diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml
new file mode 100644
index 0000000000..89c68e99d5
--- /dev/null
+++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml
@@ -0,0 +1,69 @@
+name: Windows Access Token Manipulation SeDebugPrivilege
+id: 6ece9ed0-5f92-4315-889d-48560472b188
+version: 1
+date: '2022-08-24'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies a suspicious process enabling the "SeDebugPrivilege" privilege token. 
+  SeDebugPrivilege allows a process to inspect and adjust the memory of other processes, and has long been a security concern. SeDebugPrivilege allows the token bearer to access any process or thread, regardless of security descriptors, per Palantir.
+  This technique is abused by adversaries to gain debug privileges with their malicious software to be able to access or debug a process to dump credentials or to inject malicious code.
+search: '`wineventlog_security` EventCode=4703 EnabledPrivilegeList = "*SeDebugPrivilege*" AND NOT(ProcessName IN ("*\\Program File*", "*\\System32\\lsass.exe*", "*\\SysWOW64\\lsass.exe*", "*\\SysWOW64\\svchost.exe*", "*\\System32\\svchost.exe*"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer ProcessName ProcessId SubjectDomainName SubjectUserName SubjectUserSid TargetUserName TargetLogonId TargetDomainName EnabledPrivilegeList action
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_access_token_manipulation_sedebugprivilege_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Security Event Logs with 4703 EventCode enabled. The Windows TA is also
+  required.
+known_false_positives: Some native binaries and browser applications may request SeDebugPrivilege. Filter as needed.
+references:
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4703
+- https://devblogs.microsoft.com/oldnewthing/20080314-00/?p=23113
+- https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e
+- https://atomicredteam.io/privilege-escalation/T1134.001/#atomic-test-2---%60sedebugprivilege%60-token-duplication
+tags:
+  analytic_story:
+  - Brute Ratel C4
+  asset_type:  Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/sedebugprivilege_token/security-xml.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: A process $ProcessName$ adjust its privileges with SeDebugPrivilege on $Computer$.
+  mitre_attack_id:
+  - T1134.002
+  - T1134
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ProcessName 
+  - Security_ID 
+  - action 
+  - result 
+  - Process_ID 
+  - Message 
+  - member_dn 
+  - ComputerName 
+  - user
+  risk_score: 36
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml
new file mode 100644
index 0000000000..cd80686ee5
--- /dev/null
+++ b/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml
@@ -0,0 +1,74 @@
+name: Windows Access Token Manipulation Winlogon Duplicate Token Handle
+id: dda126d7-1d99-4f0b-b72a-4c14031f9398
+version: 1
+date: '2022-08-24'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel: []
+description: The following analytic identifies a process requesting access to winlogon.exe attempting to duplicate its handle. 
+  This technique was seen in several adversaries to gain privileges for their process. 
+  Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens.
+search: '`sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") GrantedAccess = 0x1040 
+  | stats count min(_time) as firstTime max(_time) as lastTime 
+  by SourceImage TargetImage SourceProcessGUID TargetProcessGUID SourceProcessId TargetProcessId GrantedAccess CallTrace Computer user_id
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_access_token_manipulation_winlogon_duplicate_token_handle_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records process activity from your hosts to populate the endpoint data model
+  in the processes node. If you are using Sysmon, you must have at least version 6.0.4
+  of the Sysmon TA.
+known_false_positives: It is possible legitimate applications will request access to winlogon, filter as needed.
+references:
+  - https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle
+  - https://attack.mitre.org/techniques/T1134/001/
+tags:
+  analytic_story:
+  - Brute Ratel C4
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/brute_duplicate_token/sysmon.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: A process $SourceImage$ is duplicating the handle token of winlogon.exe in $Computer$
+  mitre_attack_id:
+  - T1134.001
+  - T1134
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  - name: SourceImage
+    type: Process Name
+    role:
+    - Parent Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - SourceImage 
+  - TargetImage 
+  - SourceProcessGUID 
+  - TargetProcessGUID 
+  - SourceProcessId 
+  - TargetProcessId 
+  - GrantedAccess 
+  - CallTrace 
+  - Computer 
+  - user_id
+  risk_score: 36
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml
new file mode 100644
index 0000000000..b46fcfda5b
--- /dev/null
+++ b/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml
@@ -0,0 +1,75 @@
+name: Windows Access Token Winlogon Duplicate Handle In Uncommon Path
+id: b8f7ed6b-0556-4c84-bffd-839c262b0278
+version: 1
+date: '2022-08-24'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies a process requesting access in winlogon.exe to duplicate its handle with a non-common or public process source path. 
+  This technique was seen where adversaries attempt to gain privileges to their process. 
+  This duplicate handle access technique, may refer to a malicious process duplicating the process token of winlogon.exe and using it to a new process instance.
+  Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens.
+search: '`sysmon` EventCode=10  TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") AND GrantedAccess = 0x1040 
+  AND NOT (SourceImage IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage SourceProcessGUID TargetProcessGUID SourceProcessId TargetProcessId GrantedAccess CallTrace
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records process activity from your hosts to populate the endpoint data model
+  in the processes node. If you are using Sysmon, you must have at least version 6.0.4
+  of the Sysmon TA.
+known_false_positives: It is possible legitimate applications will request access to winlogon, filter as needed.
+references:
+  - https://docs.microsoft.com/en-us/windows/win32/api/handleapi/nf-handleapi-duplicatehandle
+  - https://attack.mitre.org/techniques/T1134/001/
+tags:
+  analytic_story:
+  - Brute Ratel C4
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/brute_duplicate_token/sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: a process $SourceImage$ is duplicating the handle token of winlogon.exe in $Computer$
+  mitre_attack_id:
+  - T1134.001
+  - T1134
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  - name: SourceImage
+    type: Process Name
+    role:
+    - Parent Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - SourceImage 
+  - TargetImage 
+  - SourceProcessGUID 
+  - TargetProcessGUID 
+  - SourceProcessId 
+  - TargetProcessId 
+  - GrantedAccess 
+  - CallTrace 
+  - Computer 
+  - user_id
+  risk_score: 49
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml
new file mode 100644
index 0000000000..0791d83312
--- /dev/null
+++ b/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml
@@ -0,0 +1,77 @@
+name: Windows Defacement Modify Transcodedwallpaper File
+id: e11c3d90-5bc7-42ad-94cd-ba75db10d897
+version: 1
+date: '2022-08-25'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a modification to the Transcodedwallpaper file in the wallpaper theme directory 
+  to change the wallpaper of the host machine. This technique was seen in adversaries attempting to deface 
+  or change the desktop wallpaper of the targeted host. During our testing, the common process that affects or changes the wallpaper 
+  if a user changes it via desktop personalized setting is explorer.exe.
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_path !="*\\Windows\\Explorer.EXE" 
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid  Processes.original_file_name
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  | join proc_guid, _time [ 
+  | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem
+  where Filesystem.file_path = "*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper"  
+  by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid
+  | `drop_dm_object_name(Filesystem)` 
+  |rename process_guid as proc_guid 
+  | fields file_name file_path process_name process_path process dest file_create_time _time proc_guid] 
+  | `windows_defacement_modify_transcodedwallpaper_file_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the 
+  process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, 
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: 3rd part software application can change the wallpaper. Filter is needed.
+references:
+- https://forums.ivanti.com/s/article/Wallpaper-Windows-Settings-Desktop-Settings-and-the-transcodedwallpaper-jpg?language=en_US
+- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom_sifreli.a
+tags:
+  analytic_story:
+  - Brute Ratel C4
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/wallpaper_via_transcodedwallpaper/sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: modification or creation of transcodedwallpaper file by $process_name$ in $dest$
+  mitre_attack_id:
+  - T1491
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - dest
+  - file_create_time
+  - file_name
+  - file_path
+  - process_name
+  - process_path
+  - process
+  risk_score: 9
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_process_injection_with_public_source_path.yml b/detections/endpoint/windows_process_injection_with_public_source_path.yml
new file mode 100644
index 0000000000..cd521448ea
--- /dev/null
+++ b/detections/endpoint/windows_process_injection_with_public_source_path.yml
@@ -0,0 +1,76 @@
+name: Windows Process Injection With Public Source Path
+id: 492f09cf-5d60-4d87-99dd-0bc325532dda
+version: 1
+date: '2022-08-24'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel: []
+description: The following analytic identifies a process in a non-standard file path on Windows attempting to create a remote thread into a process. This Windows API,CreateRemoteThread, is commonly used by adversaries
+  for process injection to evade detections or gain privilege escalation.  
+search: '`sysmon` EventCode=8 TargetImage = "*.exe" AND NOT(SourceImage IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage signature TargetProcessGuid SourceProcessGuid TargetProcessId SourceProcessId StartAddress EventCode Computer 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_process_injection_with_public_source_path_filter`'
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records process activity from your hosts to populate the endpoint data model
+  in the processes node. If you are using Sysmon, you must have at least version 6.0.4
+  of the Sysmon TA.
+known_false_positives: Some security products or third party applications may utilize CreateRemoteThread, filter as needed before enabling as a notable.
+references:
+- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/
+tags:
+  analytic_story:
+  - Brute Ratel C4
+  asset_type: 80
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/create_remote_thread/sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: process $SourceImage$ create a remote thread to process $TargetImage$ on host $Computer$
+  mitre_attack_id:
+  - T1055
+  - T1055.002
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: SourceImage
+    type: Process
+    role:
+    - Attacker
+  - name: TargetImage
+    type: Process
+    role:
+    - Target
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - SourceImage
+  - TargetImage
+  - TargetProcessId
+  - SourceProcessId
+  - StartAddress
+  - EventCode
+  - Computer
+  - signature 
+  - TargetProcessGuid 
+  - SourceProcessGuid 
+  - StartAddress
+  risk_score: 64
+  security_domain: endpoint
diff --git a/detections/endpoint/windows_service_deletion_in_registry.yml b/detections/endpoint/windows_service_deletion_in_registry.yml
new file mode 100644
index 0000000000..aec113fbea
--- /dev/null
+++ b/detections/endpoint/windows_service_deletion_in_registry.yml
@@ -0,0 +1,72 @@
+name: Windows Service Deletion In Registry
+id: daed6823-b51c-4843-a6ad-169708f1323e
+version: 1
+date: '2022-08-24'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a service being deleted from the Windows Registry under CurrentControlSet\Services. 
+  Adversaries may delete a service as part of defense evasion.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\SYSTEM\\CurrentControlSet\\Services*" AND (Registry.action = deleted OR (Registry.registry_value_name = DeleteFlag AND Registry.registry_value_data = 0x00000001 AND Registry.action=modified))
+  by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_value_name Registry.action Registry.dest 
+  | `drop_dm_object_name(Registry)`
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_service_deletion_in_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: This event can be seen when administrator delete a service or uninstall/reinstall a software that creates service entry,
+  but it is still recommended to check this alert with high priority.
+references:
+- https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/
+tags:
+  analytic_story:
+  - Brute Ratel C4
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/service_deletion/sysmon.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: A service was deleted on $dest$ within the Windows registry.
+  mitre_attack_id:
+  - T1489
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  - Processes.process_id
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.process_guid
+  risk_score: 18
+  security_domain: endpoint
diff --git a/tests/endpoint/windows_access_token_manipulation_sedebugprivilege.test.yml b/tests/endpoint/windows_access_token_manipulation_sedebugprivilege.test.yml
new file mode 100644
index 0000000000..ae6569743d
--- /dev/null
+++ b/tests/endpoint/windows_access_token_manipulation_sedebugprivilege.test.yml
@@ -0,0 +1,13 @@
+name: Windows Access Token Manipulation SeDebugPrivilege Unit Test
+tests:
+- name: Windows Access Token Manipulation SeDebugPrivilege
+  file: endpoint/windows_access_token_manipulation_sedebugprivilege.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: security-xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/sedebugprivilege_token/security-xml.log
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.test.yml b/tests/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.test.yml
new file mode 100644
index 0000000000..d9a4893617
--- /dev/null
+++ b/tests/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.test.yml
@@ -0,0 +1,13 @@
+name: Windows Access Token Manipulation Winlogon Duplicate Token Handle Unit Test
+tests:
+- name: Windows Access Token Manipulation Winlogon Duplicate Token Handle
+  file: endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/brute_duplicate_token/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.test.yml b/tests/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.test.yml
new file mode 100644
index 0000000000..ce8a6ecca5
--- /dev/null
+++ b/tests/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.test.yml
@@ -0,0 +1,13 @@
+name: Windows Access Token Winlogon Duplicate Handle In Uncommon Path Unit Test
+tests:
+- name: Windows Access Token Winlogon Duplicate Handle In Uncommon Path
+  file: endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/brute_duplicate_token/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_defacement_modify_transcodedwallpaper_file.test.yml b/tests/endpoint/windows_defacement_modify_transcodedwallpaper_file.test.yml
new file mode 100644
index 0000000000..d076f5424b
--- /dev/null
+++ b/tests/endpoint/windows_defacement_modify_transcodedwallpaper_file.test.yml
@@ -0,0 +1,13 @@
+name: Windows Defacement Modify Transcodedwallpaper File Unit Test
+tests:
+- name: Windows Defacement Modify Transcodedwallpaper File
+  file: endpoint/windows_defacement_modify_transcodedwallpaper_file.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/wallpaper_via_transcodedwallpaper/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_process_injection_with_public_source_path.test.yml b/tests/endpoint/windows_process_injection_with_public_source_path.test.yml
new file mode 100644
index 0000000000..9459363c8e
--- /dev/null
+++ b/tests/endpoint/windows_process_injection_with_public_source_path.test.yml
@@ -0,0 +1,13 @@
+name: Windows Process Injection With Public Source Path Unit Test
+tests:
+- name: Windows Process Injection With Public Source Path
+  file: endpoint/windows_process_injection_with_public_source_path.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/create_remote_thread/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
diff --git a/tests/endpoint/windows_service_deletion_in_registry.test.yml b/tests/endpoint/windows_service_deletion_in_registry.test.yml
new file mode 100644
index 0000000000..54a7ad09e3
--- /dev/null
+++ b/tests/endpoint/windows_service_deletion_in_registry.test.yml
@@ -0,0 +1,14 @@
+name: Windows Service Deletion In Registry Unit Test
+tests:
+- name: Windows Service Deletion In Registry
+  file: endpoint/windows_service_deletion_in_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/service_deletion/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+
+    update_timestamp: true