ' | from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND match_regex(cmd_line, /(?i)all\s+\-oA\s+\-output/)=true

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -12,7 +12,8 @@ description: Credential extraction is often an illegal recovery of credential ma
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)CRYPTO::Certificates/)=true OR match_regex(cmd_line,
  /(?i)CRYPTO::keys/)=true OR match_regex(cmd_line, /(?i)kerberos::list/)=true OR
  match_regex(cmd_line, /(?i)kerberos::tgt/)=true OR match_regex(cmd_line, /(?i)lsadump::sam/)=true
@@ -22,7 +23,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -15,7 +15,8 @@ search: ' | from read_ssa_enriched_events()
  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
  "process_name"), "string", null), parent_process_name=ucast(map_get(input_event,
-  "parent_process_name"), "string", null) | where cmd_line != null AND parent_process_name
+  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND parent_process_name
  != null AND process_name != null  AND ( match_regex(parent_process_name, /(?i)ntkd\.exe/)=true
  OR match_regex(parent_process_name, /(?i)livekd\.exe/)=true ) AND match_regex(process_name,
  /(?i)conhost\.exe/)=true AND match_regex(cmd_line, /(?i)0xffffffff/)=true AND match_regex(cmd_line,
@@ -23,7 +24,7 @@ search: ' | from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
  "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
@@ -14,13 +14,14 @@ search: ' | from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
  cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
-  "process_name"), "string", null) | where cmd_line != null AND process_name != null
+  "process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND process_name != null
  AND ( match_regex(process_name, /^(?i)ntkd\.exe/)=true OR match_regex(process_name,
  /^(?i)kd\.exe/)=true ) AND match_regex(cmd_line, /(?i)\-z\s+/)=true

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
  | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
@@ -12,7 +12,8 @@ description: Credential extraction is often an illegal recovery of credential ma
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line,
  /(?i)Get-CachedGPPPassword/)=true OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true
  OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true
@@ -23,7 +24,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -17,10 +17,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
  OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
  "parent_process_name", parent_process_name, "process_path", process_path]) | into
  write_ssa_detected_events();'
 how_to_implement: o successfully implement this search, you need to be ingesting logs
@@ -14,11 +14,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
  "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
  null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
  process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
-  "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line,
+  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND match_regex(cmd_line,
  /(?i)deny/)=true AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
  "parent_process_name", parent_process_name, "process_path", process_path]) | into
  write_ssa_detected_events();'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -11,10 +11,11 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve
  "_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
  "string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
  "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
-  null)), process=lower(ucast(map_get(input_event, "process"), "string", null)) |
-  where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
+  null)), process=lower(ucast(map_get(input_event, "process"), "string", null)),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
  | eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine),
-  body=create_map(["process_name", process_name]) | into write_ssa_detected_events();'
+  body=create_map(["event_id", event_id, "process_name", process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
  including Windows command line logging. You can see how we test this with [Event
  Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)
@@ -12,11 +12,12 @@ search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_
  "ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"),
  ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event,
  "service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
-  null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
+  null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null)
  | where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17"
  | first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
  | where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
-  | eval start_time=_time, end_time=_time, body=create_map(["EventCode", EventCode,
+  | eval start_time=_time, end_time=_time, body=create_map(["event_id", event_id, "EventCode", EventCode,
  "ServiceName", ServiceName, "TicketOptions", TicketOptions, "TicketEncryptionType",
  TicketEncryptionType]), entities = mvappend( ucast(map_get(input_event, "dest_user_id"),
  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))|
@@ -14,13 +14,13 @@ search: ' | from read_ssa_enriched_events()
  "authentication_type"), authentication_method=map_get(input_event, "authentication_method"),
  origin_device_domain=map_get(input_event, "origin_device_domain"), dest_user_id=ucast(map_get(input_event,
  "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
-  "string", null)
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)

  | where (authentication_type="3" AND authentication_method="NtLmSsp") OR (authentication_type="9"
  AND authentication_method="seclogo")

  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
-  dest_user_id), body=create_map(["authentication_type", authentication_type, "authentication_method",
+  dest_user_id), body=create_map(["event_id", event_id, "authentication_type", authentication_type, "authentication_method",
  authentication_method]) | into write_ssa_detected_events();'
 how_to_implement: The test data is converted from Windows Security Event logs generated
  from Attach Range simulation and used in SPL search and extended to SPL2
@@ -15,10 +15,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe"
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND (process_name="net1.exe"
  OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
  "parent_process_name", parent_process_name, "process_path", process_path]) | into
  write_ssa_detected_events();'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -18,11 +18,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
  "\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext"
  */ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"),
  /* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm,
-  /\d+/, "N") | where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string",
+  /\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string",
  ""), /.* \/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp,
  dest_device_id, dest_user_id | first_time_event input_columns=["cmd_line_norm"]
  | where first_time_cmd_line_norm | eval start_time = timestamp, end_time = timestamp,
-  entities = mvappend(dest_device_id, dest_user_id), body=create_map(["cmd_line",
+  entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "cmd_line",
  cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be populating the endpoint data model for SSA and specifically
  the process_name and the process fields
@@ -14,11 +14,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
  "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
  null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
  process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
-  "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line,
+  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND match_regex(cmd_line,
  /(?i)grant/)=true AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR
  process_name="icacls.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
  "parent_process_name", parent_process_name, "process_path", process_path]) | into
  write_ssa_detected_events();'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that enable
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Get-HttpStatus/)=true OR match_regex(cmd_line,
  /(?i)Get-Keystrokes/)=true OR match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true
  OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true OR match_regex(cmd_line,
@@ -20,7 +21,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,12 +10,13 @@ description: This detection identifies access to PowerSploit modules that create
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)New-DomainUser/)=true )

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,13 +10,14 @@ description: This detection identifies use of DSInternals modules that enable or
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Disable-ADDBAccount/)=true OR match_regex(cmd_line,
  /(?i)Enable-ADDBAccount/)=true )

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,13 +10,14 @@ description: This detection identifies access to PowerSploit modules that delete
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)event::drop/)=true OR match_regex(cmd_line,
  /(?i)event::clear/)=true )

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -11,14 +11,15 @@ description: This detection identifies use of DSInternals modules for illegal ma
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Remove-ADDBObject/)=true OR match_regex(cmd_line,
  /(?i)Set-ADDBDomainController/)=true OR match_regex(cmd_line, /(?i)Set-ADDBPrimaryGroup/)=true
  OR match_regex(cmd_line, /(?i)Set-LsaPolicyInformation/)=true )

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that enable
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Set-DomainObject/)=true OR match_regex(cmd_line,
  /(?i)Set-ADObject/)=true OR match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true
  OR match_regex(cmd_line, /(?i)Set-MasterBootRecord/)=true )
@@ -19,7 +20,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that illega
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Add-DomainObjectAcl/)=true OR match_regex(cmd_line,
  /(?i)Add-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true
  OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true OR match_regex(cmd_line,
@@ -19,7 +20,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,13 +10,14 @@ description: This detection identifies use of Mimikatz modules for illegal privi
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)privilege::debug/)=true OR match_regex(cmd_line,
  /(?i)token::elevate/)=true )

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,7 +10,8 @@ description: This detection identifies use of Mimikatz modules for illegal contr
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)process::start/)=true OR match_regex(cmd_line,
  /(?i)service::\+/)=true OR match_regex(cmd_line, /(?i)service::\-/)=true OR match_regex(cmd_line,
  /(?i)service::start/)=true OR match_regex(cmd_line, /(?i)service::stop/)=true OR
@@ -19,7 +20,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -12,7 +12,8 @@ description: This detection identifies access to PowerSploit modules that enable
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Install-SSP/)=true OR match_regex(cmd_line,
  /(?i)Set-CriticalProcess/)=true OR match_regex(cmd_line, /(?i)Install-ServiceBinary/)=true
  OR match_regex(cmd_line, /(?i)Restore-ServiceBinary/)=true OR match_regex(cmd_line,
@@ -27,7 +28,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -16,12 +16,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
  "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
  null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
  process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
-  "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND like(cmd_line,
+  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line,
  "%/G%") AND (match_regex(cmd_line, /(?i)everyone:/)=true OR match_regex(cmd_line,
  /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe" OR process_name="xcacls.exe"
  OR process_name="icacls.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
  "parent_process_name", parent_process_name, "process_path", process_path]) | into
  write_ssa_detected_events();'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -10,14 +10,15 @@ description: This detection identifies use of PowerSploit modules that facilitat
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Test-AdminAccess/)=true OR match_regex(cmd_line,
  /(?i)Invoke-CheckLocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Test-ServiceDaclPermission/)=true
  )

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -15,7 +15,8 @@ search: '| from read_ssa_enriched_events()
  | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
  parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
  null)), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
-  dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
+  dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null)

  | where process_name="cmd.exe" | rex field=parent_process "(?<field0>[^\\\\]+)$"
  | where field0="winword.exe" OR field0="excel.exe" OR field0="outlook.exe" OR field0="powerpnt.exe"
@@ -24,7 +25,7 @@ search: '| from read_ssa_enriched_events()
  OR field0="java.exe" OR field0="powershell.exe"

  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
-  dest_user_id), body=create_map([ "process_name", process_name, "parent_process_name",
+  dest_user_id), body=create_map(["event_id", event_id,  "process_name", process_name, "parent_process_name",
  parent_process]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting sysmon logs. This search has been modified
  to process raw sysmon data from attack_range's nxlogs on DSP.
@@ -15,7 +15,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
  "\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
  null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event,
  "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
-  "string", null) | where parent_process_name!=null | select parent_process_name,
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where parent_process_name!=null | select parent_process_name,
  process_name, cmd_line, timestamp, dest_device_id, dest_user_id | conditional_anomaly
  conditional="parent_process_name" target="process_name" | where (process_name="powershell.exe"
  OR process_name="regsvcs.exe" OR process_name="ftp.exe" OR process_name="dfsvc.exe"
@@ -13,7 +13,8 @@ description: This detection identifies use of PowerSploit modules that discover
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Find-LocalAdminAccess/)=true OR match_regex(cmd_line,
  /(?i)Find-InterestingDomainAcl/)=true OR match_regex(cmd_line, /(?i)Invoke-ACLScanner/)=true
  OR match_regex(cmd_line, /(?i)Find-PathDLLHijack/)=true OR match_regex(cmd_line,
@@ -28,7 +29,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules that discov
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Find-DomainLocalGroupMember/)=true OR match_regex(cmd_line,
  /(?i)Invoke-EnumerateLocalAdmin/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserEvent/)=true
  OR match_regex(cmd_line, /(?i)Invoke-EventHunter/)=true OR match_regex(cmd_line,
@@ -37,7 +38,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,13 +10,14 @@ description: This detection identifies use of Mimikatz modules for discovery of
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)net::user/)=true OR match_regex(cmd_line,
  /(?i)net::group/)=true )

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -12,7 +12,8 @@ description: This detection identifies access to PowerSploit modules for reconna
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Get-DomainSID/)=true OR match_regex(cmd_line,
  /(?i)Get-DomainSite/)=true OR match_regex(cmd_line, /(?i)Get-NetSite/)=true OR match_regex(cmd_line,
  /(?i)Get-DomainSubnet/)=true OR match_regex(cmd_line, /(?i)Get-NetSubnet/)=true
@@ -27,7 +28,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules that discov
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Get-ComputerDetail/)=true OR match_regex(cmd_line,
  /(?i)Get-Domain/)=true OR match_regex(cmd_line, /(?i)Get-NetDomain/)=true OR match_regex(cmd_line,
  /(?i)Get-DomainComputer/)=true OR match_regex(cmd_line, /(?i)Get-NetComputer/)=true
@@ -20,7 +21,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,12 +10,13 @@ description: This detection identifies use of Mimikatz modules for discovery of
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)net::ServerInfo/)=true )

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -11,7 +11,8 @@ description: This detection identifies access to PowerSploit modules that discov
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Find-DomainProcess/)=true OR match_regex(cmd_line,
  /(?i)Invoke-ProcessHunter/)=true OR match_regex(cmd_line, /(?i)Get-ServiceDetail/)=true
  OR match_regex(cmd_line, /(?i)Get-WMIProcess/)=true OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true
@@ -22,7 +23,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,12 +10,13 @@ description: This detection identifies use of Mimikatz modules for discovery and
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)net::share/)=true )

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules that discov
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Find-DomainShare/)=true OR match_regex(cmd_line,
  /(?i)Invoke-ShareFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainShareFile/)=true
  OR match_regex(cmd_line, /(?i)Invoke-FileFinder/)=true OR match_regex(cmd_line,
@@ -20,7 +21,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,7 +10,8 @@ description: This detection identifies access to PowerSploit modules for reconna
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Get-DomainDNSRecord/)=true OR match_regex(cmd_line,
  /(?i)Get-DNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true
  OR match_regex(cmd_line, /(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true
@@ -21,7 +22,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,7 +10,8 @@ description: This detection identifies reconnaissance of credential stores and u
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)crypto::capi/)=true OR match_regex(cmd_line,
  /(?i)crypto::cng/)=true OR match_regex(cmd_line, /(?i)crypto::providers/)=true OR
  match_regex(cmd_line, /(?i)crypto::stores/)=true OR match_regex(cmd_line, /(?i)crypto::sc/)=true
@@ -18,7 +19,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,12 +10,13 @@ description: This detection identifies use of PowerSploit modules for assessment
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Find-AVSignature/)=true )

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,12 +10,13 @@ description: This detection identifies use of PowerSploit modules for assessment
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Invoke-PrivescAudit/)=true )

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -14,12 +14,13 @@ description: This detection identifies use of Mimikatz modules for discovery of
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)misc::detours/)=true )

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,13 +10,14 @@ description: This detection identifies use of Mimikatz modules for discovery and
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)process::list/)=true OR match_regex(cmd_line,
  /(?i)service::list/)=true )

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -17,11 +17,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null) | where cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line,
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line,
  "%shadowstorage%") AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe"
  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
  "parent_process_name", parent_process_name, "process_path", process_path]) | into
  write_ssa_detected_events();'
 how_to_implement: To successfully implement this search, you need to be ingesting
@@ -13,7 +13,8 @@ search: '| from read_ssa_enriched_events()
  process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
  "process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
  "string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
-  "string", null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true
+  "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true
  OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPassword/)=true
  OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true OR match_regex(cmd_line,
  /(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line, /(?i)Set-SamAccountPasswordHash/)=true
@@ -21,7 +22,7 @@ search: '| from read_ssa_enriched_events()

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,13 +10,14 @@ description: This detection identifies illegal setting of credentials via Mimika
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)misc::addsid/)=true OR match_regex(cmd_line,
  /(?i)CRYPTO::scauth/)=true )

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -10,12 +10,13 @@ description: This detection identifies illegal setting of credentials via PowerS
 search: '| from read_ssa_enriched_events()

  | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
-  cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
+  cmd_line=ucast(map_get(input_event, "process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
  != null AND ( match_regex(cmd_line, /(?i)Set-DomainUserPassword/)=true )

  | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["event_id", event_id,  "cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
  including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.
@@ -16,7 +16,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
  "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
  null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
-  null));
+  null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);

  $cond_1 = | from $ssa_input | where process_name="arp.exe" OR process_name="adaptertroubleshooter.exe"
  OR process_name="applicationframehost.exe" OR process_name="atbroker.exe" OR process_name="authhost.exe"
@@ -226,7 +226,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
  | from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 |
  union $cond_6 | where match_regex(process_path, /(?i)\\windows\\system32/)=false
  AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false | eval start_time=timestamp,
-  end_time=timestamp, entities=mvappend(device, user), body=create_map(["process_path",
+  end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id", event_id, "process_path",
  process_path, "process_name", process_name]) | into write_ssa_detected_events();'
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 known_false_positives: None
@@ -13,7 +13,8 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma
  "_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"),
  "string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
  null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
-  process_name=ucast(map_get(input_event, "process_name"), "string", null) | where
+  process_name=ucast(map_get(input_event, "process_name"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
  cmd_line!=null and dest_user_id!=null | eval cmd_line_norm=replace(cast(cmd_line,
  "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm, /\w:\\[^\s]+/,
  "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm,
@@ -21,7 +22,7 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma
  input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000
  | where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id",
  "cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp,
-  end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["cmd_line",
+  end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id", event_id, "cmd_line",
  cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting sysmon endpoint data that monitors command
  lines.
@@ -13,14 +13,15 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
  "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
  null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
  process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
-  "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND like(cmd_line,
+  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line,
  "% cl %") AND (match_regex(cmd_line, /(?i)security/)=true OR match_regex(cmd_line,
  /(?i)system/)=true OR match_regex(cmd_line, /(?i)sysmon/)=true OR match_regex(cmd_line,
  /(?i)application/)=true OR match_regex(cmd_line, /(?i)setup/)=true OR match_regex(cmd_line,
  /(?i)powershell/)=true) AND process_name="wevtutil.exe" | eval start_time=timestamp,
  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
-  body=create_map(["cmd_line", cmd_line, "process_name", process_name, "parent_process_name",
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "parent_process_name",
  parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting data that records process activity from your
  hosts to populate the Endpoint data model in the Processes node. You must also be
@@ -13,11 +13,12 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
  "_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
  null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
  process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
-  "parent_process_name"), "string", null) | where cmd_line IS NOT NULL AND like(cmd_line,
+  "parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
+  | where cmd_line IS NOT NULL AND like(cmd_line,
  "% sl %") AND like(cmd_line, "%/e:false%") AND process_name="wevtutil.exe" | eval
  start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
  "parent_process_name", parent_process_name, "process_path", process_path]) | into
  write_ssa_detected_events();'
 how_to_implement: You must be ingesting data that records process activity from your
@@ -25,10 +25,28 @@ references:
 tags:
  analytic_story:
  - Windows Defense Evasion Tactics
+  automated_detection_testing: passed
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Persistence,
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Incoming
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2.log
+  impact: 70
  kill_chain_phases:
  - Exploitation
+  message: Suspicious unsigned $ImageLoaded$ loaded by $Image$ on endpoint $Computer$
+    with EventCode $EventCode$
  mitre_attack_id:
  - T1548.002
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -43,23 +61,5 @@ tags:
  - Computer
  - EventCode
  - Company
-  security_domain: endpoint
-  impact: 70
-  confidence: 90
  risk_score: 63
-  context:
-  - Source:Endpoint
-  - Stage:Persistence,
-  - Stage:Privilege Escalation
-  - Stage:Defense Evasion
-  - Scope:Incoming
-  message: Suspicious unsigned $ImageLoaded$ loaded by $Image$ on endpoint $Computer$
-    with EventCode $EventCode$
-  observable:
-  - name: Computer
-    type: Hostname
-    role:
-    - Victim
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon2.log
+  security_domain: endpoint
@@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious modification of registry related to UAC bypass. 
-  This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to 
-  bypass User account Control.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*" (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "DelegateExecute")
-  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `wsreset_uac_bypass_filter`'
+description: This search is to detect a suspicious modification of registry related
+  to UAC bypass. This technique is to modify the registry in this detection, create
+  a registry value with the path of the payload and run WSreset.exe to bypass User
+  account Control.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*"
+  (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "DelegateExecute")
+  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
+  Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `wsreset_uac_bypass_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
@@ -27,10 +27,27 @@ references:
 tags:
  analytic_story:
  - Windows Defense Evasion Tactics
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  - Scope:Incoming
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log
+  impact: 70
  kill_chain_phases:
  - Exploitation
+  message: Suspicious modification of registry $registry_path$ with possible payload
+    path $registry_value_name$ in $dest$
  mitre_attack_id:
  - T1548.002
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -40,23 +57,6 @@ tags:
  - Registry.registry_path
  - Registry.registry_key_name
  - Registry.registry_value_name
-  - Registry.dest 
-  security_domain: endpoint
-  impact: 70
-  confidence: 90 
-  # (impact * confidence)/100
+  - Registry.dest
  risk_score: 63
-  context:
-  - Source:Endpoint
-  - Stage:Persistence
-  - Stage:Privilege Escalation
-  - Stage:Defense Evasion
-  - Scope:Incoming
-  message: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log
+  security_domain: endpoint
@@ -5,7 +5,7 @@
    "id": {
      "group": null, 
      "name": "DA-ESS-ContentUpdate", 
-      "version": "3.25.2"
+      "version": "3.26.0"
    }, 
    "author": [
      {
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-26T11:37:21 UTC
+# On Date: 2021-07-29T20:53:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -377,7 +377,7 @@ modification_date = 2020-02-04
 id = 854d78bf-d0e2-4f4e-b05c-640905f86d7a
 version = 3
 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"]
-detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Rule", "ESCU - Investigate Pass the Hash Attempts - Rule", "ESCU - Investigate Pass the Ticket Attempts - Rule", "ESCU - Investigate Previous Unseen User - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"]
+detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"]
 mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation"], "mitre_attack": ["T1003.001", "T1003.002", "T1003.003", "T1059.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]}
 investigative_searches = ["ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"]
 support_searches = []
@@ -476,7 +476,7 @@ modification_date = 2020-10-21
 id = 66b0fe0c-1351-11eb-adc1-0242ac120002
 version = 1
 reference = ["https://attack.mitre.org/tactics/TA0010/"]
-detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get Notable History - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule"]
+detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule"]
 mappings = {"cis20": ["CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Exfiltration", "Exploitation"], "mitre_attack": ["T1041", "T1048", "T1048.003", "T1114", "T1114.001", "T1114.003", "T1537"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.DS"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
 support_searches = []
@@ -1273,7 +1273,7 @@ modification_date = 2020-08-25
 id = 8168ca88-392e-42f4-85a2-767579c660ce
 version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
-detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Get All AWS Activity From IP Address - Rule"]
+detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1537"], "nist": ["DE.AE", "DE.CM", "DE.DP", "ID.AM", "PR.AC", "PR.DS"]}
 investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Previously Seen Cloud Instance Modifications By User - Update"]
@@ -1689,7 +1689,7 @@ modification_date = 2018-05-31
 id = 56e24a28-5003-4047-b2db-e8f3c4618064
 version = 1
 reference = ["https://attack.mitre.org/wiki/Defense_Evasion"]
-detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"]
+detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"]
 mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1222.001", "T1548.002", "T1562.001", "T1564.001"], "nist": ["DE.CM", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-20T20:51:20 UTC
+# On Date: 2021-07-29T20:53:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -263,7 +263,7 @@ version = 3
 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
 spec_version = 3
-searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"]
+searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"]
 description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping.
 narrative = Credential dumping&#151;gathering credentials from a target system, often hashed or encrypted&#151;is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\
 Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\
@@ -332,7 +332,7 @@ version = 1
 references = ["https://attack.mitre.org/tactics/TA0010/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}]
 spec_version = 3
-searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"]
+searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"]
 description = The stealing of data by an adversary.
 narrative = Exfiltration comes in many flavors.  Adversaries can collect data over encrypted or non-encrypted channels.  They can utilise Command and Control channels that are already in place to exfiltrate data.  They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data.  Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place.

@@ -883,7 +883,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
+searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
 narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities.

@@ -1060,7 +1060,7 @@ version = 1
 references = ["https://en.wikipedia.org/wiki/Trickbot", "https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/"]
 maintainers = [{"company": "Teoderick Contreras, Splunk", "email": "-", "name": "Rod Soto"}]
 spec_version = 3
-searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Powershell Remote Thread To Known Windows Process - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Trickbot Named Pipe - Rule", "ESCU - Wermgr Process Connecting To IP Check Web Services - Rule", "ESCU - Wermgr Process Create Executable File - Rule", "ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule", "ESCU - Write Executable in SMB Share - Rule"]
+searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawn CMD Process - Rule", "ESCU - Powershell Remote Thread To Known Windows Process - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Trickbot Named Pipe - Rule", "ESCU - Wermgr Process Connecting To IP Check Web Services - Rule", "ESCU - Wermgr Process Create Executable File - Rule", "ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule", "ESCU - Write Executable in SMB Share - Rule"]
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection even in LDAP environment.
 narrative = trickbot banking trojan campaigns targeting banks and other vertical sectors.This malware is known in Microsoft Windows OS where target security Microsoft Defender to prevent its detection and removal. steal Verizon credentials and targeting banks using its multi component modules that collect and exfiltrate data.

@@ -1142,7 +1142,7 @@ version = 1
 references = ["https://attack.mitre.org/wiki/Defense_Evasion"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others 
 narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms.

@@ -2363,6 +2363,18 @@ annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Ob
 known_false_positives = None thus far found
 providing_technologies = []

+[savedsearch://ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the most basic use cases for credentials being taken for offline cracking. \
+During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.
+how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]}
+known_false_positives = Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives.
+providing_technologies = []
+
 [savedsearch://ESCU - Detect Credential Dumping through LSASS access - Rule]
 type = detection
 asset_type = Windows
@@ -2938,7 +2950,7 @@ asset_type = AWS Instance
 confidence = medium
 explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
-annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]}
+annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
 known_false_positives = None
 providing_technologies = []

@@ -3163,6 +3175,16 @@ annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Comman
 known_false_positives = It is uncommon for normal users to execute a series of commands used for network discovery. System administrators often use scripts to execute these commands. These can generate false positives.
 providing_technologies = []

+[savedsearch://ESCU - Detect shared ec2 snapshot - Rule]
+type = detection
+asset_type = EC2 Snapshot
+confidence = medium
+explanation = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot.
+how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs.
+annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
+known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
+providing_technologies = []
+
 [savedsearch://ESCU - Detect web traffic to dynamic domain providers - Rule]
 type = detection
 asset_type = Endpoint
@@ -4283,6 +4305,16 @@ annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["
 known_false_positives = None at this time
 providing_technologies = []

+[savedsearch://ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the the actual trickbot payload.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed mshta.exe may be used.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"]}
+known_false_positives = limitted. this anomaly behavior is not commonly seen in clean host.
+providing_technologies = []
+
 [savedsearch://ESCU - Msmpeng Application DLL Side Loading - Rule]
 type = detection
 asset_type = 
@@ -4417,6 +4449,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.00
 known_false_positives = A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc.
 providing_technologies = []

+[savedsearch://ESCU - NET Profiler UAC bypass - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search is to detect modification of registry to bypass UAC windows feature. This technique is to add a payload dll path on .NET COR file path that will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring the registry key and values in the detection area. It may happened that windows update some dll related to mmc.exe and add dll path in this registry. In this case filtering is needed.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]}
+known_false_positives = limited false positive. It may trigger by some windows update that will modify this registry.
+providing_technologies = []
+
 [savedsearch://ESCU - NLTest Domain Trust Discovery - Rule]
 type = detection
 asset_type = Endpoint
@@ -4619,6 +4661,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.00
 known_false_positives = default browser not in the filter list
 providing_technologies = []

+[savedsearch://ESCU - Office Product Spawn CMD Process - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = this search is to detect a suspicious office product process that spawn cmd child process. This is commonly seen in a ms office product having macro to execute shell command to download or execute malicious lolbin relative to its malicious code. This is seen in trickbot spear phishing doc where it execute shell cmd to run mshta payload.
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"]}
+known_false_positives = IT or network admin may create an document automation that will run shell script.
+providing_technologies = []
+
 [savedsearch://ESCU - Office Product Spawning BITSAdmin - Rule]
 type = detection
 asset_type = 
@@ -5234,6 +5286,16 @@ annotations = {"kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre
 known_false_positives = Limited to no known false positives.
 providing_technologies = []

+[savedsearch://ESCU - SAM Database File Access Attempt - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies access to SAM, SYSTEM or SECURITY databases' within the file path of `windows\system32\config` using Windows Security EventCode 4663. This particular behavior is related to credential access, an attempt to either use a Shadow Copy or recent CVE-2021-36934 to access the SAM database. The Security Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7, 8.1 and 10 that stores users' passwords.
+how_to_implement = To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]}
+known_false_positives = Natively, `dllhost.exe` will access the files. Every environment will have additional native processes that do as well. Filter by process_name. As an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`.
+providing_technologies = []
+
 [savedsearch://ESCU - SLUI RunAs Elevated - Rule]
 type = detection
 asset_type = 
@@ -5387,6 +5449,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Ob
 known_false_positives = Although unlikely, administrators may use wmi to launch scripts for legitimate purposes. Filter as needed.
 providing_technologies = []

+[savedsearch://ESCU - Sdclt UAC Bypass - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search is to detect a suspicious sdclt.exe registry modification. This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe application by modifying some registry that sdclt.exe tries to open or query with payload file path on it to be executed.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]}
+known_false_positives = Limited to no false positives are expected.
+providing_technologies = []
+
 [savedsearch://ESCU - SearchProtocolHost with no Command Line with Network - Rule]
 type = detection
 asset_type = 
@@ -5457,6 +5529,16 @@ annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1136.001"], "nist": ["PR.
 known_false_positives = It is possible that an administrator created and deleted an account in a short time period.  Verifying activity with an administrator is advised.
 providing_technologies = []

+[savedsearch://ESCU - SilentCleanup UAC Bypass - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search is to detect a suspicious modification of registry that may related to UAC bypassed. This registry will be trigger once the attacker abuse the silentcleanup task schedule to gain high privilege execution that will bypass User control account.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]}
+known_false_positives = unknown
+providing_technologies = []
+
 [savedsearch://ESCU - Single Letter Process On Endpoint - Rule]
 type = detection
 asset_type = Endpoint
@@ -5955,6 +6037,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]}
 known_false_positives = unknown
 providing_technologies = []

+[savedsearch://ESCU - UAC Bypass MMC Load Unsigned Dll - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry that will trigger the mmc.exe to load the dll path
+how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]}
+known_false_positives = unknown. all of the dll loaded by mmc.exe is microsoft signed dll.
+providing_technologies = []
+
 [savedsearch://ESCU - USN Journal Deletion - Rule]
 type = detection
 asset_type = Endpoint
@@ -6122,6 +6214,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Ob
 known_false_positives = Some software may create WMI temporary event subscriptions for various purposes. The included search contains an exception for two of these that occur by default on Windows 10 systems. You may need to modify the search to create exceptions for other legitimate events.
 providing_technologies = []

+[savedsearch://ESCU - WSReset UAC Bypass - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = This search is to detect a suspicious modification of registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User account Control.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]}
+known_false_positives = unknown
+providing_technologies = []
+
 [savedsearch://ESCU - Wbemprox COM Object Execution - Rule]
 type = detection
 asset_type = 
@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 34790
+build = 35236

 [triggers]
 reload.analytic_stories = simple
@@ -19,7 +19,7 @@ reload.content-version = simple

 [launcher]
 author = Splunk
-version = 3.25.2
+version = 3.26.0
 description = Explore the Analytic Stories included with ES Content Updates.

 [ui]
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-26T11:37:20 UTC
+# On Date: 2021-07-29T20:53:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,2 +1,2 @@
 [content-version]
-version = 3.25.2
+version = 3.26.0
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-26T11:37:21 UTC
+# On Date: 2021-07-29T20:53:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -2311,6 +2311,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

+[sam_database_file_access_attempt_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [slui_runas_elevated_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-26T11:37:20 UTC
+# On Date: 2021-07-29T20:53:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-07-26T11:37:21 UTC
+# On Date: 2021-07-29T20:53:17 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -263,7 +263,7 @@ version = 3
 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}]
 spec_version = 3
-searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Rule", "ESCU - Investigate Pass the Hash Attempts - Rule", "ESCU - Investigate Pass the Ticket Attempts - Rule", "ESCU - Investigate Previous Unseen User - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"]
+searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"]
 description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping.
 narrative = Credential dumping&#151;gathering credentials from a target system, often hashed or encrypted&#151;is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\
 Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\
@@ -332,7 +332,7 @@ version = 1
 references = ["https://attack.mitre.org/tactics/TA0010/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}]
 spec_version = 3
-searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get Notable History - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"]
+searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"]
 description = The stealing of data by an adversary.
 narrative = Exfiltration comes in many flavors.  Adversaries can collect data over encrypted or non-encrypted channels.  They can utilise Command and Control channels that are already in place to exfiltrate data.  They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data.  Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place.

@@ -883,7 +883,7 @@ version = 1
 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
+searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
 narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities.

@@ -1167,7 +1167,7 @@ version = 1
 references = ["https://attack.mitre.org/wiki/Defense_Evasion"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others 
 narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms.

@@ -2975,7 +2975,7 @@ asset_type = AWS Instance
 confidence = medium
 explanation = This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security Hub inputs. The threshold_value should be tuned to your environment and schedule these searches according to the bucket span interval.
-annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]}
+annotations = {"cis20": ["CIS 13"], "nist": ["DE.DP"]}
 known_false_positives = None
 providing_technologies = []

@@ -5311,6 +5311,16 @@ annotations = {"kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre
 known_false_positives = Limited to no known false positives.
 providing_technologies = []

+[savedsearch://ESCU - SAM Database File Access Attempt - Rule]
+type = detection
+asset_type = 
+confidence = medium
+explanation = The following analytic identifies access to SAM, SYSTEM or SECURITY databases' within the file path of `windows\system32\config` using Windows Security EventCode 4663. This particular behavior is related to credential access, an attempt to either use a Shadow Copy or recent CVE-2021-36934 to access the SAM database. The Security Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7, 8.1 and 10 that stores users' passwords.
+how_to_implement = To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]}
+known_false_positives = Natively, `dllhost.exe` will access the files. Every environment will have additional native processes that do as well. Filter by process_name. As an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`.
+providing_technologies = []
+
 [savedsearch://ESCU - SLUI RunAs Elevated - Rule]
 type = detection
 asset_type = 
@@ -5,7 +5,7 @@
    "id": {
      "group": null, 
      "name": "DA-ESS_AmazonWebServices_Content", 
-      "version": "3.25.2"
+      "version": "3.26.0"
    }, 
    "author": [
      {
--- a/Show More
+++ b/Show More