From 07fbcc49a36b6338cb66aa146e918d0b1ff8ed02 Mon Sep 17 00:00:00 2001
From: d1vious <josehelps@gmail.com>
Date: Fri, 4 Feb 2022 15:00:40 -0500
Subject: [PATCH 1/5] TR-1677 fixing logic in detection to avoid null pointer
 exception errors

---
 .../endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml | 2 +-
 detections/endpoint/ssa___wbadmin_delete_system_backups.yml   | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
index 805aa68620..7308cf98e5 100644
--- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
@@ -14,7 +14,7 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve
   "string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
   null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
-  "event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process,
+  "event_id"), "string", null) | where cmd_line IS NOT NULL AND process_name LIKE "%rundll32.exe%" AND match_regex(process,
   /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time =
   timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id,
   "process_name", process_name, "process", process]) | into write_ssa_detected_events();'
diff --git a/detections/endpoint/ssa___wbadmin_delete_system_backups.yml b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml
index 263ce5b13b..9e3dd02435 100644
--- a/detections/endpoint/ssa___wbadmin_delete_system_backups.yml
+++ b/detections/endpoint/ssa___wbadmin_delete_system_backups.yml
@@ -15,9 +15,9 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="wbadmin.exe"
+  (cmd_line IS NOT NULL AND process_name IS NOT NULL) AND (process_name="wbadmin.exe"
   AND like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line,
-  "%systemstatebackup%") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "%systemstatebackup%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
   process_name, "parent_process_name", parent_process_name, "process_path", process_path])

From 2943bdbe246a4f74ed7e5959615767596bedf18f Mon Sep 17 00:00:00 2001
From: d1vious <josehelps@gmail.com>
Date: Fri, 4 Feb 2022 15:42:43 -0500
Subject: [PATCH 2/5] adding additional null check

---
 .../endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
index 7308cf98e5..003e0118ca 100644
--- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
@@ -14,7 +14,7 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve
   "string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
   null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
-  "event_id"), "string", null) | where cmd_line IS NOT NULL AND process_name LIKE "%rundll32.exe%" AND match_regex(process,
+  "event_id"), "string", null) | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name LIKE "%rundll32.exe%" AND match_regex(process,
   /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time =
   timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id,
   "process_name", process_name, "process", process]) | into write_ssa_detected_events();'

From 4fbc9ccbe65c6964fce7284f18d893b009b8bb6e Mon Sep 17 00:00:00 2001
From: d1vious <josehelps@gmail.com>
Date: Fri, 4 Feb 2022 16:25:42 -0500
Subject: [PATCH 3/5] passed testing

---
 ...detect_dump_lsass_memory_using_comsvcs.yml |  2 +-
 ...f_lolbas_executed_in_short_time_window.yml | 69 +++++++++++++++++++
 2 files changed, 70 insertions(+), 1 deletion(-)
 create mode 100644 detections/endpoint/ssa___unusual_number_of_lolbas_executed_in_short_time_window.yml

diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
index 003e0118ca..a0580d695f 100644
--- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
@@ -14,7 +14,7 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve
   "string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
   null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
-  "event_id"), "string", null) | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name LIKE "%rundll32.exe%" AND match_regex(process,
+  "event_id"), "string", null) | where process IS NOT NULL AND process_name IS NOT NULL AND process_name LIKE "%rundll32.exe%" AND match_regex(process,
   /(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time =
   timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id,
   "process_name", process_name, "process", process]) | into write_ssa_detected_events();'
diff --git a/detections/endpoint/ssa___unusual_number_of_lolbas_executed_in_short_time_window.yml b/detections/endpoint/ssa___unusual_number_of_lolbas_executed_in_short_time_window.yml
new file mode 100644
index 0000000000..a8875ed776
--- /dev/null
+++ b/detections/endpoint/ssa___unusual_number_of_lolbas_executed_in_short_time_window.yml
@@ -0,0 +1,69 @@
+name: Unusual number of LOLBAS executed in short time window
+id: 59c0dd70-169c-4900-9a1f-bfcf13302f93
+version: 3
+date: '2021-11-30'
+author: Ignacio Bermudez Corrales, Splunk
+type: Anomaly
+datamodel: []
+description: Living Off The Land Binaries, Scripts, and Libraries (LOLBAS) are native system tools that threat actors leverage to run discovery on a system, move laterally, or increase their privileges.
+  Common threat actor behavior is to run scripts that execute many of these tools together in a short time window to accomplish their objectives.
+  This detection looks for a high distinct count (outlier > 99% distribution) of these executables launched in a window of 300 seconds on a single device.
+  It is not uncommon for an administrator to use these tools for system management, it is unusual to see many of them leverage in short time windows unless done by a script.
+search: '| from read_ssa_enriched_events()
+  | eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), "string", null)), username=ucast(map_get(input_event, "dest_user_primary_artifact"), "string", null)
+  | where process_name=="regsvcs.exe" OR process_name=="ftp.exe" OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe" OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe"
+  OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe" OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe" OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe" OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe"
+  OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe" OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe" OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe" OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe" OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe" OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe" OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe" OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe"
+  OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe" OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe" OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe" OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe"
+  OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe" OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe" OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe"
+  OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe" OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe" OR process_name=="msconfig.exe"
+  | stats estdc(process_name) as lolbas_counter by device, process_name, username, span(timestamp, 300s)
+  | eval lolbas_counter=lolbas_counter*1.0
+  | rename window_end as timestamp
+  | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" window=2419200000L
+  | where label AND quantile>0.99
+  | eval start_time = window_start, end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter", lolbas_counter, "quantile", quantile, "device", device, "process_name", process_name, "user", username])
+  | into write_ssa_detected_events();'
+how_to_implement: Collect endpoint data such as sysmon or 4688 events.
+known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS
+  applications, usually when this detection triggers as a false positive, it tends to be due to a administrative script leveraging these tools.'
+references:
+- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
+tags:
+  analytic_story:
+  - Unusual Processes
+  cis20:
+  - CIS 8
+  confidence: 50
+  context:
+  - source:endpoint
+  - stage: Defense Evasion
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: A system process $process_name$ with commandline $cmd_line$ spawn iin short
+    period of time in host $dest_device_id$
+  mitre_attack_id:
+  - T1059
+  - T1053
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process Name
+    role:
+    - Others
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - _time
+  - process_name
+  risk_score: 25
+  risk_severity: low
+  security_domain: endpoint

From 0b609161f96045cb36274cfad63dc40e0e8a8c0d Mon Sep 17 00:00:00 2001
From: d1vious <josehelps@gmail.com>
Date: Mon, 7 Feb 2022 15:28:12 -0500
Subject: [PATCH 4/5] fixing bug introduced in the macro/lookups addition

---
 bin/jinja2_templates/doc_detections.j2        |  5 ++++
 docs/_pages/detections.md                     |  2 +-
 ...12-detect_new_login_attempts_to_routers.md |  4 +++
 ...tect_unauthorized_assets_by_mac_address.md |  4 +++
 ...9-15-no_windows_updates_in_a_time_frame.md |  4 +++
 ...9-email_attachments_with_lots_of_spaces.md |  5 ++++
 ...7-09-20-large_volume_of_dns_any_queries.md |  4 +++
 ...s_scanning_for_vulnerable_jboss_servers.md |  5 ++++
 ...cious_requests_to_exploit_jboss_servers.md |  5 ++++
 ...-23-monitor_web_traffic_for_brand_abuse.md |  4 +++
 ...0-13-unusually_long_content-type_length.md |  4 +++
 ...018-01-05-monitor_email_for_brand_abuse.md |  5 ++++
 ..._blocked_outbound_traffic_from_your_aws.md |  6 +++++
 ...6-01-detect_large_outbound_icmp_packets.md |  4 +++
 ...18-06-28-detect_s3_access_from_a_new_ip.md |  4 +++
 ...ce_created_with_previously_unseen_image.md |  4 +++
 ...-10-23-wmi_permanent_event_subscription.md |  4 +++
 ...-10-23-wmi_temporary_event_subscription.md |  4 +++
 ...1-27-detect_spike_in_s3_bucket_deletion.md |  4 +++
 .../2018-12-03-remote_wmi_command_attempt.md  |  4 +++
 .../_posts/2018-12-03-usn_journal_deletion.md |  5 ++++
 .../2018-12-06-suspicious_java_classes.md     |  4 +++
 .../2018-12-14-file_with_samsam_extension.md  |  4 +++
 .../2018-12-14-samsam_test_file_write.md      |  4 +++
 ...01-25-processes_tapping_keyboard_events.md |  4 +++
 ..._servers_executing_suspicious_processes.md |  4 +++
 ...5-08-unusually_long_command_line_-_mltk.md |  7 ++++++
 ...credential_dumping_through_lsass_access.md |  5 ++++
 ...-03-detect_mimikatz_using_loaded_images.md |  7 ++++++
 ...6-access_lsass_memory_for_dump_creation.md |  4 +++
 ...9-12-06-create_remote_thread_into_lsass.md |  4 +++
 .../2019-12-10-creation_of_shadow_copy.md     |  4 +++
 ...-01-22-dns_query_length_outliers_-_mltk.md |  6 +++++
 ...-01-28-auto_admin_logon_registry_entry.md} | 22 ++++++++++------
 ...nitor_registry_keys_for_print_monitors.md} | 23 +++++++++++++----
 ...istry_keys_for_creating_shim_databases.md} | 25 +++++++++++++------
 ...pass.md => 2020-01-28-sdclt_uac_bypass.md} | 22 ++++++++++------
 ...=> 2020-01-28-silentcleanup_uac_bypass.md} | 22 ++++++++++------
 ...ss.md => 2020-01-28-wsreset_uac_bypass.md} | 22 ++++++++++------
 ...-03-creation_of_lsass_dump_with_taskmgr.md |  4 +++
 ...20-02-07-macos_-_re-opened_applications.md |  3 +++
 ...02-20-new_container_uploaded_to_aws_ecr.md |  4 +++
 .../2020-02-21-dump_lsass_via_comsvcs_dll.md  |  6 +++++
 ...20-03-16-child_processes_of_spoolsv_exe.md |  4 +++
 .../2020-03-16-detect_rare_executables.md     |  6 +++++
 .../2020-03-16-process_execution_via_wmi.md   |  4 +++
 .../2020-03-16-script_execution_via_wmi.md    |  4 +++
 .../_posts/2020-03-16-spike_in_file_writes.md |  6 +++++
 ...n_eks_kubernetes_cluster_scan_detection.md |  4 +++
 ...mazon_eks_kubernetes_pod_scan_detection.md |  4 +++
 ...0-first_time_seen_child_process_of_zoom.md |  4 +++
 ...activity_from_previously_unseen_account.md |  4 +++
 ...28-detect_aws_console_login_by_new_user.md |  4 +++
 ...tes_aws_detect_suspicious_kubectl_calls.md |  4 +++
 ...interception_by_creation_of_program_exe.md |  4 +++
 ...2020-07-06-short_lived_windows_accounts.md |  4 +++
 .../2020-07-06-windows_event_log_cleared.md   |  6 +++++
 ...20-07-07-remote_desktop_network_traffic.md |  7 ++++++
 ...20-07-08-detect_new_local_admin_account.md |  5 ++++
 ...p_kubernetes_cluster_pod_scan_detection.md |  4 +++
 ...-07-21-attempt_to_stop_security_service.md |  6 +++++
 ...-detect_excessive_user_account_lockouts.md |  4 +++
 .../2020-07-21-detect_outbound_smb_traffic.md |  6 +++++
 ...1-detect_outlook_exe_writing_a_zip_file.md |  4 +++
 ...f_cmd_exe_to_launch_script_interpreters.md |  5 ++++
 ...-21-detection_of_tools_built_by_nirsoft.md |  4 +++
 ...ritten_outside_of_the_outlook_directory.md |  4 +++
 ...rs_sending_high_volume_traffic_to_hosts.md |  5 ++++
 .../2020-07-21-excessive_dns_failures.md      |  5 ++++
 ...first_time_seen_running_windows_service.md |  6 +++++
 ...g_files_and_directories_with_attrib_exe.md |  5 ++++
 ...me_of_network_traffic_from_email_server.md |  4 +++
 ...shell_process_-_execution_policy_bypass.md |  5 ++++
 ...th_invalid_credentials_from_the_same_ip.md |  4 +++
 .../2020-07-21-okta_account_lockout_events.md |  4 +++
 .../2020-07-21-okta_failed_sso_attempts.md    |  4 +++
 ...1-okta_user_logins_from_multiple_cities.md |  4 +++
 ...7-21-overwriting_accessibility_binaries.md |  4 +++
 ...7-21-prohibited_network_traffic_allowed.md |  6 +++++
 .../2020-07-21-protocol_or_port_mismatch.md   |  5 ++++
 ...07-21-remote_desktop_network_bruteforce.md |  5 ++++
 ...emote_desktop_process_running_on_system.md |  5 ++++
 ...21-sc_exe_manipulating_windows_services.md |  9 +++++++
 ...2020-07-21-sql_injection_with_long_urls.md |  4 +++
 docs/_posts/2020-07-22-smb_traffic_spike.md   |  7 ++++++
 .../2020-07-22-smb_traffic_spike_-_mltk.md    |  7 ++++++
 ...-suspicious_email_attachment_extensions.md |  5 ++++
 .../2020-07-22-suspicious_reg_exe_process.md  |  6 +++++
 ...uspicious_writes_to_windows_recycle_bin.md |  4 +++
 docs/_posts/2020-07-22-tor_traffic.md         |  7 ++++++
 .../2020-07-22-unload_sysmon_filter_driver.md |  4 +++
 ...-07-27-aws_detect_attach_to_role_policy.md |  4 +++
 ...07-27-aws_detect_permanent_key_creation.md |  4 +++
 .../2020-07-27-aws_detect_role_creation.md    |  4 +++
 ...-07-27-aws_detect_sts_assume_role_abuse.md |  4 +++
 ...-aws_detect_sts_get_session_token_abuse.md |  4 +++
 ...ct_windows_dns_sigred_via_splunk_stream.md |  4 +++
 ...7-28-detect_windows_dns_sigred_via_zeek.md |  4 +++
 ...ance_modified_by_previously_unseen_user.md |  4 +++
 ...-08-02-detect_f5_tmui_rce_cve-2020-5902.md |  4 +++
 ...-05-detect_new_open_gcp_storage_buckets.md |  4 +++
 ...detect_gcp_storage_access_from_a_new_ip.md |  4 +++
 .../_posts/2020-08-11-detect_arp_poisoning.md |  4 +++
 .../2020-08-11-detect_rogue_dhcp_server.md    |  4 +++
 ...ivity_from_previously_unseen_ip_address.md |  4 +++
 ..._activity_from_previously_unseen_region.md |  4 +++
 ...igh_number_of_cloud_instances_destroyed.md |  4 +++
 ...high_number_of_cloud_instances_launched.md |  5 ++++
 ...ection_by_machine_learning_method_-_ssa.md |  3 +++
 ...rocess_running_from_unexpected_location.md |  5 ++++
 ...-unusual_lolbas_in_short_period_of_time.md |  4 +++
 ...nce_created_in_previously_unused_region.md |  4 +++
 ...calls_from_previously_unseen_user_roles.md |  4 +++
 ...umber_of_cloud_infrastructure_api_calls.md |  4 +++
 ...umber_of_cloud_security_group_api_calls.md |  4 +++
 ...ed_with_previously_unseen_instance_type.md |  4 +++
 .../2020-09-15-detect_zerologon_via_zeek.md   |  4 +++
 ..._or_delete_windows_shares_using_net_exe.md |  4 +++
 ...computer_changed_with_anonymous_account.md |  4 +++
 ...aws_console_login_by_user_from_new_city.md |  5 ++++
 ..._console_login_by_user_from_new_country.md |  5 ++++
 ...s_console_login_by_user_from_new_region.md |  5 ++++
 ...2020-10-08-gcp_detect_gcploit_framework.md |  4 +++
 ...ng_activity_from_previously_unseen_city.md |  4 +++
 ...activity_from_previously_unseen_country.md |  4 +++
 ...tivity_related_to_pass_the_hash_attacks.md |  4 +++
 ...oasting_spn_request_with_rc4_encryption.md |  4 +++
 .../_posts/2020-10-21-detect_kerberoasting.md |  4 +++
 ...20-10-21-detect_snicat_sni_exfiltration.md |  4 +++
 ...ect_ipv6_network_infrastructure_threats.md |  4 +++
 ...20-10-28-detect_port_security_violation.md |  4 +++
 ...ect_software_download_to_network_device.md |  4 +++
 .../2020-10-28-detect_traffic_mirroring.md    |  4 +++
 .../2020-11-06-ryuk_test_files_detected.md    |  4 +++
 ...cution_policy_to_unrestricted_or_bypass.md |  6 +++++
 ...indows_security_account_manager_stopped.md |  4 +++
 ...2020-11-09-common_ransomware_extensions.md |  7 ++++++
 .../2020-11-09-common_ransomware_notes.md     |  7 ++++++
 .../2020-11-09-deleting_shadow_copies.md      |  7 ++++++
 ...xcessive_account_lockouts_from_endpoint.md |  4 +++
 ..._system_network_configuration_discovery.md |  4 +++
 ...rohibited_applications_spawning_cmd_exe.md |  4 +++
 ...8-disabling_remote_user_account_control.md |  6 +++++
 ...cution_of_file_with_multiple_extensions.md |  5 ++++
 ...installation_with_suspicious_parameters.md |  4 +++
 ...pulating_windows_services_registry_keys.md |  5 ++++
 ...2-07-schtasks_used_for_forcing_a_reboot.md |  5 ++++
 .../2020-12-08-shim_database_file_creation.md |  4 +++
 ...12-08-single_letter_process_on_endpoint.md |  4 +++
 ...processes_run_from_unexpected_locations.md |  7 ++++++
 .../2020-12-08-unusually_long_command_line.md |  7 ++++++
 ...i_permanent_event_subscription_-_sysmon.md |  4 +++
 ...burst_correlation_dll_and_network_event.md |  4 +++
 ...12-15-o365_suspicious_rights_delegation.md |  4 +++
 ..._of_login_failures_from_a_single_source.md |  4 +++
 ...excessive_authentication_failures_alert.md |  4 +++
 .../2020-12-16-o365_pst_export_alert.md       |  5 ++++
 ...-o365_suspicious_admin_email_forwarding.md |  5 ++++
 ...6-o365_suspicious_user_email_forwarding.md |  5 ++++
 ...heduled_task_deleted_or_created_via_cmd.md |  5 ++++
 ...1-bcdedit_failure_recovery_modification.md |  5 ++++
 docs/_posts/2021-01-06-supernova_webshell.md  |  4 +++
 ...ng_keys_with_encrypt_policy_without_mfa.md |  4 +++
 ..._with_kms_keys_performing_encryption_s3.md |  4 +++
 ...ontrol_list_created_with_all_open_ports.md |  4 +++
 ...aws_network_access_control_list_deleted.md |  4 +++
 ...cious_microsoft_workflow_compiler_usage.md |  4 +++
 .../2021-01-12-suspicious_msbuild_path.md     |  6 +++++
 .../2021-01-12-suspicious_msbuild_rename.md   |  6 +++++
 .../2021-01-12-suspicious_msbuild_spawn.md    |  4 +++
 ...21-01-12-suspicious_mshta_child_process.md |  4 +++
 ..._connecting_to_dynamic_domain_providers.md |  9 +++++++
 ...ell_process_with_obfuscation_techniques.md |  4 +++
 ...20-detect_rundll32_inline_hta_execution.md |  5 ++++
 .../2021-01-20-suspicious_mshta_spawn.md      |  4 +++
 ...021-01-22-wbadmin_delete_system_backups.md |  5 ++++
 ...021-01-25-nltest_domain_trust_discovery.md |  7 ++++++
 ...l_access_by_provider_user_and_principal.md |  4 +++
 ...01-26-aws_saml_update_identity_provider.md |  4 +++
 ...-26-certutil_exe_certificate_extraction.md |  5 ++++
 ...ws_security_hub_alerts_for_ec2_instance.md |  4 +++
 ...ike_in_aws_security_hub_alerts_for_user.md |  4 +++
 ...o365_add_app_role_assignment_grant_user.md |  5 ++++
 ...1-01-26-o365_excessive_sso_logon_errors.md |  5 ++++
 ...1-01-26-o365_new_federated_domain_added.md |  5 ++++
 .../_posts/2021-01-26-revil_registry_entry.md |  5 ++++
 ...1-27-detect_baron_samedit_cve-2021-3156.md |  4 +++
 ...baron_samedit_cve-2021-3156_via_osquery.md |  4 +++
 ...ect_regsvr32_application_control_bypass.md |  5 ++++
 .../_posts/2021-01-28-ntdsutil_export_ntds.md |  5 ++++
 ...cious_regsvr32_register_suspicious_path.md |  5 ++++
 ...ct_baron_samedit_cve-2021-3156_segfault.md |  4 +++
 ...32_application_control_bypass_-_advpack.md |  4 +++
 ...2_application_control_bypass_-_setupapi.md |  4 +++
 ...2_application_control_bypass_-_syssetup.md |  4 +++
 .../2021-02-04-suspicious_rundll32_startw.md  |  6 +++++
 ...9-suspicious_rundll32_dllregisterserver.md |  4 +++
 ...11-detect_html_help_spawn_child_process.md |  4 +++
 ...-02-12-detect_regasm_spawning_a_process.md |  4 +++
 ...02-12-detect_regsvcs_spawning_a_process.md |  4 +++
 ...6-detect_regasm_with_network_connection.md |  4 +++
 ...-detect_regsvcs_with_network_connection.md |  4 +++
 ...e_policy_version_to_allow_all_resources.md |  4 +++
 .../2021-02-22-cobalt_strike_named_pipes.md   |  6 +++++
 ...2-22-suspicious_curl_network_connection.md |  5 ++++
 .../2021-02-22-suspicious_plistbuddy_usage.md |  4 +++
 ...suspicious_plistbuddy_usage_via_osquery.md |  4 +++
 ...uspicious_sqlite3_lsquarantine_behavior.md |  4 +++
 .../2021-03-01-any_powershell_downloadfile.md |  6 +++++
 ...021-03-01-any_powershell_downloadstring.md |  6 +++++
 .../_posts/2021-03-01-fodhelper_uac_bypass.md |  5 ++++
 .../2021-03-01-ryuk_wake_on_lan_command.md    |  4 +++
 ...us_scheduled_task_from_public_directory.md |  6 +++++
 .../2021-03-02-aws_setdefaultpolicyversion.md |  4 +++
 ...ed_messaging_service_spawning_a_process.md |  4 +++
 ...-02-windows_disableantispyware_registry.md |  5 ++++
 ...2021-03-03-nishang_powershelltcponeline.md |  4 +++
 docs/_posts/2021-03-03-w3wp_spawning_shell.md |  5 ++++
 ...21-03-12-ransomware_notes_bulk_creation.md |  6 +++++
 .../2021-03-12-resize_shadowstorage_volume.md |  4 +++
 ...2021-03-16-high_file_deletion_frequency.md |  5 ++++
 ...3-16-high_process_termination_frequency.md |  4 +++
 .../2021-03-17-clop_common_exec_parameter.md  |  4 +++
 ...3-17-clop_ransomware_known_service_name.md |  4 +++
 ...-process_deleting_its_process_file_path.md |  6 +++++
 ...nload_with_urlcache_and_split_arguments.md |  5 ++++
 ...load_with_verifyctl_and_split_arguments.md |  5 ++++
 ...021-03-23-certutil_with_decode_argument.md |  4 +++
 ...021-03-29-powershell_start-bitstransfer.md |  4 +++
 ...03-31-aws_iam_successful_group_deletion.md |  4 +++
 ...021-03-31-disabling_firewall_with_netsh.md |  4 +++
 .../2021-03-31-dsquery_domain_discovery.md    |  5 ++++
 ...-aws_iam_assume_role_policy_brute_force.md |  4 +++
 .../2021-04-01-aws_iam_delete_policy.md       |  4 +++
 ...21-04-01-aws_iam_failure_group_deletion.md |  4 +++
 ...icious_powershell_executed_as_a_service.md |  4 +++
 ...o_authenticate_from_host_using_kerberos.md |  4 +++
 ...heduled_task_created_within_public_path.md |  8 ++++++
 .../2021-04-12-excel_spawning_powershell.md   |  4 +++
 ...4-12-excel_spawning_windows_script_host.md |  4 +++
 ...t_scheduled_task_created_to_spawn_shell.md |  6 +++++
 .../2021-04-12-winword_spawning_powershell.md |  4 +++
 ...12-winword_spawning_windows_script_host.md |  4 +++
 ...1-04-13-aws_excessive_security_scanning.md |  4 +++
 ...authenticate_using_explicit_credentials.md |  4 +++
 ...ng_to_authenticate_from_host_using_ntlm.md |  4 +++
 ...rs_failing_to_authenticate_from_process.md |  4 +++
 ...otely_failing_to_authenticate_from_host.md |  4 +++
 ...fice_application_spawn_rundll32_process.md |  6 +++++
 ...o_authenticate_from_host_using_kerberos.md |  4 +++
 ...o_authenticate_from_host_using_kerberos.md |  4 +++
 ...-office_document_creating_schedule_task.md |  4 +++
 ...14-office_document_executing_macro_code.md |  6 +++++
 ...-15-dns_exfiltration_using_nslookup_app.md |  7 ++++++
 ...ng_to_authenticate_from_host_using_ntlm.md |  4 +++
 ..._no_command_line_arguments_with_network.md |  4 +++
 ..._remote_thread_to_known_windows_process.md |  4 +++
 ...hedule_task_with_http_command_arguments.md |  4 +++
 ...dule_task_with_rundll32_command_trigger.md |  6 +++++
 ...ess_connecting_to_ip_check_web_services.md |  4 +++
 ...9-wermgr_process_create_executable_file.md |  4 +++
 ...ocess_spawned_cmd_or_powershell_process.md |  4 +++
 ...1-04-21-excessive_usage_of_nslookup_app.md |  7 ++++++
 ...ultiple_archive_files_http_post_traffic.md |  5 ++++
 .../2021-04-22-anomalous_usage_of_7zip.md     |  5 ++++
 ...e_product_spawning_rundll32_with_no_dll.md |  4 +++
 ...-04-22-plain_http_post_exfiltrated_data.md |  5 ++++
 .../_posts/2021-04-22-winword_spawning_cmd.md |  4 +++
 ...04-26-office_product_spawning_bitsadmin.md |  4 +++
 ...-04-26-office_product_spawning_certutil.md |  4 +++
 ...021-04-26-office_product_spawning_mshta.md |  5 ++++
 docs/_posts/2021-04-26-trickbot_named_pipe.md |  4 +++
 docs/_posts/2021-04-29-icacls_deny_command.md |  4 +++
 ...021-04-29-suspicious_driver_loaded_path.md |  4 +++
 docs/_posts/2021-04-29-xmrig_driver_loaded.md |  4 +++
 .../2021-05-04-deleting_of_net_users.md       |  4 +++
 .../2021-05-04-disabling_net_user_account.md  |  4 +++
 ...4-excessive_attempt_to_disable_services.md |  4 +++
 ...21-05-04-excessive_service_stop_attempt.md |  5 ++++
 .../2021-05-04-excessive_usage_of_taskkill.md |  4 +++
 .../_posts/2021-05-04-icacls_grant_command.md |  5 ++++
 ...odify_acl_permission_to_files_or_folder.md |  4 +++
 ...21-05-04-process_kill_base_on_file_path.md |  4 +++
 ...2021-05-05-suspicious_process_file_path.md |  6 +++++
 ...021-05-06-download_files_using_telegram.md |  4 +++
 ...merate_users_local_group_using_telegram.md |  4 +++
 .../2021-05-06-excessive_usage_of_net_app.md  |  5 ++++
 ...s_or_script_creation_in_suspicious_path.md |  6 +++++
 ...2021-05-07-excessive_usage_of_cacls_app.md |  4 +++
 .../2021-05-07-schtasks_run_task_on_demand.md |  4 +++
 ...05-12-delete_shadowcopy_with_powershell.md |  6 +++++
 ...2021-05-13-cmlua_or_cmstplua_uac_bypass.md |  5 ++++
 docs/_posts/2021-05-13-slui_runas_elevated.md |  5 ++++
 .../2021-05-13-slui_spawning_a_process.md     |  5 ++++
 .../2021-05-18-services_escalate_exe.md       |  4 +++
 ...-allow_inbound_traffic_in_firewall_rule.md |  4 +++
 .../2021-05-19-mailsniper_invoke_functions.md |  4 +++
 .../2021-05-20-cmd_echo_pipe_-_escalation.md  |  4 +++
 .../2021-05-21-winrm_spawning_a_process.md    |  4 +++
 ...6-secretdumps_offline_ntds_dumping_tool.md |  4 +++
 ...27-detect_sharphound_file_modifications.md |  5 ++++
 .../2021-05-27-detect_sharphound_usage.md     |  5 ++++
 ...etect_azurehound_command-line_arguments.md |  4 +++
 ...01-detect_azurehound_file_modifications.md |  4 +++
 ...etect_sharphound_command-line_arguments.md |  5 ++++
 .../2021-06-02-conti_common_exec_parameter.md |  4 +++
 .../2021-06-02-modification_of_wallpaper.md   |  6 +++++
 .../2021-06-02-revil_common_exec_parameter.md |  5 ++++
 ...021-06-02-wbemprox_com_object_execution.md |  5 ++++
 ...rocesses_created_in_windows_temp_folder.md |  4 +++
 ...-04-known_services_killed_by_ransomware.md |  5 ++++
 ...-excessive_number_of_taskhost_processes.md |  4 +++
 ...ss_process_injection_via_getprocaddress.md |  4 +++
 ..._script_contains_base64_encoded_content.md |  4 +++
 ...re_with_powershell_script_block_logging.md |  4 +++
 ...tz_with_powershell_script_block_logging.md |  4 +++
 ...021-06-09-unloading_amsi_via_reflection.md |  4 +++
 ...ear_unallocated_sector_using_cipher_app.md |  4 +++
 .../2021-06-10-disable_logs_using_wevtutil.md |  4 +++
 ...rmission_modification_using_takeown_app.md |  4 +++
 ...-06-10-powershell_creating_thread_mutex.md |  4 +++
 ...021-06-10-powershell_domain_enumeration.md |  4 +++
 ...o_memory_via_system_reflection_assembly.md |  4 +++
 ...10-powershell_processing_stream_of_data.md |  4 +++
 ...owershell_using_memory_as_backing_store.md |  4 +++
 ...ent_automatic_repair_mode_using_bcdedit.md |  4 +++
 ...6-10-recon_avproduct_through_pwh_or_wmi.md |  5 ++++
 .../2021-06-10-recon_using_wmi_class.md       |  4 +++
 ...4-wmi_recon_running_process_or_services.md |  4 +++
 ...2021-06-15-wevtutil_usage_to_clear_logs.md |  6 +++++
 ...21-06-15-wevtutil_usage_to_disable_logs.md |  5 ++++
 ...tect_wmi_event_subscription_persistence.md |  4 +++
 ...7-suspicious_event_log_service_behavior.md |  6 +++++
 ...ecute_javascript_with_jscript_com_clsid.md |  4 +++
 ...-powershell_enable_smb1protocol_feature.md |  5 ++++
 ...ursive_delete_of_directory_in_batch_cmd.md |  4 +++
 ...w_file_and_printing_sharing_in_firewall.md |  4 +++
 ...-23-allow_network_discovery_in_firewall.md |  5 ++++
 ...4-excessive_usage_of_sc_service_utility.md |  4 +++
 ...er_of_service_control_start_as_disabled.md |  4 +++
 ...1-print_spooler_adding_a_printer_driver.md |  4 +++
 ...-print_spooler_failed_to_load_a_plug-in.md |  4 +++
 .../2021-07-01-spoolsv_spawning_rundll32.md   |  4 +++
 ...07-01-spoolsv_suspicious_loaded_modules.md |  4 +++
 ...07-01-spoolsv_suspicious_process_access.md |  4 +++
 .../2021-07-01-spoolsv_writing_a_dll.md       |  4 +++
 ...21-07-01-spoolsv_writing_a_dll_-_sysmon.md |  4 +++
 ...05-msmpeng_application_dll_side_loading.md |  5 ++++
 ...-powershell_disable_security_monitoring.md |  5 ++++
 .../2021-07-12-net_profiler_uac_bypass.md     |  4 +++
 ...-07-12-uac_bypass_mmc_load_unsigned_dll.md |  4 +++
 ...tance_created_by_previously_unseen_user.md |  4 +++
 docs/_posts/2021-07-19-aws_createaccesskey.md |  4 +++
 .../2021-07-19-aws_createloginprofile.md      |  4 +++
 .../2021-07-19-aws_updateloginprofile.md      |  4 +++
 .../2021-07-19-detect_new_open_s3_buckets.md  |  4 +++
 ...detect_new_open_s3_buckets_over_aws_cli.md |  4 +++
 ...a_spawning_rundll32_or_regsvr32_process.md |  5 ++++
 ...-07-19-office_product_spawn_cmd_process.md |  4 +++
 .../2021-07-20-detect_shared_ec2_snapshot.md  |  5 ++++
 ...of_shadowcopy_with_script_block_logging.md |  4 +++
 ...-07-23-sam_database_file_access_attempt.md |  4 +++
 ...-rundll32_createremotethread_in_browser.md |  4 +++
 docs/_posts/2021-07-26-rundll32_dnsquery.md   |  4 +++
 ...rundll32_process_creating_exe_dll_files.md |  4 +++
 ...7-26-suspicious_icedid_rundll32_cmdline.md |  4 +++
 ...21-07-26-suspicious_rundll32_plugininit.md |  4 +++
 .../2021-07-27-chcp_command_execution.md      |  4 +++
 ...gsvr32_with_known_silent_switch_cmdline.md |  6 +++++
 ...dll32_create_remote_thread_to_a_process.md |  4 +++
 .../2021-07-30-drop_icedid_license_dat.md     |  4 +++
 ...edid_exfiltrated_archived_file_creation.md |  4 +++
 ...fice_application_spawn_regsvr32_process.md |  4 +++
 ...2021-08-03-sqlite_module_in_temp_folder.md |  4 +++
 ...eate_remote_thread_in_shell_application.md |  4 +++
 .../2021-08-09-uninstall_app_using_msiexec.md |  4 +++
 ...021-08-10-powershell_execute_com_object.md |  5 ++++
 docs/_posts/2021-08-11-fsutil_zeroing_file.md |  4 +++
 ...8-13-uac_bypass_with_colorui_com_object.md |  4 +++
 ...16-gsuite_drive_share_in_external_email.md |  4 +++
 ...8-16-gsuite_email_suspicious_attachment.md |  4 +++
 ...8-17-7zip_commandline_to_smb_share_path.md |  4 +++
 ...ws_ecr_container_scanning_findings_high.md |  4 +++
 ...ning_findings_low_informational_unknown.md |  4 +++
 ..._ecr_container_scanning_findings_medium.md |  4 +++
 ...mail_with_attachment_to_external_domain.md |  4 +++
 docs/_posts/2021-08-18-esentutl_sam_copy.md   |  4 +++
 .../2021-08-18-powershell_4104_hunting.md     |  4 +++
 ...container_upload_outside_business_hours.md |  4 +++
 ...9-aws_ecr_container_upload_unknown_user.md |  4 +++
 ...mail_suspicious_subject_with_attachment.md |  4 +++
 ...ols_passing_authentication_in_cleartext.md |  4 +++
 ...1-08-20-github_commit_changes_in_master.md |  4 +++
 ...2021-08-20-kubernetes_nginx_ingress_lfi.md |  4 +++
 ...2021-08-23-getlocaluser_with_powershell.md |  4 +++
 ...tlocaluser_with_powershell_script_block.md |  4 +++
 ...twmiobject_user_account_with_powershell.md |  4 +++
 ...er_account_with_powershell_script_block.md |  4 +++
 ...email_with_known_abuse_web_service_link.md |  4 +++
 ...8-23-gsuite_suspicious_shared_file_name.md |  4 +++
 ...2021-08-23-kubernetes_nginx_ingress_rfi.md |  4 +++
 ...21-08-24-adsisearcher_account_discovery.md |  4 +++
 ...4-domain_account_discovery_with_dsquery.md |  4 +++
 ...4-domain_account_discovery_with_net_app.md |  4 +++
 ...8-24-domain_account_discovery_with_wmic.md |  4 +++
 ...1-08-24-get-domaintrust_with_powershell.md |  4 +++
 ...omaintrust_with_powershell_script_block.md |  4 +++
 .../2021-08-24-get_aduser_with_powershell.md  |  4 +++
 ...get_aduser_with_powershell_script_block.md |  4 +++
 ...21-08-24-get_domainuser_with_powershell.md |  4 +++
 ...domainuser_with_powershell_script_block.md |  4 +++
 ...24-getwmiobject_ds_user_with_powershell.md |  4 +++
 ...ct_ds_user_with_powershell_script_block.md |  4 +++
 ...-08-24-kubernetes_scanner_image_pulling.md |  4 +++
 ...omain_group_discovery_with_adsisearcher.md |  4 +++
 ...1-08-25-domain_group_discovery_with_net.md |  4 +++
 ...-08-25-domain_group_discovery_with_wmic.md |  4 +++
 ...08-25-elevated_group_discovery_with_net.md |  4 +++
 ...elevated_group_discovery_with_powerview.md |  4 +++
 ...8-25-elevated_group_discovery_with_wmic.md |  4 +++
 .../2021-08-25-getadgroup_with_powershell.md  |  4 +++
 ...getadgroup_with_powershell_script_block.md |  4 +++
 ...21-08-25-getdomaingroup_with_powershell.md |  4 +++
 ...-25-getnettcpconnection_with_powershell.md |  4 +++
 ...5-getwmiobject_ds_group_with_powershell.md |  4 +++
 ...t_ds_group_with_powershell_script_block.md |  4 +++
 ...ultdomainpasswordpolicy_with_powershell.md |  4 +++
 ...wordpolicy_with_powershell_script_block.md |  4 +++
 ...resultantpasswordpolicy_with_powershell.md |  4 +++
 ...wordpolicy_with_powershell_script_block.md |  4 +++
 ...-08-26-get_domainpolicy_with_powershell.md |  4 +++
 ...mainpolicy_with_powershell_script_block.md |  4 +++
 ...omaingroup_with_powershell_script_block.md |  4 +++
 ...8-26-password_policy_discovery_with_net.md |  4 +++
 ...reating_lnk_file_in_suspicious_location.md |  4 +++
 ...8-27-exchange_powershell_abuse_via_ssrf.md |  4 +++
 ...-08-27-exchange_powershell_module_usage.md |  4 +++
 ...domain_controller_discovery_with_nltest.md |  4 +++
 ...-08-30-remote_system_discovery_with_net.md |  4 +++
 ...petitpotam_network_share_access_request.md |  4 +++
 ...itpotam_suspicious_kerberos_tgt_request.md |  4 +++
 ...31-remote_system_discovery_with_dsquery.md |  4 +++
 ...1-09-01-circle_ci_disable_security_step.md |  4 +++
 ...1-domain_controller_discovery_with_wmic.md |  4 +++
 ...-01-domain_group_discovery_with_dsquery.md |  4 +++
 ...adcomputer_with_powershell_script_block.md |  4 +++
 ...s_computer_with_powershell_script_block.md |  4 +++
 .../2021-09-01-github_commit_in_develop.md    |  4 +++
 .../2021-09-01-github_dependabot_alert.md     |  4 +++
 ...1-github_pull_request_from_unknown_user.md |  4 +++
 ...mote_system_discovery_with_adsisearcher.md |  4 +++
 ...09-01-remote_system_discovery_with_wmic.md |  4 +++
 ...21-09-02-circle_ci_disable_security_job.md |  4 +++
 ...1-09-02-get-foresttrust_with_powershell.md |  4 +++
 ...oresttrust_with_powershell_script_block.md |  4 +++
 ...incomputer_with_powershell_script_block.md |  4 +++
 ...controller_with_powershell_script_block.md |  4 +++
 ...cdedit_command_back_to_normal_mode_boot.md |  4 +++
 ...change_to_safe_mode_with_network_config.md |  4 +++
 ...9-06-correlation_by_repository_and_risk.md |  4 +++
 ...2021-09-06-correlation_by_user_and_risk.md |  4 +++
 ...021-09-07-getadcomputer_with_powershell.md |  4 +++
 ...09-07-getdomaincomputer_with_powershell.md |  4 +++
 ...-07-getdomaincontroller_with_powershell.md |  4 +++
 ...etwmiobject_ds_computer_with_powershell.md |  4 +++
 ...e_by_app_connect_and_create_adsi_object.md |  4 +++
 ...-system_information_discovery_detection.md |  4 +++
 ...l_loading_from_world_writable_directory.md |  4 +++
 ...eate_local_admin_accounts_using_net_exe.md |  4 +++
 .../2021-09-08-office_spawning_control.md     |  5 ++++
 ...2021-09-08-rundll32_control_rundll_hunt.md |  5 ++++
 ...control_rundll_world_writable_directory.md |  5 ++++
 ...2021-09-09-extraction_of_registry_hives.md |  5 ++++
 ...09-mshtml_module_load_in_office_product.md |  5 ++++
 ...connection_with_powershell_script_block.md |  4 +++
 ...0-network_connection_discovery_with_arp.md |  4 +++
 ...0-network_connection_discovery_with_net.md |  4 +++
 ...twork_connection_discovery_with_netstat.md |  4 +++
 ...09-10-office_product_writing_cab_or_inf.md |  5 ++++
 ...1-09-13-getcurrent_user_with_powershell.md |  4 +++
 ...rrent_user_with_powershell_script_block.md |  4 +++
 ...-13-jscript_execution_using_cscript_app.md |  5 ++++
 ...s_scripting_process_loading_ldap_module.md |  4 +++
 ...ms_scripting_process_loading_wmi_module.md |  4 +++
 ...9-13-office_application_drop_executable.md |  4 +++
 ...-09-13-system_user_discovery_with_query.md |  4 +++
 ...09-13-system_user_discovery_with_whoami.md |  4 +++
 ...user_discovery_with_env_vars_powershell.md |  4 +++
 ...y_with_env_vars_powershell_script_block.md |  4 +++
 ...21-09-13-xsl_script_execution_with_wmic.md |  5 ++++
 ...-cmdline_tool_not_executed_in_cmd_shell.md |  4 +++
 ...021-09-14-get_wmiobject_group_discovery.md |  4 +++
 ...oup_discovery_with_script_block_logging.md |  4 +++
 .../2021-09-14-net_localgroup_discovery.md    |  5 ++++
 ...-14-powershell_get_localgroup_discovery.md |  4 +++
 ...oup_discovery_with_script_block_logging.md |  4 +++
 .../_posts/2021-09-14-wmic_group_discovery.md |  4 +++
 ...1-09-15-check_elevated_cmd_using_whoami.md |  4 +++
 ...me_process_accessing_chrome_default_dir.md |  5 ++++
 ...efox_process_access_firefox_profile_dir.md |  5 ++++
 ...21-09-16-account_discovery_with_net_app.md |  5 ++++
 ...t_to_add_certificate_to_untrusted_store.md |  4 +++
 ...edential_dump_from_registry_via_reg_exe.md |  5 ++++
 ...2021-09-16-batch_file_write_to_system32.md |  4 +++
 .../_posts/2021-09-16-bits_job_persistence.md |  4 +++
 .../2021-09-16-bitsadmin_download_file.md     |  6 +++++
 ...of_shadow_copy_with_wmic_and_powershell.md |  4 +++
 ...mping_via_copy_command_from_shadow_copy.md |  4 +++
 ...tial_dumping_via_symlink_to_shadow_copy.md |  4 +++
 .../2021-09-16-detect_html_help_renamed.md    |  4 +++
 ...16-detect_html_help_url_in_command_line.md |  4 +++
 ...ml_help_using_infotech_storage_handlers.md |  4 +++
 ...09-16-detect_mshta_inline_hta_execution.md |  4 +++
 .../_posts/2021-09-16-detect_mshta_renamed.md |  4 +++
 ...-09-16-detect_mshta_url_in_command_line.md |  4 +++
 ...9-16-detect_psexec_with_accepteula_flag.md |  8 ++++++
 .../_posts/2021-09-16-detect_renamed_7-zip.md |  4 +++
 .../2021-09-16-detect_renamed_psexec.md       |  8 ++++++
 .../2021-09-16-detect_renamed_rclone.md       |  5 ++++
 .../2021-09-16-detect_renamed_winrar.md       |  4 +++
 .../2021-09-16-dump_lsass_via_procdump.md     |  5 ++++
 ...-09-16-local_account_discovery_with_net.md |  4 +++
 ...09-16-local_account_discovery_with_wmic.md |  4 +++
 ...2021-09-16-office_product_spawning_wmic.md |  5 ++++
 .../2021-09-16-processes_launching_netsh.md   |  6 +++++
 ...t_regasm_with_no_command_line_arguments.md |  4 +++
 ..._regsvcs_with_no_command_line_arguments.md |  4 +++
 ...ument_spawned_child_process_to_download.md |  4 +++
 ...cious_dllhost_no_command_line_arguments.md |  4 +++
 ...ious_gpupdate_no_command_line_arguments.md |  4 +++
 ...ious_microsoft_workflow_compiler_rename.md |  6 +++++
 ...ious_rundll32_no_command_line_arguments.md |  6 +++++
 ...hprotocolhost_no_command_line_arguments.md |  4 +++
 ...mcos_rat_file_creation_in_remcos_folder.md |  4 +++
 ...icious_image_creation_in_appdata_folder.md |  4 +++
 ...1-suspicious_wav_file_in_appdata_folder.md |  4 +++
 ...1-09-27-change_default_file_association.md |  5 ++++
 ...27-logon_script_event_trigger_execution.md |  5 ++++
 ...-27-screensaver_event_trigger_execution.md |  5 ++++
 ...9-28-print_processor_registry_autostart.md |  5 ++++
 .../2021-09-29-verclsid_clsid_execution.md    |  4 +++
 ...01-vbscript_execution_using_wscript_app.md |  5 ++++
 ...ld_suspicious_spawned_by_script_process.md |  4 +++
 ...32_silent_and_install_param_dll_loading.md |  5 ++++
 .../2021-10-05-detect_exchange_web_shell.md   |  5 ++++
 ...5-malicious_inprocserver32_modification.md |  5 ++++
 ...1-10-05-process_writing_dynamicwrapperx.md |  4 +++
 .../2021-10-05-rundll32_shimcache_flush.md    |  4 +++
 .../2021-10-05-suspicious_copy_on_system32.md |  4 +++
 .../2021-10-05-winhlp32_spawning_a_process.md |  4 +++
 ...ery_length_with_high_standard_deviation.md |  6 +++++
 ...021-10-06-sdelete_application_execution.md |  4 +++
 ...ipt_or_cscript_suspicious_child_process.md |  7 ++++++
 .../2021-10-11-suspicious_wevtutil_usage.md   |  6 +++++
 ..._no_command_line_arguments_with_network.md |  4 +++
 ..._no_command_line_arguments_with_network.md |  6 +++++
 ...lhost_with_no_command_line_with_network.md |  4 +++
 ...rincipalnames_discovery_with_powershell.md |  4 +++
 ...iceprincipalnames_discovery_with_setspn.md |  4 +++
 .../2021-10-18-disable_schedule_task.md       |  4 +++
 ...indows_curl_download_to_suspicious_path.md |  5 ++++
 ...ows_task_scheduler_event_action_started.md |  5 ++++
 ...-wmic_noninteractive_app_uninstallation.md |  4 +++
 ...21-10-24-gdrive_suspicious_file_sharing.md |  5 ++++
 ...10-24-gsuite_suspicious_calendar_invite.md |  4 +++
 docs/_posts/2021-11-03-windows_adfind_exe.md  |  5 ++++
 .../2021-11-04-attacker_tools_on_endpoint.md  |  7 ++++++
 ..._observed_by_an_event_collecting_device.md |  4 +++
 ...ndows_curl_upload_to_remote_destination.md |  4 +++
 ...ows_service_creation_on_remote_endpoint.md |  4 +++
 ...s_service_initiation_on_remote_endpoint.md |  4 +++
 ...ocess_instantiation_via_winrm_and_winrs.md |  4 +++
 ...sk_creation_on_remote_endpoint_using_at.md |  4 +++
 ...uled_task_initiation_on_remote_endpoint.md |  4 +++
 ...chtasks_scheduling_job_on_remote_system.md |  5 ++++
 .../2021-11-11-wmic_xsl_execution_via_url.md  |  4 +++
 ...2-aws_iam_accessdenied_discovery_events.md |  4 +++
 ...21-11-12-csc_net_on_the_fly_compilation.md |  4 +++
 ...1-11-12-firewall_allowed_program_enable.md |  4 +++
 ...twork_discovery_using_route_windows_app.md |  4 +++
 ...12-remote_process_instantiation_via_wmi.md |  6 +++++
 ...21-11-12-runas_execution_in_commandline.md |  4 +++
 ...12-windows_installutil_credential_theft.md |  4 +++
 ...s_installutil_remote_network_connection.md |  4 +++
 ...12-windows_installutil_uninstall_option.md |  4 +++
 ...stallutil_uninstall_option_with_network.md |  4 +++
 ...windows_installutil_url_in_command_line.md |  4 +++
 ...s_instantiation_via_dcom_and_powershell.md |  4 +++
 ...on_via_dcom_and_powershell_script_block.md |  4 +++
 ...ss_instantiation_via_wmi_and_powershell.md |  4 +++
 ...ion_via_wmi_and_powershell_script_block.md |  4 +++
 ...021-11-15-sdelete_application_execution.md |  4 +++
 .../2021-11-15-windows_diskcryptor_usage.md   |  4 +++
 ...requency_copy_of_files_in_network_share.md |  4 +++
 ..._instantiation_via_winrm_and_powershell.md |  4 +++
 ...n_via_winrm_and_powershell_script_block.md |  4 +++
 ...2021-11-17-windows_dism_remove_defender.md |  4 +++
 ...ile_written_in_administrative_smb_share.md |  5 ++++
 ...sion_on_remote_endpoint_with_powershell.md |  4 +++
 .../2021-11-18-loading_of_dynwrapx_module.md  |  4 +++
 ...info_gathering_using_dxdiag_application.md |  4 +++
 ...-11-22-anomalous_usage_of_archive_tools.md |  5 ++++
 ...22-possible_browser_pass_view_parameter.md |  4 +++
 ...services_lolbas_execution_process_spawn.md |  4 +++
 ...-svchost_lolbas_execution_process_spawn.md |  4 +++
 ...ce_created_with_suspicious_service_path.md |  5 ++++
 ...dows_service_created_within_public_path.md |  4 +++
 ...wmiprsve_lolbas_execution_process_spawn.md |  4 +++
 ...provhost_lolbas_execution_process_spawn.md |  4 +++
 ...1-23-mmc_lolbas_execution_process_spawn.md |  4 +++
 .../2021-11-24-attempt_to_delete_services.md  |  5 ++++
 .../2021-11-24-attempt_to_disable_services.md |  5 ++++
 ...5-add_or_set_windows_defender_exclusion.md |  6 +++++
 ...ell_windows_defender_exclusion_commands.md |  6 +++++
 ...ndows_defender_exclusion_registry_entry.md |  5 ++++
 ...edential_dump_from_registry_via_reg_exe.md |  4 +++
 ...-29-deny_permission_using_cacls_utility.md |  4 +++
 ...-detect_dump_lsass_memory_using_comsvcs.md |  4 +++
 ...-11-29-detect_rclone_command-line_usage.md |  5 ++++
 ...sible_lateral_movement_powershell_spawn.md |  5 ++++
 ...-randomly_generated_scheduled_task_name.md |  4 +++
 ...randomly_generated_windows_service_name.md |  4 +++
 docs/_posts/2021-11-30-delete_a_net_user.md   |  5 ++++
 .../2021-11-30-disable_net_user_account.md    |  5 ++++
 ...0-first_time_seen_command_line_argument.md |  4 +++
 ...30-grant_permission_using_cacls_utility.md |  4 +++
 ...ify_acls_permission_of_files_or_folders.md |  4 +++
 ...hash_observed_at_the_destination_device.md |  4 +++
 ...-rare_parent-child_process_relationship.md |  4 +++
 .../2021-11-30-resize_shadowstorage_volume.md |  5 ++++
 ...r_of_computer_service_tickets_requested.md |  4 +++
 ...f_remote_endpoint_authentication_events.md |  4 +++
 ...-12-03-detect_rclone_command-line_usage.md |  5 ++++
 .../2021-12-03-short_lived_scheduled_task.md  |  4 +++
 ...ndows_curl_upload_to_remote_destination.md |  4 +++
 ...-anomalous_usage_of_account_credentials.md |  4 +++
 ...7-bcdedit_failure_recovery_modification.md |  5 ++++
 ...-07-dns_exfiltration_using_nslookup_app.md |  7 ++++++
 ...excessive_number_of_office_files_copied.md |  3 +++
 docs/_posts/2021-12-07-fsutil_zeroing_file.md |  4 +++
 ...2021-12-07-high_file_deletion_frequency.md |  4 +++
 ...ion_service_writing_active_server_pages.md |  5 ++++
 ...021-12-07-wbadmin_delete_system_backups.md |  5 ++++
 ...windows_raccine_scheduled_task_deletion.md |  4 +++
 ...-08-disable_defender_antivirus_registry.md |  4 +++
 ...-msi_module_loaded_by_non-system_binary.md |  4 +++
 ...-12-10-curl_download_and_bash_execution.md |  5 ++++
 ...-12-11-wget_download_and_bash_execution.md |  5 ++++
 ...2021-12-13-detect_outbound_ldap_traffic.md |  4 +++
 ..._class_file_download_by_java_user_agent.md |  4 +++
 .../2021-12-13-linux_java_spawning_shell.md   |  4 +++
 ...og4shell_jndi_payload_injection_attempt.md |  4 +++
 ...load_injection_with_outbound_connection.md |  4 +++
 ...onnection_from_java_using_default_ports.md |  4 +++
 ...2021-12-13-windows_java_spawning_shells.md |  4 +++
 .../2021-12-14-hunting_for_log4shell.md       |  4 +++
 ..._add_files_in_known_crontab_directories.md |  5 ++++
 ...-17-linux_at_allow_config_file_creation.md |  5 ++++
 ...21-12-17-linux_at_application_execution.md |  5 ++++
 ...1-12-17-linux_edit_cron_table_parameter.md |  5 ++++
 ..._append_command_to_at_allow_config_file.md |  5 ++++
 ..._cronjob_entry_on_existing_cronjob_file.md |  5 ++++
 ...ssible_cronjob_modification_with_editor.md |  5 ++++
 ...ear_unallocated_sector_using_cipher_app.md |  5 ++++
 ...g_files_and_directories_with_attrib_exe.md |  6 +++++
 ...ux_file_creation_in_init_boot_directory.md |  5 ++++
 ...inux_file_creation_in_profile_directory.md |  5 ++++
 ...e_append_command_to_profile_config_file.md |  5 ++++
 ...rvice_file_created_in_systemd_directory.md |  5 ++++
 .../2021-12-20-linux_service_restarted.md     |  5 ++++
 ...-12-20-linux_service_started_or_enabled.md |  5 ++++
 ...suspicious_computer_account_name_change.md |  4 +++
 ...picious_kerberos_service_ticket_request.md |  4 +++
 .../2021-12-21-linux_add_user_account.md      |  5 ++++
 ...1-12-21-linux_change_file_owner_to_root.md |  5 ++++
 ...21-linux_nopasswd_entry_in_sudoers_file.md |  5 ++++
 ...-12-21-linux_setuid_using_chmod_utility.md |  5 ++++
 ...12-21-linux_setuid_using_setcap_utility.md |  5 ++++
 ...21-12-21-linux_visudo_utility_execution.md |  5 ++++
 ...spicious_ticket_granting_ticket_request.md |  4 +++
 ...file_created_in_kernel_driver_directory.md |  5 ++++
 ...sert_kernel_module_using_insmod_utility.md |  5 ++++
 ...ll_kernel_module_using_modprobe_utility.md |  5 ++++
 ...2-22-linux_preload_hijack_library_calls.md |  5 ++++
 ...ux_common_process_for_elevation_control.md |  5 ++++
 ...1-12-23-linux_sudoers_tmp_file_creation.md |  5 ++++
 .../2022-01-04-linux_sudo_or_su_execution.md  |  5 ++++
 ...022-01-05-linux_doas_conf_file_creation.md |  5 ++++
 .../2022-01-05-linux_doas_tool_execution.md   |  5 ++++
 ...nux_possible_access_to_credential_files.md |  5 ++++
 ...0-linux_possible_access_to_sudoers_file.md |  5 ++++
 ...ess_or_modification_of_sshd_config_file.md |  5 ++++
 ...11-linux_possible_ssh_key_file_creation.md |  5 ++++
 ..._connect_to_internet_with_hidden_window.md |  7 ++++++
 ..._hunting_system_account_targeting_lsass.md |  4 +++
 ...dows_non-system_account_targeting_lsass.md |  4 +++
 ...tentially_malicious_code_on_commandline.md |  4 +++
 ...-cmd_carry_out_string_command_parameter.md |  6 +++++
 ...lateral_movement_commandline_parameters.md |  5 ++++
 ...us_powershell_process_-_encoded_command.md |  6 +++++
 ...cess_dns_query_known_abuse_web_services.md |  5 ++++
 ...spicious_process_with_discord_dns_query.md |  4 +++
 ...dows_dotnet_binary_in_non_standard_path.md |  8 ++++++
 ...indows_installutil_in_non_standard_path.md |  8 ++++++
 ...ive_file_deletion_in_windefender_folder.md |  4 +++
 .../2022-01-20-ping_sleep_batch_command.md    |  4 +++
 ...shell_remove_windows_defender_directory.md |  4 +++
 .../2022-01-21-windows_nirsoft_advancedrun.md |  6 +++++
 .../2022-01-24-windows_nirsoft_utilities.md   |  4 +++
 ...2-01-26-active_setup_registry_autostart.md |  5 ++++
 ...dd_defaultuser_and_password_in_registry.md |  4 +++
 ...bound_traffic_by_firewall_rule_registry.md |  4 +++
 ...1-26-allow_operation_with_consent_admin.md |  4 +++
 ...022-01-26-disable_amsi_through_registry.md |  4 +++
 ...-26-disable_defender_antivirus_registry.md |  4 +++
 ...sable_defender_blockatfirstseen_feature.md |  4 +++
 ...-disable_defender_enhanced_notification.md |  4 +++
 ...1-26-disable_defender_mpengine_registry.md |  4 +++
 ...01-26-disable_defender_spynet_reporting.md |  4 +++
 ...defender_submit_samples_consent_feature.md |  4 +++
 ...1-26-registry_keys_used_for_persistence.md | 12 +++++++++
 ...stry_keys_used_for_privilege_escalation.md |  6 +++++
 ...26-remcos_client_registry_install_entry.md |  4 +++
 ...22-01-26-start_up_during_safe_mode_boot.md |  4 +++
 ...1-26-time_provider_persistence_registry.md |  5 ++++
 ...2022-01-27-disable_etw_through_registry.md |  4 +++
 .../2022-01-27-disable_registry_tool.md       |  4 +++
 ...ble_security_logs_using_minint_registry.md |  4 +++
 .../2022-01-27-disable_show_hidden_files.md   |  4 +++
 ...22-01-27-disable_uac_remote_restriction.md |  5 ++++
 .../2022-01-27-disable_windows_app_hotkeys.md |  4 +++
 ...-27-disable_windows_behavior_monitoring.md |  6 +++++
 ...-disable_windows_smartscreen_protection.md |  4 +++
 .../2022-01-27-disabling_cmd_application.md   |  4 +++
 .../2022-01-27-disabling_controlpanel.md      |  4 +++
 ...-27-windows_possible_credential_dumping.md |  6 +++++
 .../2022-01-28-disabling_defender_services.md |  4 +++
 ...disabling_folderoptions_windows_feature.md |  4 +++
 .../2022-01-28-disabling_norun_windows_app.md |  4 +++
 ...-28-disabling_systemrestore_in_registry.md |  4 +++
 .../2022-01-28-disabling_task_manager.md      |  4 +++
 ...2-01-28-enable_rdp_in_other_port_number.md |  4 +++
 ...ble_wdigest_uselogoncredential_registry.md |  4 +++
 .../2022-01-28-etw_registry_disabled.md       |  5 ++++
 docs/_posts/2022-01-28-eventvwr_uac_bypass.md |  5 ++++
 ...8-hide_user_account_from_sign-in_screen.md |  4 +++
 ...01-28-linux_pkexec_privilege_escalation.md |  4 +++
 ...022-02-03-o365_added_service_principal.md} | 13 +++++++---
 ...2-02-03-o365_bypass_mfa_via_trusted_ip.md} | 12 ++++++---
 ..._mfa.md => 2022-02-03-o365_disable_mfa.md} | 10 +++++---
 docs/_stories/credential_dumping.md           |  2 +-
 751 files changed, 3429 insertions(+), 54 deletions(-)
 rename docs/_posts/{2021-09-06-auto_admin_logon_registry_entry.md => 2020-01-28-auto_admin_logon_registry_entry.md} (77%)
 rename docs/_posts/{2020-11-23-monitor_registry_keys_for_print_monitors.md => 2020-01-28-monitor_registry_keys_for_print_monitors.md} (68%)
 rename docs/_posts/{2020-11-26-registry_keys_for_creating_shim_databases.md => 2020-01-28-registry_keys_for_creating_shim_databases.md} (70%)
 rename docs/_posts/{2021-07-01-sdclt_uac_bypass.md => 2020-01-28-sdclt_uac_bypass.md} (77%)
 rename docs/_posts/{2021-07-01-silentcleanup_uac_bypass.md => 2020-01-28-silentcleanup_uac_bypass.md} (75%)
 rename docs/_posts/{2021-07-01-wsreset_uac_bypass.md => 2020-01-28-wsreset_uac_bypass.md} (72%)
 rename docs/_posts/{2021-01-26-o365_added_service_principal.md => 2022-02-03-o365_added_service_principal.md} (92%)
 rename docs/_posts/{2021-07-19-o365_bypass_mfa_via_trusted_ip.md => 2022-02-03-o365_bypass_mfa_via_trusted_ip.md} (94%)
 rename docs/_posts/{2020-12-16-o365_disable_mfa.md => 2022-02-03-o365_disable_mfa.md} (94%)

diff --git a/bin/jinja2_templates/doc_detections.j2 b/bin/jinja2_templates/doc_detections.j2
index af178a97af..0d6f20535d 100644
--- a/bin/jinja2_templates/doc_detections.j2
+++ b/bin/jinja2_templates/doc_detections.j2
@@ -101,6 +101,11 @@ The SPL above uses the following Lookups:
 #### Known False Positives
 {{ detection.known_false_positives}}
 
+#### Associated Analytic story
+{% for story in detection.tags.analytic_story -%}
+* [{{ story }}](/stories/{{story|lower|replace(" ", "_")}})
+{% endfor %}
+
 #### Kill Chain Phase
 {% for phase in detection.tags.kill_chain_phases -%}
 * {{ phase }}
diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md
index e8a6284a70..cb94713d5c 100644
--- a/docs/_pages/detections.md
+++ b/docs/_pages/detections.md
@@ -61,8 +61,8 @@ sidebar:
 | [Attempt To Delete Services](/endpoint/attempt_to_delete_services/) | [Service Stop](/tags/#service-stop), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
 | [Attempt To Disable Services](/endpoint/attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | TTP |
 | [Attempt To Stop Security Service](/endpoint/attempt_to_stop_security_service/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
-| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP |
+| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials) | TTP |
 | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [BCDEdit Failure Recovery Modification](/endpoint/bcdedit_failure_recovery_modification/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
index 867f97014a..a29b070bbd 100644
--- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
+++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
@@ -63,6 +63,10 @@ To successfully implement this search, you must ensure the network router device
 #### Known False Positives
 Legitimate router connections may appear as new connections
 
+#### Associated Analytic story
+* [Router and Infrastructure Security](/stories/router_and_infrastructure_security)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md
index d0acafeee0..650696bef5 100644
--- a/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md
+++ b/docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md
@@ -64,6 +64,10 @@ This search uses the Network_Sessions data model shipped with Enterprise Securit
 #### Known False Positives
 This search might be prone to high false positives. Please consider this when conducting analysis or investigations. Authorized devices may be detected as unauthorized. If this is the case, verify the MAC address of the system responsible for the false positive and add it to the Assets and Identity framework with the proper information.
 
+#### Associated Analytic story
+* [Asset Tracking](/stories/asset_tracking)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 * Delivery
diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
index 4e07cfd05b..bb8a83c18d 100644
--- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
+++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
@@ -66,6 +66,10 @@ To successfully implement this search, it requires that the &#39;Update&#39; dat
 #### Known False Positives
 None identified
 
+#### Associated Analytic story
+* [Monitor for Updates](/stories/monitor_for_updates)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
index fdd00b3fba..d6b8c5a242 100644
--- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
+++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
@@ -68,6 +68,11 @@ If Splunk Phantom is also configured in your environment, a playbook called &#34
 #### Known False Positives
 None at this time
 
+#### Associated Analytic story
+* [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
+* [Suspicious Emails](/stories/suspicious_emails)
+
+
 #### Kill Chain Phase
 * Delivery
 
diff --git a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md
index 4e5a3c7aba..57c4a26d94 100644
--- a/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md
+++ b/docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md
@@ -72,6 +72,10 @@ To successfully implement this search you must ensure that DNS data is populatin
 #### Known False Positives
 Legitimate ANY requests may trigger this search, however it is unusual to see a large volume of them under typical circumstances. You may modify the threshold in the search to better suit your environment.
 
+#### Associated Analytic story
+* [DNS Amplification Attacks](/stories/dns_amplification_attacks)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
index 234e37608b..de8511ad97 100644
--- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
+++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
@@ -71,6 +71,11 @@ You must be ingesting data from the web server or network traffic that contains
 #### Known False Positives
 It&#39;s possible for legitimate HTTP requests to be made to URLs containing the suspicious paths.
 
+#### Associated Analytic story
+* [JBoss Vulnerability](/stories/jboss_vulnerability)
+* [SamSam Ransomware](/stories/samsam_ransomware)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
index b20a46610e..8447ccf664 100644
--- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
+++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
@@ -65,6 +65,11 @@ You must ingest data from the web server or capture network data that contains w
 #### Known False Positives
 No known false positives for this detection.
 
+#### Associated Analytic story
+* [JBoss Vulnerability](/stories/jboss_vulnerability)
+* [SamSam Ransomware](/stories/samsam_ransomware)
+
+
 #### Kill Chain Phase
 * Delivery
 
diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
index 4f05ebdfd7..8ba02f7477 100644
--- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
+++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
@@ -66,6 +66,10 @@ You need to ingest data from your web traffic. This can be accomplished by index
 #### Known False Positives
 None at this time
 
+#### Associated Analytic story
+* [Brand Monitoring](/stories/brand_monitoring)
+
+
 #### Kill Chain Phase
 * Delivery
 
diff --git a/docs/_posts/2017-10-13-unusually_long_content-type_length.md b/docs/_posts/2017-10-13-unusually_long_content-type_length.md
index af3e8f829b..6718992b26 100644
--- a/docs/_posts/2017-10-13-unusually_long_content-type_length.md
+++ b/docs/_posts/2017-10-13-unusually_long_content-type_length.md
@@ -60,6 +60,10 @@ This particular search leverages data extracted from Stream:HTTP. You must confi
 #### Known False Positives
 Very few legitimate Content-Type fields will have a length greater than 100 characters.
 
+#### Associated Analytic story
+* [Apache Struts Vulnerability](/stories/apache_struts_vulnerability)
+
+
 #### Kill Chain Phase
 * Delivery
 
diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
index d339ae9964..8a28c1e6b1 100644
--- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
+++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
@@ -71,6 +71,11 @@ You need to ingest email header data. Specifically the sender&#39;s address (src
 #### Known False Positives
 None at this time
 
+#### Associated Analytic story
+* [Brand Monitoring](/stories/brand_monitoring)
+* [Suspicious Emails](/stories/suspicious_emails)
+
+
 #### Kill Chain Phase
 * Delivery
 
diff --git a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md
index cfe2948e49..c5aaa5955d 100644
--- a/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md
+++ b/docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md
@@ -76,6 +76,12 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-
 #### Known False Positives
 The false-positive rate may vary based on the values of`dataPointThreshold` and `deviationThreshold`. Additionally, false positives may result when AWS administrators roll out policies enforcing network blocks, causing sudden increases in the number of blocked outbound connections.
 
+#### Associated Analytic story
+* [AWS Network ACL Activity](/stories/aws_network_acl_activity)
+* [Suspicious AWS Traffic](/stories/suspicious_aws_traffic)
+* [Command and Control](/stories/command_and_control)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 * Command and Control
diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
index d4da8870de..d70a6dff23 100644
--- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
+++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
@@ -75,6 +75,10 @@ In order to run this search effectively, we highly recommend that you leverage t
 #### Known False Positives
 ICMP packets are used in a variety of ways to help troubleshoot networking issues and ensure the proper flow of traffic. As such, it is possible that a large ICMP packet could be perfectly legitimate. If large ICMP packets are associated with command and control traffic, there will typically be a large number of these packets observed over time. If the search is providing a large number of false positives, you can modify the macro `detect_large_outbound_icmp_packets_filter` to adjust the byte threshold or add specific IP addresses to an allow list.
 
+#### Associated Analytic story
+* [Command and Control](/stories/command_and_control)
+
+
 #### Kill Chain Phase
 * Command and Control
 
diff --git a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
index 9c8bb48b5e..512a5e1674 100644
--- a/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
+++ b/docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
@@ -77,6 +77,10 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-
 #### Known False Positives
 S3 buckets can be accessed from any IP, as long as it can make a successful connection. This will be a false postive, since the search is looking for a new IP within the past hour
 
+#### Associated Analytic story
+* [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md b/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md
index e82beab7dd..b0177d256b 100644
--- a/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md
+++ b/docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md
@@ -72,6 +72,10 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. Y
 #### Known False Positives
 After a new image is created, the first systems created with that image will cause this alert to fire.  Verify that the image being used was created by a legitimate user.
 
+#### Associated Analytic story
+* [Cloud Cryptomining](/stories/cloud_cryptomining)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
index 9036fdc4ca..992b0179b8 100644
--- a/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
+++ b/docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
@@ -73,6 +73,10 @@ To successfully implement this search, you must be ingesting the Windows WMI act
 #### Known False Positives
 Although unlikely, administrators may use event subscriptions for legitimate purposes.
 
+#### Associated Analytic story
+* [Suspicious WMI Use](/stories/suspicious_wmi_use)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
index c03fdffb58..af9d904ab3 100644
--- a/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
+++ b/docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
@@ -71,6 +71,10 @@ To successfully implement this search, you must be ingesting the Windows WMI act
 #### Known False Positives
 Some software may create WMI temporary event subscriptions for various purposes. The included search contains an exception for two of these that occur by default on Windows 10 systems. You may need to modify the search to create exceptions for other legitimate events.
 
+#### Associated Analytic story
+* [Suspicious WMI Use](/stories/suspicious_wmi_use)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md
index 49a95afb7a..118bb9a794 100644
--- a/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md
+++ b/docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md
@@ -88,6 +88,10 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-
 #### Known False Positives
 Based on the values of`dataPointThreshold` and `deviationThreshold`, the false positive rate may vary. Please modify this according the your environment.
 
+#### Associated Analytic story
+* [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md
index 1aa0a18bd1..99f1a25afc 100644
--- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md
+++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md
@@ -73,6 +73,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators may use this legitimately to gather info from remote systems. Filter as needed.
 
+#### Associated Analytic story
+* [Suspicious WMI Use](/stories/suspicious_wmi_use)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2018-12-03-usn_journal_deletion.md b/docs/_posts/2018-12-03-usn_journal_deletion.md
index 829667578b..d018df239f 100644
--- a/docs/_posts/2018-12-03-usn_journal_deletion.md
+++ b/docs/_posts/2018-12-03-usn_journal_deletion.md
@@ -72,6 +72,11 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 None identified
 
+#### Associated Analytic story
+* [Windows Log Manipulation](/stories/windows_log_manipulation)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md
index c2980bf781..9f628dca7d 100644
--- a/docs/_posts/2018-12-06-suspicious_java_classes.md
+++ b/docs/_posts/2018-12-06-suspicious_java_classes.md
@@ -67,6 +67,10 @@ In order to properly run this search, Splunk needs to ingest data from your web-
 #### Known False Positives
 There are no known false positives.
 
+#### Associated Analytic story
+* [Apache Struts Vulnerability](/stories/apache_struts_vulnerability)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2018-12-14-file_with_samsam_extension.md b/docs/_posts/2018-12-14-file_with_samsam_extension.md
index 2a876bf05c..e661f24ff2 100644
--- a/docs/_posts/2018-12-14-file_with_samsam_extension.md
+++ b/docs/_posts/2018-12-14-file_with_samsam_extension.md
@@ -62,6 +62,10 @@ You must be ingesting data that records file-system activity from your hosts to
 #### Known False Positives
 Because these extensions are not typically used in normal operations, you should investigate all results.
 
+#### Associated Analytic story
+* [SamSam Ransomware](/stories/samsam_ransomware)
+
+
 #### Kill Chain Phase
 * Installation
 
diff --git a/docs/_posts/2018-12-14-samsam_test_file_write.md b/docs/_posts/2018-12-14-samsam_test_file_write.md
index 69b63fdb65..a341cf6aa9 100644
--- a/docs/_posts/2018-12-14-samsam_test_file_write.md
+++ b/docs/_posts/2018-12-14-samsam_test_file_write.md
@@ -69,6 +69,10 @@ You must be ingesting data that records the file-system activity from your hosts
 #### Known False Positives
 No false positives have been identified.
 
+#### Associated Analytic story
+* [SamSam Ransomware](/stories/samsam_ransomware)
+
+
 #### Kill Chain Phase
 * Delivery
 
diff --git a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md
index 68264700a8..2616237784 100644
--- a/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md
+++ b/docs/_posts/2019-01-25-processes_tapping_keyboard_events.md
@@ -62,6 +62,10 @@ In order to properly run this search, Splunk needs to ingest data from your osqu
 #### Known False Positives
 There might be some false positives as keyboard event taps are used by processes like Siri and Zoom video chat, for some good examples of processes to exclude please see [this](https://github.com/facebook/osquery/pull/5345#issuecomment-454639161) comment.
 
+#### Associated Analytic story
+* [ColdRoot MacOS RAT](/stories/coldroot_macos_rat)
+
+
 #### Kill Chain Phase
 * Command and Control
 
diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
index bb38800e84..8bf22f477b 100644
--- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
+++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
@@ -72,6 +72,10 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 Some of these processes may be used legitimately on web servers during maintenance or other administrative tasks.
 
+#### Associated Analytic story
+* [Apache Struts Vulnerability](/stories/apache_struts_vulnerability)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
index dc08d49223..c00539a07e 100644
--- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
+++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
@@ -67,6 +67,13 @@ You must be ingesting endpoint data that monitors command lines and populates th
 #### Known False Positives
 Some legitimate applications use long command lines for installs or updates. You should review identified command lines for legitimacy. You may modify the first part of the search to omit legitimate command lines from consideration. If you are seeing more results than desired, you may consider changing the value of threshold in the search to a smaller value. You should also periodically re-run the support search to re-build the ML model on the latest data. You may get unexpected results if the user identified in the results is not present in the data used to build the associated model.
 
+#### Associated Analytic story
+* [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions)
+* [Unusual Processes](/stories/unusual_processes)
+* [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
index d8cadb9742..b8752e8916 100644
--- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
+++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
@@ -76,6 +76,11 @@ This search needs Sysmon Logs and a sysmon configuration, which includes EventCo
 #### Known False Positives
 The activity may be legitimate. Other tools can access lsass for legitimate reasons, and it&#39;s possible this event could be generated in those cases. In these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+* [Detect Zerologon Attack](/stories/detect_zerologon_attack)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
index 17935af9b1..2544b67105 100644
--- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
+++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
@@ -74,6 +74,13 @@ This search needs Sysmon Logs and a sysmon configuration, which includes EventCo
 #### Known False Positives
 Other tools can import the same DLLs. These tools should be part of a whitelist. False positives may be present with any process that authenticates or uses credentials, PowerShell included. Filter based on parent process.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+* [Detect Zerologon Attack](/stories/detect_zerologon_attack)
+* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
index 57f9544a47..37dd81d3d9 100644
--- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
+++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
@@ -75,6 +75,10 @@ This search requires Sysmon Logs and a Sysmon configuration, which includes Even
 #### Known False Positives
 Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
index f5c753564c..2048c716cc 100644
--- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
+++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
@@ -75,6 +75,10 @@ This search needs Sysmon Logs with a Sysmon configuration, which includes EventC
 #### Known False Positives
 Other tools can access LSASS for legitimate reasons and generate an event. In these cases, tweaking the search may help eliminate noise.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2019-12-10-creation_of_shadow_copy.md b/docs/_posts/2019-12-10-creation_of_shadow_copy.md
index b9329febf9..40cc22dc54 100644
--- a/docs/_posts/2019-12-10-creation_of_shadow_copy.md
+++ b/docs/_posts/2019-12-10-creation_of_shadow_copy.md
@@ -80,6 +80,10 @@ You must be ingesting endpoint data that tracks process activity, including pare
 #### Known False Positives
 Legitimate administrator usage of Vssadmin or Wmic will create false positives.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
index f26b7a1c45..7b02d1d34c 100644
--- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
+++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
@@ -88,6 +88,12 @@ Detailed documentation on how to create a new field within Incident Review may b
 #### Known False Positives
 If you are seeing more results than desired, you may consider reducing the value for threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data.
 
+#### Associated Analytic story
+* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
+* [Suspicious DNS Traffic](/stories/suspicious_dns_traffic)
+* [Command and Control](/stories/command_and_control)
+
+
 #### Kill Chain Phase
 * Command and Control
 
diff --git a/docs/_posts/2021-09-06-auto_admin_logon_registry_entry.md b/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md
similarity index 77%
rename from docs/_posts/2021-09-06-auto_admin_logon_registry_entry.md
rename to docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md
index 58d6aae744..507f417639 100644
--- a/docs/_posts/2021-09-06-auto_admin_logon_registry_entry.md
+++ b/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md
@@ -3,7 +3,7 @@ title: "Auto Admin Logon Registry Entry"
 excerpt: "Credentials in Registry, Unsecured Credentials"
 categories:
   - Endpoint
-last_modified_at: 2021-09-06
+last_modified_at: 2020-01-28
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ this search is to detect a suspicious registry modification to implement auto ad
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-09-06
+- **Last Updated**: 2020-01-28
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 1379d2b8-0f18-11ec-8ca3-acde48001122
 
@@ -45,16 +45,20 @@ this search is to detect a suspicious registry modification to implement auto ad
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_key_name=AutoAdminLogon AND Registry.registry_value_name=1 by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND Registry.registry_value_data=1 by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-|`security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `auto_admin_logon_registry_entry_filter`
 ```
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `auto_admin_logon_registry_entry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -73,6 +77,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [BlackMatter Ransomware](/stories/blackmatter_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
@@ -101,4 +109,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/auto_admin_logon_registry_entry.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/auto_admin_logon_registry_entry.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-23-monitor_registry_keys_for_print_monitors.md b/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md
similarity index 68%
rename from docs/_posts/2020-11-23-monitor_registry_keys_for_print_monitors.md
rename to docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md
index 89c79639c4..81920e53a7 100644
--- a/docs/_posts/2020-11-23-monitor_registry_keys_for_print_monitors.md
+++ b/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md
@@ -3,7 +3,7 @@ title: "Monitor Registry Keys for Print Monitors"
 excerpt: "Port Monitors, Boot or Logon Autostart Execution"
 categories:
   - Endpoint
-last_modified_at: 2020-11-23
+last_modified_at: 2020-01-28
 toc: true
 toc_label: ""
 tags:
@@ -29,8 +29,8 @@ This search looks for registry activity associated with modifications to the reg
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: 
-- **Last Updated**: 2020-11-23
-- **Author**: Bhavin Patel, Splunk
+- **Last Updated**: 2020-01-28
+- **Author**: Bhavin Patel, Teoderick Contreras, Splunk
 - **ID**: f5f6af30-7ba7-4295-bfe9-07de87c01bbc
 
 
@@ -46,8 +46,15 @@ This search looks for registry activity associated with modifications to the reg
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*" by Registry.dest, Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_name Registry.action 
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data 
 | `drop_dm_object_name(Registry)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `monitor_registry_keys_for_print_monitors_filter`
 ```
 
@@ -73,6 +80,11 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 You will encounter noise from legitimate print-monitor registry entries.
 
+#### Associated Analytic story
+* [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities)
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
@@ -95,7 +107,8 @@ Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://githu
 Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
 
 * [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.010/atomic_red_team/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.010/atomic_red_team/windows-sysmon.log)
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.010/atomic_red_team/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.010/atomic_red_team/sysmon.log)
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/monitor_registry_keys_for_print_monitors.yml) \| *version*: **2**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/monitor_registry_keys_for_print_monitors.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2020-11-26-registry_keys_for_creating_shim_databases.md b/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md
similarity index 70%
rename from docs/_posts/2020-11-26-registry_keys_for_creating_shim_databases.md
rename to docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md
index ff24cc057e..03cfb71d14 100644
--- a/docs/_posts/2020-11-26-registry_keys_for_creating_shim_databases.md
+++ b/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md
@@ -3,7 +3,7 @@ title: "Registry Keys for Creating SHIM Databases"
 excerpt: "Application Shimming, Event Triggered Execution"
 categories:
   - Endpoint
-last_modified_at: 2020-11-26
+last_modified_at: 2020-01-28
 toc: true
 toc_label: ""
 tags:
@@ -29,8 +29,8 @@ This search looks for registry activity associated with application compatibilit
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: 
-- **Last Updated**: 2020-11-26
-- **Author**: Bhavin Patel, Patrick Bareiss, Splunk
+- **Last Updated**: 2020-01-28
+- **Author**: Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk
 - **ID**: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb
 
 
@@ -46,16 +46,20 @@ This search looks for registry activity associated with application compatibilit
 
 ```
 
-| tstats `security_content_summariesonly` count values(Registry.registry_key_name) as registry_key_name min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB* by Registry.dest Registry.user 
-| `security_content_ctime(lastTime)` 
-| `security_content_ctime(firstTime)` 
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry where Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB* by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
 | `drop_dm_object_name(Registry)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data 
 | `registry_keys_for_creating_shim_databases_filter`
 ```
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `registry_keys_for_creating_shim_databases_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -74,6 +78,11 @@ To successfully implement this search, you must populate the Change_Analysis dat
 #### Known False Positives
 There are many legitimate applications that leverage shim databases for compatibility purposes for legacy applications
 
+#### Associated Analytic story
+* [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities)
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
@@ -99,4 +108,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml) \| *version*: **3**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/registry_keys_for_creating_shim_databases.yml) \| *version*: **4**
\ No newline at end of file
diff --git a/docs/_posts/2021-07-01-sdclt_uac_bypass.md b/docs/_posts/2020-01-28-sdclt_uac_bypass.md
similarity index 77%
rename from docs/_posts/2021-07-01-sdclt_uac_bypass.md
rename to docs/_posts/2020-01-28-sdclt_uac_bypass.md
index 8fb0d9d929..0bd5b88d45 100644
--- a/docs/_posts/2021-07-01-sdclt_uac_bypass.md
+++ b/docs/_posts/2020-01-28-sdclt_uac_bypass.md
@@ -3,7 +3,7 @@ title: "Sdclt UAC Bypass"
 excerpt: "Bypass User Account Control, Abuse Elevation Control Mechanism"
 categories:
   - Endpoint
-last_modified_at: 2021-07-01
+last_modified_at: 2020-01-28
 toc: true
 toc_label: ""
 tags:
@@ -30,7 +30,7 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-07-01
+- **Last Updated**: 2020-01-28
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: d71efbf6-da63-11eb-8c6e-acde48001122
 
@@ -47,16 +47,20 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\Windows\\CurrentVersion\\App Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*") (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "IsolatedCommand") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\Windows\\CurrentVersion\\App Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*") (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "IsolatedCommand") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `sdclt_uac_bypass_filter`
 ```
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `sdclt_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -75,6 +79,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited to no false positives are expected.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
@@ -105,4 +113,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/sdclt_uac_bypass.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/sdclt_uac_bypass.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2021-07-01-silentcleanup_uac_bypass.md b/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md
similarity index 75%
rename from docs/_posts/2021-07-01-silentcleanup_uac_bypass.md
rename to docs/_posts/2020-01-28-silentcleanup_uac_bypass.md
index f0de07ad76..9d3155d8dd 100644
--- a/docs/_posts/2021-07-01-silentcleanup_uac_bypass.md
+++ b/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md
@@ -3,7 +3,7 @@ title: "SilentCleanup UAC Bypass"
 excerpt: "Bypass User Account Control, Abuse Elevation Control Mechanism"
 categories:
   - Endpoint
-last_modified_at: 2021-07-01
+last_modified_at: 2020-01-28
 toc: true
 toc_label: ""
 tags:
@@ -30,7 +30,7 @@ This search is to detect a suspicious modification of registry that may related
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-07-01
+- **Last Updated**: 2020-01-28
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 56d7cfcc-da63-11eb-92d4-acde48001122
 
@@ -47,16 +47,20 @@ This search is to detect a suspicious modification of registry that may related
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\windir" Registry.registry_value_name = "*.exe*" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\windir" Registry.registry_value_data = "*.exe*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.registry_key_name 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `silentcleanup_uac_bypass_filter`
 ```
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `silentcleanup_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -75,6 +79,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
@@ -104,4 +112,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/silentcleanup_uac_bypass.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/silentcleanup_uac_bypass.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2021-07-01-wsreset_uac_bypass.md b/docs/_posts/2020-01-28-wsreset_uac_bypass.md
similarity index 72%
rename from docs/_posts/2021-07-01-wsreset_uac_bypass.md
rename to docs/_posts/2020-01-28-wsreset_uac_bypass.md
index 59dad6cc32..bf55049c5e 100644
--- a/docs/_posts/2021-07-01-wsreset_uac_bypass.md
+++ b/docs/_posts/2020-01-28-wsreset_uac_bypass.md
@@ -3,7 +3,7 @@ title: "WSReset UAC Bypass"
 excerpt: "Bypass User Account Control, Abuse Elevation Control Mechanism"
 categories:
   - Endpoint
-last_modified_at: 2021-07-01
+last_modified_at: 2020-01-28
 toc: true
 toc_label: ""
 tags:
@@ -30,7 +30,7 @@ This search is to detect a suspicious modification of registry related to UAC by
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
-- **Last Updated**: 2021-07-01
+- **Last Updated**: 2020-01-28
 - **Author**: Teoderick Contreras, Splunk
 - **ID**: 8b5901bc-da63-11eb-be43-acde48001122
 
@@ -47,16 +47,20 @@ This search is to detect a suspicious modification of registry related to UAC by
 
 ```
 
-| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*" (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "DelegateExecute") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*" AND (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name = "DelegateExecute") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.registry_key_name 
 | `drop_dm_object_name(Registry)` 
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name] 
+| table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name 
 | `wsreset_uac_bypass_filter`
 ```
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `wsreset_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -75,6 +79,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
@@ -104,4 +112,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
 
 
 
-[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/wsreset_uac_bypass.yml) \| *version*: **1**
\ No newline at end of file
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/wsreset_uac_bypass.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
index 3a48814b20..d049b94220 100644
--- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
+++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
@@ -73,6 +73,10 @@ This search requires Sysmon Logs and a Sysmon configuration, which includes Even
 #### Known False Positives
 Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
index 6da38f2d96..7c75058eb1 100644
--- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
+++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
@@ -64,6 +64,9 @@ In order to properly run this search, Splunk needs to ingest process data from y
 #### Known False Positives
 At this stage, there are no known false positives. During testing, no process events refering the com.apple.loginwindow.plist files were observed during normal operation of re-opening applications on reboot. Therefore, it can be asumed that any occurences of this in the process events would be worth investigating. In the event that the legitimate modification by the system of these files is in fact logged to the process log, then the process_name of that process can be added to an allow list.
 
+#### Associated Analytic story
+
+
 #### Kill Chain Phase
 * Installation
 * Command and Control
diff --git a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md
index 97bc8448e3..f25313b1db 100644
--- a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md
+++ b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md
@@ -62,6 +62,10 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-
 #### Known False Positives
 Uploading container is a normal behavior from developers or users with access to container registry.
 
+#### Associated Analytic story
+* [Container Implantation Monitoring and Investigation](/stories/container_implantation_monitoring_and_investigation)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
index a0be6cc28a..58a3f74610 100644
--- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
+++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
@@ -81,6 +81,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 None identified.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+* [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity)
+* [HAFNIUM Group](/stories/hafnium_group)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
index 518ce60f00..a6933d540a 100644
--- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
+++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
@@ -75,6 +75,10 @@ You must be ingesting endpoint data that tracks process activity, including pare
 #### Known False Positives
 Some legitimate printer-related processes may show up as children of spoolsv.exe. You should confirm that any activity as legitimate and may be added as exclusions in the search.
 
+#### Associated Analytic story
+* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md
index 2a8b3abe7c..0058f2d863 100644
--- a/docs/_posts/2020-03-16-detect_rare_executables.md
+++ b/docs/_posts/2020-03-16-detect_rare_executables.md
@@ -75,6 +75,12 @@ To successfully implement this search, you must be ingesting data that records p
 #### Known False Positives
 Some legitimate processes may be only rarely executed in your environment. As these are identified, update `rare_process_allow_list_local.csv` to filter them out of your search results.
 
+#### Associated Analytic story
+* [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
+* [Unusual Processes](/stories/unusual_processes)
+* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
+
+
 #### Kill Chain Phase
 * Installation
 * Command and Control
diff --git a/docs/_posts/2020-03-16-process_execution_via_wmi.md b/docs/_posts/2020-03-16-process_execution_via_wmi.md
index 9496fd07bd..d2cd92fb5d 100644
--- a/docs/_posts/2020-03-16-process_execution_via_wmi.md
+++ b/docs/_posts/2020-03-16-process_execution_via_wmi.md
@@ -70,6 +70,10 @@ You must be ingesting endpoint data that tracks process activity, including pare
 #### Known False Positives
 Although unlikely, administrators may use wmi to execute commands for legitimate purposes.
 
+#### Associated Analytic story
+* [Suspicious WMI Use](/stories/suspicious_wmi_use)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-03-16-script_execution_via_wmi.md b/docs/_posts/2020-03-16-script_execution_via_wmi.md
index 298fbb1753..e402a87aaa 100644
--- a/docs/_posts/2020-03-16-script_execution_via_wmi.md
+++ b/docs/_posts/2020-03-16-script_execution_via_wmi.md
@@ -68,6 +68,10 @@ You must be ingesting endpoint data that tracks process activity, including pare
 #### Known False Positives
 Although unlikely, administrators may use wmi to launch scripts for legitimate purposes. Filter as needed.
 
+#### Associated Analytic story
+* [Suspicious WMI Use](/stories/suspicious_wmi_use)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-03-16-spike_in_file_writes.md b/docs/_posts/2020-03-16-spike_in_file_writes.md
index 418eb3759e..a59bbb1860 100644
--- a/docs/_posts/2020-03-16-spike_in_file_writes.md
+++ b/docs/_posts/2020-03-16-spike_in_file_writes.md
@@ -60,6 +60,12 @@ In order to implement this search, you must populate the Endpoint file-system da
 #### Known False Positives
 It is important to understand that if you happen to install any new applications on your hosts or are copying a large number of files, you can expect to see a large increase of file modifications.
 
+#### Associated Analytic story
+* [SamSam Ransomware](/stories/samsam_ransomware)
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
index 7e176a34d8..d025fd1699 100644
--- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
+++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
@@ -76,6 +76,10 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-
 #### Known False Positives
 Not all unauthenticated requests are malicious, but frequency, UA and source IPs will provide context.
 
+#### Associated Analytic story
+* [Kubernetes Scanning Activity](/stories/kubernetes_scanning_activity)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
index e46ba8b2ff..17c2446de2 100644
--- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
+++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
@@ -77,6 +77,10 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-
 #### Known False Positives
 Not all unauthenticated requests are malicious, but frequency, UA and source IPs and direct request to API provide context.
 
+#### Associated Analytic story
+* [Kubernetes Scanning Activity](/stories/kubernetes_scanning_activity)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
index 8ac48ea503..8eecb3d6b6 100644
--- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
+++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
@@ -82,6 +82,10 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 A new child process of zoom isn&#39;t malicious by that fact alone. Further investigation of the actions of the child process is needed to verify any malicious behavior is taken.
 
+#### Associated Analytic story
+* [Suspicious Zoom Child Processes](/stories/suspicious_zoom_child_processes)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md b/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md
index 0bc5f4cf2e..69ba49d44f 100644
--- a/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md
+++ b/docs/_posts/2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md
@@ -72,6 +72,10 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. Y
 #### Known False Positives
 Using multiple AWS accounts and roles is perfectly valid behavior. It&#39;s suspicious when an account requests privileges of an account it hasn&#39;t before. You should validate with the account owner that this is a legitimate request.
 
+#### Associated Analytic story
+* [Suspicious Cloud Authentication Activities](/stories/suspicious_cloud_authentication_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md b/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md
index 323c255adf..0fce192856 100644
--- a/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md
+++ b/docs/_posts/2020-05-28-detect_aws_console_login_by_new_user.md
@@ -67,6 +67,10 @@ You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later
 #### Known False Positives
 When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
 
+#### Associated Analytic story
+* [Suspicious Cloud Authentication Activities](/stories/suspicious_cloud_authentication_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md
index 8e263e99e5..3730b87892 100644
--- a/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md
+++ b/docs/_posts/2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md
@@ -60,6 +60,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 Kubectl calls are not malicious by nature. However source IP, verb and Object can reveal potential malicious activity, specially anonymous suspicious IPs and sensitive objects such as configmaps or secrets
 
+#### Associated Analytic story
+* [Kubernetes Sensitive Object Access Activity](/stories/kubernetes_sensitive_object_access_activity)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
index 8a917ffe3e..813182bc81 100644
--- a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
+++ b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
@@ -91,6 +91,10 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-07-06-short_lived_windows_accounts.md b/docs/_posts/2020-07-06-short_lived_windows_accounts.md
index 4aed66bffe..e5be7ad3b3 100644
--- a/docs/_posts/2020-07-06-short_lived_windows_accounts.md
+++ b/docs/_posts/2020-07-06-short_lived_windows_accounts.md
@@ -75,6 +75,10 @@ This search requires you to have enabled your Group Management Audit Logs in you
 #### Known False Positives
 It is possible that an administrator created and deleted an account in a short time period.  Verifying activity with an administrator is advised.
 
+#### Associated Analytic story
+* [Account Monitoring and Controls](/stories/account_monitoring_and_controls)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md
index bb7983c26b..57d853aa82 100644
--- a/docs/_posts/2020-07-06-windows_event_log_cleared.md
+++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md
@@ -70,6 +70,12 @@ To successfully implement this search, you need to be ingesting Windows event lo
 #### Known False Positives
 It is possible that these logs may be legitimately cleared by Administrators. Filter as needed.
 
+#### Associated Analytic story
+* [Windows Log Manipulation](/stories/windows_log_manipulation)
+* [Ransomware](/stories/ransomware)
+* [Clop Ransomware](/stories/clop_ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
index 8aad85046a..a9c2867f01 100644
--- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
+++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
@@ -77,6 +77,13 @@ To successfully implement this search you need to identify systems that commonly
 #### Known False Positives
 Remote Desktop may be used legitimately by users on the network.
 
+#### Associated Analytic story
+* [SamSam Ransomware](/stories/samsam_ransomware)
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-07-08-detect_new_local_admin_account.md b/docs/_posts/2020-07-08-detect_new_local_admin_account.md
index 6738568aaf..cd752c0445 100644
--- a/docs/_posts/2020-07-08-detect_new_local_admin_account.md
+++ b/docs/_posts/2020-07-08-detect_new_local_admin_account.md
@@ -74,6 +74,11 @@ You must be ingesting Windows event logs using the Splunk Windows TA and collect
 #### Known False Positives
 The activity may be legitimate. For this reason, it&#39;s best to verify the account with an administrator and ask whether there was a valid service request for the account creation. If your local administrator group name is not &#34;Administrators&#34;, this search may generate an excessive number of false positives
 
+#### Associated Analytic story
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+* [HAFNIUM Group](/stories/hafnium_group)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 * Command and Control
diff --git a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md
index db6a2f4345..644215088e 100644
--- a/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md
+++ b/docs/_posts/2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md
@@ -72,6 +72,10 @@ You must install the GCP App for Splunk (version 2.0.0 or later), then configure
 #### Known False Positives
 Not all unauthenticated requests are malicious, but frequency, User Agent, source IPs and pods  will provide context.
 
+#### Associated Analytic story
+* [Kubernetes Scanning Activity](/stories/kubernetes_scanning_activity)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md
index d440d82b46..1700025a46 100644
--- a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md
+++ b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md
@@ -88,6 +88,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 None identified. Attempts to disable security-related services should be identified and understood.
 
+#### Associated Analytic story
+* [Disabling Security Tools](/stories/disabling_security_tools)
+* [Trickbot](/stories/trickbot)
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Installation
 * Actions on Objectives
diff --git a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
index a7b95cad3c..c09fd3030f 100644
--- a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
+++ b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
@@ -80,6 +80,10 @@ ou must ingest your Windows security event logs in the `Change` datamodel under
 #### Known False Positives
 It is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts.
 
+#### Associated Analytic story
+* [Account Monitoring and Controls](/stories/account_monitoring_and_controls)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
index 1a67653342..6daa9cb924 100644
--- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
+++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
@@ -78,6 +78,12 @@ In order to run this search effectively, we highly recommend that you leverage t
 #### Known False Positives
 It is likely that the outbound Server Message Block (SMB) traffic is legitimate, if the company&#39;s internal networks are not well-defined in the Assets and Identity Framework. Categorize the internal CIDR blocks as `internal` in the lookup file to avoid creating notable events for traffic destined to those CIDR blocks. Any other network connection that is going out to the Internet should be investigated and blocked. Best practices suggest preventing external communications of all SMB versions and related protocols at the network boundary.
 
+#### Associated Analytic story
+* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+* [NOBELIUM Group](/stories/nobelium_group)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 * Command and Control
diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
index d4d162ee5c..3e2be95791 100644
--- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
+++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
@@ -87,6 +87,10 @@ You must be ingesting data that records filesystem and process activity from you
 #### Known False Positives
 It is not uncommon for outlook to write legitimate zip files to the disk.
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+
+
 #### Kill Chain Phase
 * Installation
 * Actions on Objectives
diff --git a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
index 157b56b014..cf1e0799bb 100644
--- a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
+++ b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
@@ -75,6 +75,11 @@ To successfully implement this search, you must be ingesting data that records p
 #### Known False Positives
 Some legitimate applications may exhibit this behavior.
 
+#### Associated Analytic story
+* [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
+* [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
index 2d2f485cf8..ee97b67dbd 100644
--- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
+++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
@@ -72,6 +72,10 @@ You must be ingesting endpoint data that tracks process activity, including pare
 #### Known False Positives
 While legitimate, these NirSoft tools are prone to abuse. You should verfiy that the tool was used for a legitimate purpose.
 
+#### Associated Analytic story
+* [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
+
+
 #### Kill Chain Phase
 * Installation
 * Actions on Objectives
diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
index a672c04359..b63d8cc813 100644
--- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
+++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
@@ -76,6 +76,10 @@ To successfully implement this search, you must be ingesting data that records t
 #### Known False Positives
 Administrators and users sometimes prefer backing up their email data by moving the email files into a different folder. These attempts will be detected by the search.
 
+#### Associated Analytic story
+* [Collection and Staging](/stories/collection_and_staging)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md
index 2cc6ae59a2..4c77199c8d 100644
--- a/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md
+++ b/docs/_posts/2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md
@@ -77,6 +77,11 @@ This search requires you to be ingesting your network traffic and populating the
 #### Known False Positives
 The false-positive rate will vary based on how you set the deviation_threshold and data_samples values. Our recommendation is to adjust these values based on your network traffic to and from your email servers.
 
+#### Associated Analytic story
+* [Collection and Staging](/stories/collection_and_staging)
+* [HAFNIUM Group](/stories/hafnium_group)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-07-21-excessive_dns_failures.md b/docs/_posts/2020-07-21-excessive_dns_failures.md
index 562818e0cc..8c7dbc4d95 100644
--- a/docs/_posts/2020-07-21-excessive_dns_failures.md
+++ b/docs/_posts/2020-07-21-excessive_dns_failures.md
@@ -78,6 +78,11 @@ To successfully implement this search you must ensure that DNS data is populatin
 #### Known False Positives
 It is possible legitimate traffic can trigger this rule. Please investigate as appropriate. The threshold for generating an event can also be customized to better suit your environment.
 
+#### Associated Analytic story
+* [Suspicious DNS Traffic](/stories/suspicious_dns_traffic)
+* [Command and Control](/stories/command_and_control)
+
+
 #### Kill Chain Phase
 * Command and Control
 
diff --git a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md
index 4c3da77b2a..0cfa41e016 100644
--- a/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md
+++ b/docs/_posts/2020-07-21-first_time_seen_running_windows_service.md
@@ -79,6 +79,12 @@ While this search does not require you to adhere to Splunk CIM, you must be inge
 #### Known False Positives
 A previously unseen service is not necessarily malicious. Verify that the service is legitimate and that was installed by a legitimate process.
 
+#### Associated Analytic story
+* [Windows Service Abuse](/stories/windows_service_abuse)
+* [Orangeworm Attack Group](/stories/orangeworm_attack_group)
+* [NOBELIUM Group](/stories/nobelium_group)
+
+
 #### Kill Chain Phase
 * Installation
 * Actions on Objectives
diff --git a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
index bcd70dc24d..937eaa4ef4 100644
--- a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
+++ b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
@@ -74,6 +74,11 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 Some applications and users may legitimately use attrib.exe to interact with the files. 
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md
index 38e4a9d60a..7a3b372e04 100644
--- a/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md
+++ b/docs/_posts/2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md
@@ -77,6 +77,10 @@ This search requires you to be ingesting your network traffic and populating the
 #### Known False Positives
 The false-positive rate will vary based on how you set the deviation_threshold and data_samples values. Our recommendation is to adjust these values based on your network traffic to and from your email servers.
 
+#### Associated Analytic story
+* [Collection and Staging](/stories/collection_and_staging)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
index 9c6332f9c0..16d1e18ac8 100644
--- a/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
+++ b/docs/_posts/2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
@@ -81,6 +81,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 There may be legitimate reasons to bypass the PowerShell execution policy. The PowerShell script being run with this parameter should be validated to ensure that it is legitimate.
 
+#### Associated Analytic story
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+* [HAFNIUM Group](/stories/hafnium_group)
+
+
 #### Kill Chain Phase
 * Command and Control
 * Actions on Objectives
diff --git a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md
index 9cdbfd7cea..175776fcce 100644
--- a/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md
+++ b/docs/_posts/2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md
@@ -84,6 +84,10 @@ This search is specific to Okta and requires Okta logs are being ingested in you
 #### Known False Positives
 A single public IP address servicing multiple legitmate users may trigger this search. In addition, the threshold of 5 distinct users may be too low for your needs. You may modify the included filter macro `multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter` to raise the threshold or except specific IP adresses from triggering this search.
 
+#### Associated Analytic story
+* [Suspicious Okta Activity](/stories/suspicious_okta_activity)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2020-07-21-okta_account_lockout_events.md b/docs/_posts/2020-07-21-okta_account_lockout_events.md
index fdf8d34003..bd50c4d8bd 100644
--- a/docs/_posts/2020-07-21-okta_account_lockout_events.md
+++ b/docs/_posts/2020-07-21-okta_account_lockout_events.md
@@ -77,6 +77,10 @@ This search is specific to Okta and requires Okta logs are being ingested in you
 #### Known False Positives
 None. Account lockouts should be followed up on to determine if the actual user was the one who caused the lockout, or if it was an unauthorized actor.
 
+#### Associated Analytic story
+* [Suspicious Okta Activity](/stories/suspicious_okta_activity)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md
index 4a68126027..42ec91189a 100644
--- a/docs/_posts/2020-07-21-okta_failed_sso_attempts.md
+++ b/docs/_posts/2020-07-21-okta_failed_sso_attempts.md
@@ -80,6 +80,10 @@ This search is specific to Okta and requires Okta logs are being ingested in you
 #### Known False Positives
 There may be a faulty config preventing legitmate users from accessing apps they should have access to.
 
+#### Associated Analytic story
+* [Suspicious Okta Activity](/stories/suspicious_okta_activity)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md
index d76b90acaf..11374bc0b6 100644
--- a/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md
+++ b/docs/_posts/2020-07-21-okta_user_logins_from_multiple_cities.md
@@ -80,6 +80,10 @@ This search is specific to Okta and requires Okta logs are being ingested in you
 #### Known False Positives
 Users in your enviornment may legitmately be travelling and loggin in from different locations. This search is useful for those users that should *not* be travelling for some reason, such as the COVID-19 pandemic. The search also relies on the geographical information being populated in the Okta logs. It is also possible that a connection from another region may be attributed to a login from a remote VPN endpoint.
 
+#### Associated Analytic story
+* [Suspicious Okta Activity](/stories/suspicious_okta_activity)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
index f30ef06414..4560df7a7d 100644
--- a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
+++ b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
@@ -75,6 +75,10 @@ You must be ingesting data that records the filesystem activity from your hosts
 #### Known False Positives
 Microsoft may provide updates to these binaries. Verify that these changes do not correspond with your normal software update cycle.
 
+#### Associated Analytic story
+* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
index cf4ffb1f22..a647aff3b4 100644
--- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
+++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
@@ -73,6 +73,12 @@ In order to properly run this search, Splunk needs to ingest data from firewalls
 #### Known False Positives
 None identified
 
+#### Associated Analytic story
+* [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch)
+* [Ransomware](/stories/ransomware)
+* [Command and Control](/stories/command_and_control)
+
+
 #### Kill Chain Phase
 * Delivery
 * Command and Control
diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md
index 959c7450e1..d942cebac8 100644
--- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md
+++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md
@@ -75,6 +75,11 @@ Running this search properly requires a technology that can inspect network traf
 #### Known False Positives
 None identified
 
+#### Associated Analytic story
+* [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch)
+* [Command and Control](/stories/command_and_control)
+
+
 #### Kill Chain Phase
 * Command and Control
 
diff --git a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md
index 75f7cf7c94..1c63cbe857 100644
--- a/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md
+++ b/docs/_posts/2020-07-21-remote_desktop_network_bruteforce.md
@@ -75,6 +75,11 @@ You must ensure that your network traffic data is populating the Network_Traffic
 #### Known False Positives
 RDP gateways may have unusually high amounts of traffic from all other hosts&#39; RDP applications in the network.
 
+#### Associated Analytic story
+* [SamSam Ransomware](/stories/samsam_ransomware)
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 * Delivery
diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
index f8b0758ffe..c3185d4581 100644
--- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
+++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
@@ -75,6 +75,11 @@ To successfully implement this search, you must be ingesting data that records p
 #### Known False Positives
 Remote Desktop may be used legitimately by users on the network.
 
+#### Associated Analytic story
+* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
index af7f4c678d..8fec1118f7 100644
--- a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
+++ b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
@@ -76,6 +76,15 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Using sc.exe to manipulate Windows services is uncommon. However, there may be legitimate instances of this behavior. It is important to validate and investigate as appropriate.
 
+#### Associated Analytic story
+* [Windows Service Abuse](/stories/windows_service_abuse)
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+* [Orangeworm Attack Group](/stories/orangeworm_attack_group)
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Disabling Security Tools](/stories/disabling_security_tools)
+* [NOBELIUM Group](/stories/nobelium_group)
+
+
 #### Kill Chain Phase
 * Installation
 
diff --git a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md
index 69c938f47b..34b695b410 100644
--- a/docs/_posts/2020-07-21-sql_injection_with_long_urls.md
+++ b/docs/_posts/2020-07-21-sql_injection_with_long_urls.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be monitoring network communi
 #### Known False Positives
 It&#39;s possible that legitimate traffic will have long URLs or long user agent strings and that common SQL commands may be found within the URL. Please investigate as appropriate.
 
+#### Associated Analytic story
+* [SQL Injection](/stories/sql_injection)
+
+
 #### Kill Chain Phase
 * Delivery
 
diff --git a/docs/_posts/2020-07-22-smb_traffic_spike.md b/docs/_posts/2020-07-22-smb_traffic_spike.md
index 76aef88e35..3baccd2a57 100644
--- a/docs/_posts/2020-07-22-smb_traffic_spike.md
+++ b/docs/_posts/2020-07-22-smb_traffic_spike.md
@@ -76,6 +76,13 @@ This search requires you to be ingesting your network traffic logs and populatin
 #### Known False Positives
 A file server may experience high-demand loads that could cause this analytic to trigger.
 
+#### Associated Analytic story
+* [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
+* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
+* [Ransomware](/stories/ransomware)
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md
index 50eea1bb18..663c2347ee 100644
--- a/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md
+++ b/docs/_posts/2020-07-22-smb_traffic_spike_-_mltk.md
@@ -82,6 +82,13 @@ Detailed documentation on how to create a new field within Incident Review is fo
 #### Known False Positives
 If you are seeing more results than desired, you may consider reducing the value of the threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data. Please update the `smb_traffic_spike_mltk_filter` macro to filter out false positive results
 
+#### Associated Analytic story
+* [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
+* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
+* [Ransomware](/stories/ransomware)
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
index fbcd94aa82..806848820d 100644
--- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
+++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
@@ -83,6 +83,11 @@ If Splunk Phantom is also configured in your environment, a Playbook called &#34
 #### Known False Positives
 None identified
 
+#### Associated Analytic story
+* [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
+* [Suspicious Emails](/stories/suspicious_emails)
+
+
 #### Kill Chain Phase
 * Delivery
 
diff --git a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md
index e1d878bde6..c3c8055857 100644
--- a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md
+++ b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md
@@ -80,6 +80,12 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 It&#39;s possible for system administrators to write scripts that exhibit this behavior. If this is the case, the search will need to be modified to filter them out.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Disabling Security Tools](/stories/disabling_security_tools)
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md b/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md
index ac0b143707..a0f5deef09 100644
--- a/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md
+++ b/docs/_posts/2020-07-22-suspicious_writes_to_windows_recycle_bin.md
@@ -74,6 +74,10 @@ To successfully implement this search you need to be ingesting information on fi
 #### Known False Positives
 Because the Recycle Bin is a hidden folder in modern versions of Windows, it would be unusual for a process other than explorer.exe to write to it. Incidents should be investigated as appropriate.
 
+#### Associated Analytic story
+* [Collection and Staging](/stories/collection_and_staging)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md
index fde28335a5..ff46982a56 100644
--- a/docs/_posts/2020-07-22-tor_traffic.md
+++ b/docs/_posts/2020-07-22-tor_traffic.md
@@ -76,6 +76,13 @@ In order to properly run this search, Splunk needs to ingest data from firewalls
 #### Known False Positives
 None at this time
 
+#### Associated Analytic story
+* [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch)
+* [Ransomware](/stories/ransomware)
+* [Command and Control](/stories/command_and_control)
+* [NOBELIUM Group](/stories/nobelium_group)
+
+
 #### Kill Chain Phase
 * Command and Control
 
diff --git a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md
index bf8e020066..0431142e13 100644
--- a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md
+++ b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md
@@ -76,6 +76,10 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 
 
+#### Associated Analytic story
+* [Disabling Security Tools](/stories/disabling_security_tools)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md
index a317f08c1e..b3133924c0 100644
--- a/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md
+++ b/docs/_posts/2020-07-27-aws_detect_attach_to_role_policy.md
@@ -67,6 +67,10 @@ You must install splunk AWS add-on and Splunk App for AWS. This search works wit
 #### Known False Positives
 Attach to policy can create a lot of noise. This search can be adjusted to provide specific values to identify cases of abuse (i.e status=failure). The search can provide context for common users attaching themselves to higher privilege policies or even newly created policies.
 
+#### Associated Analytic story
+* [AWS Cross Account Activity](/stories/aws_cross_account_activity)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md
index b7616bd8e3..7502eaf8c5 100644
--- a/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md
+++ b/docs/_posts/2020-07-27-aws_detect_permanent_key_creation.md
@@ -77,6 +77,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 Not all permanent key creations are malicious. If there is a policy of rotating keys this search can be adjusted to provide better context.
 
+#### Associated Analytic story
+* [AWS Cross Account Activity](/stories/aws_cross_account_activity)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2020-07-27-aws_detect_role_creation.md b/docs/_posts/2020-07-27-aws_detect_role_creation.md
index aa75f3af1c..f3231b38ce 100644
--- a/docs/_posts/2020-07-27-aws_detect_role_creation.md
+++ b/docs/_posts/2020-07-27-aws_detect_role_creation.md
@@ -82,6 +82,10 @@ You must install splunk AWS add-on and Splunk App for AWS. This search works wit
 #### Known False Positives
 CreateRole is not very common in common users. This search can be adjusted to provide specific values to identify cases of abuse. In general AWS provides plenty of trust policies that fit most use cases.
 
+#### Associated Analytic story
+* [AWS Cross Account Activity](/stories/aws_cross_account_activity)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md
index e11507a99e..93512639cb 100644
--- a/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md
+++ b/docs/_posts/2020-07-27-aws_detect_sts_assume_role_abuse.md
@@ -76,6 +76,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 Sts:AssumeRole can be very noisy as it is a standard mechanism to provide cross account and cross resources access. This search can be adjusted to provide specific values to identify cases of abuse.
 
+#### Associated Analytic story
+* [AWS Cross Account Activity](/stories/aws_cross_account_activity)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md
index 744dd3cfa4..b23ae8e210 100644
--- a/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md
+++ b/docs/_posts/2020-07-27-aws_detect_sts_get_session_token_abuse.md
@@ -75,6 +75,10 @@ You must install splunk AWS add-on and Splunk App for AWS. This search works wit
 #### Known False Positives
 Sts:GetSessionToken can be very noisy as in certain environments numerous calls of this type can be executed. This search can be adjusted to provide specific values to identify cases of abuse. In specific environments the use of field requestParameters.serialNumber will need to be used.
 
+#### Associated Analytic story
+* [AWS Cross Account Activity](/stories/aws_cross_account_activity)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
index 9ca3673fcc..9323d26dfc 100644
--- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
+++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
@@ -71,6 +71,10 @@ You must be ingesting Splunk Stream DNS and Splunk Stream TCP. We are detecting
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Windows DNS SIGRed CVE-2020-1350](/stories/windows_dns_sigred_cve-2020-1350)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md
index ea1f341c0a..63600160c2 100644
--- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md
+++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_zeek.md
@@ -75,6 +75,10 @@ You must be ingesting Zeek DNS and Zeek Conn data into Splunk. Zeek data should
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Windows DNS SIGRed CVE-2020-1350](/stories/windows_dns_sigred_cve-2020-1350)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
index ac7e63f4a1..8eafba8ea8 100644
--- a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
+++ b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
@@ -92,6 +92,10 @@ This search has a dependency on other searches to create and update a baseline o
 #### Known False Positives
 It&#39;s possible that a new user will start to modify EC2 instances when they haven&#39;t before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior.
 
+#### Associated Analytic story
+* [Suspicious Cloud Instance Activities](/stories/suspicious_cloud_instance_activities)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md
index 20490e7974..f4c0fbe13c 100644
--- a/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md
+++ b/docs/_posts/2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md
@@ -64,6 +64,10 @@ To consistently detect exploit attempts on F5 devices using the vulnerabilities
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [F5 TMUI RCE CVE-2020-5902](/stories/f5_tmui_rce_cve-2020-5902)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md
index 9735255eb6..14c665d98a 100644
--- a/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md
+++ b/docs/_posts/2020-08-05-detect_new_open_gcp_storage_buckets.md
@@ -79,6 +79,10 @@ This search relies on the Splunk Add-on for Google Cloud Platform, setting up a
 #### Known False Positives
 While this search has no known false positives, it is possible that a GCP admin has legitimately created a public bucket for a specific purpose. That said, GCP strongly advises against granting full control to the &#34;allUsers&#34; group.
 
+#### Associated Analytic story
+* [Suspicious GCP Storage Activities](/stories/suspicious_gcp_storage_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md
index baee46b606..fedd690d65 100644
--- a/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md
+++ b/docs/_posts/2020-08-10-detect_gcp_storage_access_from_a_new_ip.md
@@ -89,6 +89,10 @@ This search relies on the Splunk Add-on for Google Cloud Platform, setting up a
 #### Known False Positives
 GCP Storage buckets can be accessed from any IP (if the ACLs are open to allow it), as long as it can make a successful connection. This will be a false postive, since the search is looking for a new IP within the past two hours.
 
+#### Associated Analytic story
+* [Suspicious GCP Storage Activities](/stories/suspicious_gcp_storage_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md
index 13f3986a68..d3149ab70a 100644
--- a/docs/_posts/2020-08-11-detect_arp_poisoning.md
+++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md
@@ -87,6 +87,10 @@ This search uses a standard SPL query on logs from Cisco Network devices. The ne
 #### Known False Positives
 This search might be prone to high false positives if DHCP Snooping or ARP inspection has been incorrectly configured, or if a device normally sends many ARP packets (unlikely).
 
+#### Associated Analytic story
+* [Router and Infrastructure Security](/stories/router_and_infrastructure_security)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 * Delivery
diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md
index 5980c9d30a..05f56898c8 100644
--- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md
+++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md
@@ -79,6 +79,10 @@ This search uses a standard SPL query on logs from Cisco Network devices. The ne
 #### Known False Positives
 This search might be prone to high false positives if DHCP Snooping has been incorrectly configured or in the unlikely event that the DHCP server has been moved to another network interface.
 
+#### Associated Analytic story
+* [Router and Infrastructure Security](/stories/router_and_infrastructure_security)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 * Delivery
diff --git a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md
index 3f84e6246c..318efa433e 100644
--- a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md
+++ b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md
@@ -86,6 +86,10 @@ You must be ingesting your cloud infrastructure logs from your cloud provider.
 This is a strictly behavioral search, so we define &#34;false positive&#34; slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you&#39;re searching within, plus what is stored in the cache feature. But while there are really no &#34;false positives&#34; in a traditional sense, there is definitely lots of noise.\
  This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
 
+#### Associated Analytic story
+* [Suspicious Cloud Provisioning Activities](/stories/suspicious_cloud_provisioning_activities)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md
index 8a035ee42b..21f87098ed 100644
--- a/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md
+++ b/docs/_posts/2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md
@@ -88,6 +88,10 @@ You must be ingesting your cloud infrastructure logs from your cloud provider.
 This is a strictly behavioral search, so we define &#34;false positive&#34; slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you&#39;re searching within, plus what is stored in the cache feature. But while there are really no &#34;false positives&#34; in a traditional sense, there is definitely lots of noise.\
  This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
 
+#### Associated Analytic story
+* [Suspicious Cloud Provisioning Activities](/stories/suspicious_cloud_provisioning_activities)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md
index 8c439b28f1..5940234596 100644
--- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md
+++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md
@@ -91,6 +91,10 @@ You must be ingesting your cloud infrastructure logs. You also must run the base
 #### Known False Positives
 Many service accounts configured within a cloud infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
 
+#### Associated Analytic story
+* [Suspicious Cloud Instance Activities](/stories/suspicious_cloud_instance_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md
index 8cafe54f06..82d970f5a6 100644
--- a/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md
+++ b/docs/_posts/2020-08-21-abnormally_high_number_of_cloud_instances_launched.md
@@ -91,6 +91,11 @@ You must be ingesting your cloud infrastructure logs. You also must run the base
 #### Known False Positives
 Many service accounts configured within an AWS infrastructure are known to exhibit this behavior. Please adjust the threshold values and filter out service accounts from the output. Always verify if this search alerted on a human user.
 
+#### Associated Analytic story
+* [Cloud Cryptomining](/stories/cloud_cryptomining)
+* [Suspicious Cloud Instance Activities](/stories/suspicious_cloud_instance_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md
index e372d27a08..322ec6b390 100644
--- a/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md
+++ b/docs/_posts/2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md
@@ -67,6 +67,9 @@ Events are fed to DSP contains at least email&#39;s sender, subject and its mess
 #### Known False Positives
 Because of imbalance of anomaly data in training, the model will less likely report false positive. Instead, the model is more prone to false negative. Current best recall score is ~85%
 
+#### Associated Analytic story
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-08-25-system_process_running_from_unexpected_location.md b/docs/_posts/2020-08-25-system_process_running_from_unexpected_location.md
index 425284f6f7..279195b74f 100644
--- a/docs/_posts/2020-08-25-system_process_running_from_unexpected_location.md
+++ b/docs/_posts/2020-08-25-system_process_running_from_unexpected_location.md
@@ -90,6 +90,11 @@ Collect endpoint data such as sysmon or 4688 events.
 #### Known False Positives
 None
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-08-25-unusual_lolbas_in_short_period_of_time.md b/docs/_posts/2020-08-25-unusual_lolbas_in_short_period_of_time.md
index c064016f9c..528fce7e55 100644
--- a/docs/_posts/2020-08-25-unusual_lolbas_in_short_period_of_time.md
+++ b/docs/_posts/2020-08-25-unusual_lolbas_in_short_period_of_time.md
@@ -75,6 +75,10 @@ Collect endpoint data such as sysmon or 4688 events.
 Some administrative tasks may involve multiple use of LOLBAS applications in a short period of time. This might trigger false positives at the beginning when it hasn&#39;t collected yet enough data to construct the baseline.
 
 
+#### Associated Analytic story
+* [Unusual Processes](/stories/unusual_processes)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md b/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md
index 6a3c1617ad..c9bc14e27a 100644
--- a/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md
+++ b/docs/_posts/2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md
@@ -79,6 +79,10 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. Y
 #### Known False Positives
 It&#39;s possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate.
 
+#### Associated Analytic story
+* [Cloud Cryptomining](/stories/cloud_cryptomining)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md b/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md
index 5a8509f84e..adf8061f2b 100644
--- a/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md
+++ b/docs/_posts/2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md
@@ -84,6 +84,10 @@ You must be ingesting your cloud infrastructure logs from your cloud provider.
 #### Known False Positives
 .
 
+#### Associated Analytic story
+* [Suspicious Cloud User Activities](/stories/suspicious_cloud_user_activities)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md
index 2eac913574..fc57c804cd 100644
--- a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md
+++ b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md
@@ -88,6 +88,10 @@ You must be ingesting your cloud infrastructure logs. You also must run the base
 #### Known False Positives
 
 
+#### Associated Analytic story
+* [Suspicious Cloud User Activities](/stories/suspicious_cloud_user_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md
index fc4154f57e..04d5b163ee 100644
--- a/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md
+++ b/docs/_posts/2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md
@@ -89,6 +89,10 @@ You must be ingesting your cloud infrastructure logs. You also must run the base
 #### Known False Positives
 
 
+#### Associated Analytic story
+* [Suspicious Cloud User Activities](/stories/suspicious_cloud_user_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md b/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md
index a5e699bc96..37cfa4fa3d 100644
--- a/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md
+++ b/docs/_posts/2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md
@@ -72,6 +72,10 @@ You must be ingesting your cloud infrastructure logs from your cloud provider. Y
 #### Known False Positives
 It is possible that an admin will create a new system using a new instance type that has never been used before. Verify with the creator that they intended to create the system with the new instance type.
 
+#### Associated Analytic story
+* [Cloud Cryptomining](/stories/cloud_cryptomining)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md
index db5a52b79a..5ef8f28acd 100644
--- a/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md
+++ b/docs/_posts/2020-09-15-detect_zerologon_via_zeek.md
@@ -66,6 +66,10 @@ You must be ingesting Zeek DCE-RPC data into Splunk. Zeek data should also be ge
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Detect Zerologon Attack](/stories/detect_zerologon_attack)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
index a6d08ea3f2..2b9a1fff54 100644
--- a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
+++ b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
@@ -82,6 +82,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators often leverage net.exe to create or delete network shares. You should verify that the activity was intentional and is legitimate.
 
+#### Associated Analytic story
+* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md
index 8f7fd1178d..d042182027 100644
--- a/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md
+++ b/docs/_posts/2020-09-18-detect_computer_changed_with_anonymous_account.md
@@ -68,6 +68,10 @@ This search requires audit computer account management to be enabled on the syst
 #### Known False Positives
 None thus far found
 
+#### Associated Analytic story
+* [Detect Zerologon Attack](/stories/detect_zerologon_attack)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md
index fa0bdda008..be200b8866 100644
--- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md
+++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_city.md
@@ -83,6 +83,11 @@ You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later
 #### Known False Positives
 When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
 
+#### Associated Analytic story
+* [Suspicious AWS Login Activities](/stories/suspicious_aws_login_activities)
+* [Suspicious Cloud Authentication Activities](/stories/suspicious_cloud_authentication_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md
index 7081e8411b..86d9ccef2e 100644
--- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md
+++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_country.md
@@ -83,6 +83,11 @@ You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later
 #### Known False Positives
 When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
 
+#### Associated Analytic story
+* [Suspicious AWS Login Activities](/stories/suspicious_aws_login_activities)
+* [Suspicious Cloud Authentication Activities](/stories/suspicious_cloud_authentication_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md
index 1226d1d1d8..c6a060077f 100644
--- a/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md
+++ b/docs/_posts/2020-10-07-detect_aws_console_login_by_user_from_new_region.md
@@ -83,6 +83,11 @@ You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later
 #### Known False Positives
 When a legitimate new user logins for the first time, this activity will be detected. Check how old the account is and verify that the user activity is legitimate.
 
+#### Associated Analytic story
+* [Suspicious AWS Login Activities](/stories/suspicious_aws_login_activities)
+* [Suspicious Cloud Authentication Activities](/stories/suspicious_cloud_authentication_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md
index 3ad30f4f12..ccc371a6f9 100644
--- a/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md
+++ b/docs/_posts/2020-10-08-gcp_detect_gcploit_framework.md
@@ -73,6 +73,10 @@ You must install splunk GCP add-on. This search works with gcp:pubsub:message lo
 #### Known False Positives
 Payload.request.function.timeout value can possibly be match with other functions or requests however the source user and target request account may indicate an attempt to move laterally accross acounts or projects
 
+#### Associated Analytic story
+* [GCP Cross Account Activity](/stories/gcp_cross_account_activity)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md
index 2270dc24e1..221794b79f 100644
--- a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md
+++ b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md
@@ -88,6 +88,10 @@ You must be ingesting your cloud infrastructure logs from your cloud provider.
 This is a strictly behavioral search, so we define &#34;false positive&#34; slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you&#39;re searching within, plus what is stored in the cache feature. But while there are really no &#34;false positives&#34; in a traditional sense, there is definitely lots of noise.\
  This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
 
+#### Associated Analytic story
+* [Suspicious Cloud Provisioning Activities](/stories/suspicious_cloud_provisioning_activities)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md
index 65764279ca..206c30f0dc 100644
--- a/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md
+++ b/docs/_posts/2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md
@@ -87,6 +87,10 @@ You must be ingesting your cloud infrastructure logs from your cloud provider.
 This is a strictly behavioral search, so we define &#34;false positive&#34; slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you&#39;re searching within, plus what is stored in the cache feature. But while there are really no &#34;false positives&#34; in a traditional sense, there is definitely lots of noise.\
  This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
 
+#### Associated Analytic story
+* [Suspicious Cloud Provisioning Activities](/stories/suspicious_cloud_provisioning_activities)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
index 7453e7282e..fe82571a0e 100644
--- a/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
+++ b/docs/_posts/2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
@@ -76,6 +76,10 @@ To successfully implement this search, you must ingest your Windows Security Eve
 #### Known False Positives
 Legitimate logon activity by authorized NTLM systems may be detected by this search. Please investigate as appropriate.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md b/docs/_posts/2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md
index a797777947..c90715d4c2 100644
--- a/docs/_posts/2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md
+++ b/docs/_posts/2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md
@@ -73,6 +73,10 @@ You must be ingesting endpoint data that tracks process activity, and include th
 #### Known False Positives
 Older systems that support kerberos RC4 by default NetApp may generate false positives
 
+#### Associated Analytic story
+* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2020-10-21-detect_kerberoasting.md b/docs/_posts/2020-10-21-detect_kerberoasting.md
index 76a7e24db7..91b3dfab1b 100644
--- a/docs/_posts/2020-10-21-detect_kerberoasting.md
+++ b/docs/_posts/2020-10-21-detect_kerberoasting.md
@@ -76,6 +76,10 @@ The test data is converted from Windows Security Event logs generated from Attac
 #### Known False Positives
 Older systems that support kerberos RC4 by default NetApp may generate false positives
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md
index f182703965..eaf0ed902d 100644
--- a/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md
+++ b/docs/_posts/2020-10-21-detect_snicat_sni_exfiltration.md
@@ -78,6 +78,10 @@ You must be ingesting Zeek SSL data into Splunk. Zeek data should also be gettin
 #### Known False Positives
 Unknown
 
+#### Associated Analytic story
+* [Data Exfiltration](/stories/data_exfiltration)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md
index 30d8285d5b..68d02f63e0 100644
--- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md
+++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md
@@ -92,6 +92,10 @@ This search uses a standard SPL query on logs from Cisco Network devices. The ne
 #### Known False Positives
 None currently known
 
+#### Associated Analytic story
+* [Router and Infrastructure Security](/stories/router_and_infrastructure_security)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 * Delivery
diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md
index ded6fc83e1..2db24011cc 100644
--- a/docs/_posts/2020-10-28-detect_port_security_violation.md
+++ b/docs/_posts/2020-10-28-detect_port_security_violation.md
@@ -90,6 +90,10 @@ This search uses a standard SPL query on logs from Cisco Network devices. The ne
 #### Known False Positives
 This search might be prone to high false positives if you have malfunctioning devices connected to your ethernet ports or if end users periodically connect physical devices to the network.
 
+#### Associated Analytic story
+* [Router and Infrastructure Security](/stories/router_and_infrastructure_security)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 * Delivery
diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md
index 8f5e118015..781679351a 100644
--- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md
+++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md
@@ -79,6 +79,10 @@ This search looks for Network Traffic events to TFTP, FTP or SSH/SCP ports from
 #### Known False Positives
 This search will also report any legitimate attempts of software downloads to network devices as well as outbound SSH sessions from network devices.
 
+#### Associated Analytic story
+* [Router and Infrastructure Security](/stories/router_and_infrastructure_security)
+
+
 #### Kill Chain Phase
 * Delivery
 
diff --git a/docs/_posts/2020-10-28-detect_traffic_mirroring.md b/docs/_posts/2020-10-28-detect_traffic_mirroring.md
index 003ac70ed5..1db9849eb6 100644
--- a/docs/_posts/2020-10-28-detect_traffic_mirroring.md
+++ b/docs/_posts/2020-10-28-detect_traffic_mirroring.md
@@ -80,6 +80,10 @@ This search uses a standard SPL query on logs from Cisco Network devices. The ne
 #### Known False Positives
 This search will return false positives for any legitimate traffic captures by network administrators.
 
+#### Associated Analytic story
+* [Router and Infrastructure Security](/stories/router_and_infrastructure_security)
+
+
 #### Kill Chain Phase
 * Delivery
 * Actions on Objectives
diff --git a/docs/_posts/2020-11-06-ryuk_test_files_detected.md b/docs/_posts/2020-11-06-ryuk_test_files_detected.md
index cf3782464b..ba81fc858e 100644
--- a/docs/_posts/2020-11-06-ryuk_test_files_detected.md
+++ b/docs/_posts/2020-11-06-ryuk_test_files_detected.md
@@ -67,6 +67,10 @@ You must be ingesting data that records the filesystem activity from your hosts
 #### Known False Positives
 If there are files with this keywoord as file names it might trigger false possitives, please make use of our filters to tune out potential FPs.
 
+#### Associated Analytic story
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+
+
 #### Kill Chain Phase
 * Delivery
 
diff --git a/docs/_posts/2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md b/docs/_posts/2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
index 2657bf5f90..76641c3c31 100644
--- a/docs/_posts/2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
+++ b/docs/_posts/2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
@@ -73,6 +73,12 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 Administrators may attempt to change the default execution policy on a system for a variety of reasons. However, setting the policy to &#34;unrestricted&#34; or &#34;bypass&#34; as this search is designed to identify, would be unusual. Hits should be reviewed and investigated as appropriate.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+* [Credential Dumping](/stories/credential_dumping)
+* [HAFNIUM Group](/stories/hafnium_group)
+
+
 #### Kill Chain Phase
 * Installation
 * Actions on Objectives
diff --git a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md
index f3ad707faa..8a3f6289c7 100644
--- a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md
+++ b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md
@@ -68,6 +68,10 @@ You must be ingesting data that records the process-system activity from your ho
 #### Known False Positives
 SAM is a critical windows service, stopping it would cause major issues on an endpoint this makes false positive rare. AlthoughNo false positives have been identified.
 
+#### Associated Analytic story
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+
+
 #### Kill Chain Phase
 * Delivery
 
diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md
index 2475a86dc5..d43c67c5b2 100644
--- a/docs/_posts/2020-11-09-common_ransomware_extensions.md
+++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md
@@ -81,6 +81,13 @@ Detailed documentation on how to create a new field within Incident Review may b
 #### Known False Positives
 It is possible for a legitimate file with these extensions to be created. If this is a true ransomware attack, there will be a large number of files created with these extensions.
 
+#### Associated Analytic story
+* [SamSam Ransomware](/stories/samsam_ransomware)
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+* [Ransomware](/stories/ransomware)
+* [Clop Ransomware](/stories/clop_ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md
index 3cb530adc6..b24b64ffbc 100644
--- a/docs/_posts/2020-11-09-common_ransomware_notes.md
+++ b/docs/_posts/2020-11-09-common_ransomware_notes.md
@@ -76,6 +76,13 @@ You must be ingesting data that records file-system activity from your hosts to
 #### Known False Positives
 It&#39;s possible that a legitimate file could be created with the same name used by ransomware note files.
 
+#### Associated Analytic story
+* [SamSam Ransomware](/stories/samsam_ransomware)
+* [Ransomware](/stories/ransomware)
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+* [Clop Ransomware](/stories/clop_ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-11-09-deleting_shadow_copies.md b/docs/_posts/2020-11-09-deleting_shadow_copies.md
index f4526a1c69..ad23a6ce73 100644
--- a/docs/_posts/2020-11-09-deleting_shadow_copies.md
+++ b/docs/_posts/2020-11-09-deleting_shadow_copies.md
@@ -76,6 +76,13 @@ You must be ingesting endpoint data that tracks process activity, including pare
 #### Known False Positives
 vssadmin.exe and wmic.exe are standard applications shipped with modern versions of windows. They may be used by administrators to legitimately delete old backup copies, although this is typically rare.
 
+#### Associated Analytic story
+* [Windows Log Manipulation](/stories/windows_log_manipulation)
+* [SamSam Ransomware](/stories/samsam_ransomware)
+* [Ransomware](/stories/ransomware)
+* [Clop Ransomware](/stories/clop_ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
index f6cdcea037..aa00009ab1 100644
--- a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
+++ b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
@@ -85,6 +85,10 @@ If Splunk&gt;Phantom is also configured in your environment, a Playbook called &
 #### Known False Positives
 It&#39;s possible that a widely used system, such as a kiosk, could cause a large number of account lockouts.
 
+#### Associated Analytic story
+* [Account Monitoring and Controls](/stories/account_monitoring_and_controls)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
index ae2b8d16e7..9932ebf456 100644
--- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
+++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
@@ -81,6 +81,10 @@ You must be ingesting data that records registry activity from your hosts to pop
 #### Known False Positives
 It is uncommon for normal users to execute a series of commands used for network discovery. System administrators often use scripts to execute these commands. These can generate false positives.
 
+#### Associated Analytic story
+* [Unusual Processes](/stories/unusual_processes)
+
+
 #### Kill Chain Phase
 * Installation
 * Command and Control
diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
index 346eb9acad..290a04a004 100644
--- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
+++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
@@ -70,6 +70,10 @@ In order to successfully implement this analytic, you will need endpoint process
 #### Known False Positives
 There are circumstances where an application may legitimately execute and interact with the Windows command-line interface.
 
+#### Associated Analytic story
+* [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md
index 2ece88cdf8..ef8c5de8b7 100644
--- a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md
+++ b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md
@@ -73,6 +73,12 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 This registry key may be modified via administrators to implement a change in system policy. This type of change should be a very rare occurrence.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities)
+* [Remcos](/stories/remcos)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md
index 3600b15dd1..5124e0ddf9 100644
--- a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md
+++ b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md
@@ -73,6 +73,11 @@ To successfully implement this search, you must be ingesting data that records p
 #### Known False Positives
 None identified.
 
+#### Associated Analytic story
+* [Windows File Extension and Association Abuse](/stories/windows_file_extension_and_association_abuse)
+* [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md
index bd9de3e6b8..7e9b0800d9 100644
--- a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md
+++ b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md
@@ -75,6 +75,10 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 None identified
 
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
index 67facd573d..656d5a3574 100644
--- a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
+++ b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
@@ -79,6 +79,11 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 It is unusual for a service to be created or modified by directly manipulating the registry. However, there may be legitimate instances of this behavior. It is important to validate and investigate, as appropriate.
 
+#### Associated Analytic story
+* [Windows Service Abuse](/stories/windows_service_abuse)
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Installation
 
diff --git a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md
index 4ea2fd9f70..4e44caf07e 100644
--- a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md
+++ b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md
@@ -78,6 +78,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators may create jobs on systems forcing reboots to perform updates, maintenance, etc.
 
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-12-08-shim_database_file_creation.md b/docs/_posts/2020-12-08-shim_database_file_creation.md
index 9cb77436c2..34a4be73a2 100644
--- a/docs/_posts/2020-12-08-shim_database_file_creation.md
+++ b/docs/_posts/2020-12-08-shim_database_file_creation.md
@@ -74,6 +74,10 @@ You must be ingesting data that records the filesystem activity from your hosts
 #### Known False Positives
 Because legitimate shim files are created and used all the time, this event, in itself, is not suspicious. However, if there are other correlating events, it may warrant further investigation.
 
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md
index 3ed544d810..a70ffa2fbe 100644
--- a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md
+++ b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md
@@ -76,6 +76,10 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 Single-letter executables are not always malicious. Investigate this activity with your normal incident-response process.
 
+#### Associated Analytic story
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
index f082ac7ae8..e290aacc01 100644
--- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
+++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
@@ -85,6 +85,13 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 This detection may require tuning based on third party applications utilizing native Windows binaries in non-standard paths.
 
+#### Associated Analytic story
+* [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions)
+* [Unusual Processes](/stories/unusual_processes)
+* [Ransomware](/stories/ransomware)
+* [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-12-08-unusually_long_command_line.md b/docs/_posts/2020-12-08-unusually_long_command_line.md
index e10ce8f2f4..ce3469275f 100644
--- a/docs/_posts/2020-12-08-unusually_long_command_line.md
+++ b/docs/_posts/2020-12-08-unusually_long_command_line.md
@@ -66,6 +66,13 @@ You must be ingesting endpoint data that tracks process activity, including pare
 #### Known False Positives
 Some legitimate applications start with long command lines.
 
+#### Associated Analytic story
+* [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions)
+* [Unusual Processes](/stories/unusual_processes)
+* [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md
index 61057c10b2..481762c613 100644
--- a/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md
+++ b/docs/_posts/2020-12-08-wmi_permanent_event_subscription_-_sysmon.md
@@ -80,6 +80,10 @@ To successfully implement this search, you must be collecting Sysmon data using
 #### Known False Positives
 Although unlikely, administrators may use event subscriptions for legitimate purposes.
 
+#### Associated Analytic story
+* [Suspicious WMI Use](/stories/suspicious_wmi_use)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
index 18c5cafaea..79ecf90ed5 100644
--- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
+++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
@@ -71,6 +71,10 @@ This detection relies on sysmon logs with the Event ID 7, Driver loaded. Please
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [NOBELIUM Group](/stories/nobelium_group)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md
index e143f9fb30..ca41bf7cfe 100644
--- a/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md
+++ b/docs/_posts/2020-12-15-o365_suspicious_rights_delegation.md
@@ -73,6 +73,10 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365
 #### Known False Positives
 Service Accounts
 
+#### Associated Analytic story
+* [Office 365 Detections](/stories/office_365_detections)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md
index 8c53fecab5..8260fbfc93 100644
--- a/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md
+++ b/docs/_posts/2020-12-16-high_number_of_login_failures_from_a_single_source.md
@@ -77,6 +77,10 @@ Note that `high_number_of_login_failures_from_a_single_source_filter` is a empty
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Office 365 Detections](/stories/office_365_detections)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-12-16-o365_excessive_authentication_failures_alert.md b/docs/_posts/2020-12-16-o365_excessive_authentication_failures_alert.md
index 594a99ea9c..80be2b8a77 100644
--- a/docs/_posts/2020-12-16-o365_excessive_authentication_failures_alert.md
+++ b/docs/_posts/2020-12-16-o365_excessive_authentication_failures_alert.md
@@ -71,6 +71,10 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365
 #### Known False Positives
 The threshold for alert is above 10 attempts and this should reduce the number of false positives.
 
+#### Associated Analytic story
+* [Office 365 Detections](/stories/office_365_detections)
+
+
 #### Kill Chain Phase
 * Not Applicable
 
diff --git a/docs/_posts/2020-12-16-o365_pst_export_alert.md b/docs/_posts/2020-12-16-o365_pst_export_alert.md
index 875631c122..d271a1647c 100644
--- a/docs/_posts/2020-12-16-o365_pst_export_alert.md
+++ b/docs/_posts/2020-12-16-o365_pst_export_alert.md
@@ -70,6 +70,11 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365
 #### Known False Positives
 PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored.
 
+#### Associated Analytic story
+* [Office 365 Detections](/stories/office_365_detections)
+* [Data Exfiltration](/stories/data_exfiltration)
+
+
 #### Kill Chain Phase
 * Actions on Objective
 
diff --git a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md
index 415dbd7377..a00ebd9794 100644
--- a/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md
+++ b/docs/_posts/2020-12-16-o365_suspicious_admin_email_forwarding.md
@@ -74,6 +74,11 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Office 365 Detections](/stories/office_365_detections)
+* [Data Exfiltration](/stories/data_exfiltration)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md
index 13a1a36240..827517be27 100644
--- a/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md
+++ b/docs/_posts/2020-12-16-o365_suspicious_user_email_forwarding.md
@@ -74,6 +74,11 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Office 365 Detections](/stories/office_365_detections)
+* [Data Exfiltration](/stories/data_exfiltration)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-12-17-scheduled_task_deleted_or_created_via_cmd.md b/docs/_posts/2020-12-17-scheduled_task_deleted_or_created_via_cmd.md
index a27f4656cd..3919624069 100644
--- a/docs/_posts/2020-12-17-scheduled_task_deleted_or_created_via_cmd.md
+++ b/docs/_posts/2020-12-17-scheduled_task_deleted_or_created_via_cmd.md
@@ -79,6 +79,11 @@ You must be ingesting endpoint data that tracks process activity, including pare
 #### Known False Positives
 Tasks should not be manually created via CLI, this is rarely done by admins as well
 
+#### Associated Analytic story
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+* [NOBELIUM Group](/stories/nobelium_group)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md
index ed3f2af60d..b63021ff09 100644
--- a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md
+++ b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md
@@ -70,6 +70,11 @@ You must be ingesting endpoint data that tracks process activity, including pare
 #### Known False Positives
 Administrators may modify the boot configuration.
 
+#### Associated Analytic story
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-01-06-supernova_webshell.md b/docs/_posts/2021-01-06-supernova_webshell.md
index 1ec714268d..c5ff556d0e 100644
--- a/docs/_posts/2021-01-06-supernova_webshell.md
+++ b/docs/_posts/2021-01-06-supernova_webshell.md
@@ -69,6 +69,10 @@ To successfully implement this search, you need to be monitoring web traffic to
 #### Known False Positives
 There might be false positives associted with this detection since items like args as a web argument is pretty generic.
 
+#### Associated Analytic story
+* [NOBELIUM Group](/stories/nobelium_group)
+
+
 #### Kill Chain Phase
 * Exfiltration
 
diff --git a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
index b44cc439fd..27d3299fb8 100644
--- a/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
+++ b/docs/_posts/2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
@@ -77,6 +77,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Ransomware Cloud](/stories/ransomware_cloud)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
index 3fb4142bd9..6c4f44912a 100644
--- a/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
+++ b/docs/_posts/2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
@@ -72,6 +72,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 bucket with S3 encryption
 
+#### Associated Analytic story
+* [Ransomware Cloud](/stories/ransomware_cloud)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
index 08ed898c0d..0501524009 100644
--- a/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
+++ b/docs/_posts/2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
@@ -82,6 +82,10 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-
 #### Known False Positives
 It&#39;s possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.
 
+#### Associated Analytic story
+* [AWS Network ACL Activity](/stories/aws_network_acl_activity)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md
index 3b76728ac7..90481fd30d 100644
--- a/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md
+++ b/docs/_posts/2021-01-12-aws_network_access_control_list_deleted.md
@@ -75,6 +75,10 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-
 #### Known False Positives
 It&#39;s possible that a user has legitimately deleted a network ACL.
 
+#### Associated Analytic story
+* [AWS Network ACL Activity](/stories/aws_network_acl_activity)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
index 9cff0748ad..daae7b88bc 100644
--- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
+++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
@@ -77,6 +77,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, limited instances have been identified coming from native Microsoft utilities similar to SCCM.
 
+#### Associated Analytic story
+* [Trusted Developer Utilities Proxy Execution](/stories/trusted_developer_utilities_proxy_execution)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_path.md b/docs/_posts/2021-01-12-suspicious_msbuild_path.md
index d80ce55062..5b8d0c02ef 100644
--- a/docs/_posts/2021-01-12-suspicious_msbuild_path.md
+++ b/docs/_posts/2021-01-12-suspicious_msbuild_path.md
@@ -89,6 +89,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Some legitimate applications may use a moved copy of msbuild.exe, triggering a false positive. Baselining of MSBuild.exe usage is recommended to better understand it&#39;s path usage. Visual Studio runs an instance out of a path that will need to be filtered on.
 
+#### Associated Analytic story
+* [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild)
+* [Cobalt Strike](/stories/cobalt_strike)
+* [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_rename.md b/docs/_posts/2021-01-12-suspicious_msbuild_rename.md
index 8385989040..23ea599cce 100644
--- a/docs/_posts/2021-01-12-suspicious_msbuild_rename.md
+++ b/docs/_posts/2021-01-12-suspicious_msbuild_rename.md
@@ -89,6 +89,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, some legitimate applications may use a moved copy of msbuild, triggering a false positive.
 
+#### Associated Analytic story
+* [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild)
+* [Cobalt Strike](/stories/cobalt_strike)
+* [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
index 97e3352761..e6c4885ebb 100644
--- a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
+++ b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
 
+#### Associated Analytic story
+* [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md
index 7ee6e8ee00..60472da69b 100644
--- a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md
+++ b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md
@@ -75,6 +75,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
 
+#### Associated Analytic story
+* [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
index 92e1219b1d..7d76860d9e 100644
--- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
+++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
@@ -81,6 +81,15 @@ Detailed documentation on how to create a new field within Incident Review may b
 #### Known False Positives
 Some users and applications may leverage Dynamic DNS to reach out to some domains on the Internet since dynamic DNS by itself is not malicious, however this activity must be verified.
 
+#### Associated Analytic story
+* [Data Protection](/stories/data_protection)
+* [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch)
+* [DNS Hijacking](/stories/dns_hijacking)
+* [Suspicious DNS Traffic](/stories/suspicious_dns_traffic)
+* [Dynamic DNS](/stories/dynamic_dns)
+* [Command and Control](/stories/command_and_control)
+
+
 #### Kill Chain Phase
 * Command and Control
 * Actions on Objectives
diff --git a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
index cf26597d0f..aa40219ba0 100644
--- a/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
+++ b/docs/_posts/2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
@@ -83,6 +83,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 These characters might be legitimately on the command-line, but it is not common.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
 #### Kill Chain Phase
 * Command and Control
 * Actions on Objectives
diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
index 599cf9fd29..92bd572314 100644
--- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
+++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
@@ -81,6 +81,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
 
+#### Associated Analytic story
+* [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity)
+* [NOBELIUM Group](/stories/nobelium_group)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md
index 80bd26e56c..a68360f0a5 100644
--- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md
+++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
 
+#### Associated Analytic story
+* [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md
index 5cdd4df6b9..8d9127dfaf 100644
--- a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md
+++ b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md
@@ -70,6 +70,11 @@ You must be ingesting endpoint data that tracks process activity, including pare
 #### Known False Positives
 Administrators may modify the boot configuration.
 
+#### Associated Analytic story
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md b/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md
index dfc4b51beb..6ab95ee750 100644
--- a/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md
+++ b/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md
@@ -72,6 +72,13 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators may use nltest for troubleshooting purposes, otherwise, rarely used.
 
+#### Associated Analytic story
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+* [Domain Trust Discovery](/stories/domain_trust_discovery)
+* [IcedID](/stories/icedid)
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md
index d593083511..1f070ebcec 100644
--- a/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md
+++ b/docs/_posts/2021-01-26-aws_saml_access_by_provider_user_and_principal.md
@@ -75,6 +75,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks.
 
+#### Associated Analytic story
+* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md
index 10f1bba1a2..85af5f6d57 100644
--- a/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md
+++ b/docs/_posts/2021-01-26-aws_saml_update_identity_provider.md
@@ -74,6 +74,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored.
 
+#### Associated Analytic story
+* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md
index 1de9b24b58..c5fd69aeed 100644
--- a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md
+++ b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md
@@ -66,6 +66,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services.
 
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
+
+
 #### Kill Chain Phase
 * Installation
 
diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md
index 8d7cf2c5fd..f414d083c6 100644
--- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md
+++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md
@@ -65,6 +65,10 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-
 #### Known False Positives
 None
 
+#### Associated Analytic story
+* [AWS Security Hub Alerts](/stories/aws_security_hub_alerts)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md
index 799509ab5e..d9c002d920 100644
--- a/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md
+++ b/docs/_posts/2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md
@@ -63,6 +63,10 @@ You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-
 #### Known False Positives
 None
 
+#### Associated Analytic story
+* [AWS Security Hub Alerts](/stories/aws_security_hub_alerts)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md
index 082a842ca9..2f173a8259 100644
--- a/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md
+++ b/docs/_posts/2021-01-26-o365_add_app_role_assignment_grant_user.md
@@ -75,6 +75,11 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365
 #### Known False Positives
 The creation of a new Federation is not necessarily malicious, however this events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.
 
+#### Associated Analytic story
+* [Office 365 Detections](/stories/office_365_detections)
+* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
+
+
 #### Kill Chain Phase
 * Actions on Objective
 
diff --git a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md
index 6012bca0bf..d21d8a1de2 100644
--- a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md
+++ b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md
@@ -72,6 +72,11 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365
 #### Known False Positives
 Logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password obtained via credential access attack.
 
+#### Associated Analytic story
+* [Office 365 Detections](/stories/office_365_detections)
+* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
+
+
 #### Kill Chain Phase
 * Actions on Objective
 
diff --git a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md
index ec2fb1c400..a107f285b4 100644
--- a/docs/_posts/2021-01-26-o365_new_federated_domain_added.md
+++ b/docs/_posts/2021-01-26-o365_new_federated_domain_added.md
@@ -76,6 +76,11 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365
 #### Known False Positives
 The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider.
 
+#### Associated Analytic story
+* [Office 365 Detections](/stories/office_365_detections)
+* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
+
+
 #### Kill Chain Phase
 * Actions on Objective
 
diff --git a/docs/_posts/2021-01-26-revil_registry_entry.md b/docs/_posts/2021-01-26-revil_registry_entry.md
index 4ca50ef9b6..91dc707482 100644
--- a/docs/_posts/2021-01-26-revil_registry_entry.md
+++ b/docs/_posts/2021-01-26-revil_registry_entry.md
@@ -74,6 +74,11 @@ to successfully implement this search, you need to be ingesting logs with the Im
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+* [Revil Ransomware](/stories/revil_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md
index 1967edd8da..6d86259c4f 100644
--- a/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md
+++ b/docs/_posts/2021-01-27-detect_baron_samedit_cve-2021-3156.md
@@ -63,6 +63,10 @@ Splunk Universal Forwarder running on Linux systems, capturing logs from the /va
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Baron Samedit CVE-2021-3156](/stories/baron_samedit_cve-2021-3156)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md
index ab29cc0995..5456b359c8 100644
--- a/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md
+++ b/docs/_posts/2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md
@@ -64,6 +64,10 @@ OSQuery installed and configured to pick up process events (info at https://osqu
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Baron Samedit CVE-2021-3156](/stories/baron_samedit_cve-2021-3156)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
index 2bb9f1078f..a625b55a31 100644
--- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
+++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
@@ -82,6 +82,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives related to third party software registering .DLL&#39;s.
 
+#### Associated Analytic story
+* [Suspicious Regsvr32 Activity](/stories/suspicious_regsvr32_activity)
+* [Cobalt Strike](/stories/cobalt_strike)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md
index 818c5b9538..5c9793da42 100644
--- a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md
+++ b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md
@@ -78,6 +78,11 @@ You must be ingesting endpoint data that tracks process activity, including pare
 #### Known False Positives
 Highly possible Server Administrators will troubleshoot with ntdsutil.exe, generating false positives.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+* [HAFNIUM Group](/stories/hafnium_group)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
index e8f27e3d78..6e457f0dde 100644
--- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
+++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
@@ -81,6 +81,11 @@ You must be ingesting endpoint data that tracks process activity, including pare
 #### Known False Positives
 Limited false positives with the query restricted to specified paths. Add more world writeable paths as tuning continues.
 
+#### Associated Analytic story
+* [Suspicious Regsvr32 Activity](/stories/suspicious_regsvr32_activity)
+* [Iceid](/stories/iceid)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md
index abea0eb9d5..129e3f94ec 100644
--- a/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md
+++ b/docs/_posts/2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md
@@ -66,6 +66,10 @@ Splunk Universal Forwarder running on Linux systems (tested on Centos and Ubuntu
 #### Known False Positives
 If sudoedit is throwing segfaults for other reasons this will pick those up too.
 
+#### Associated Analytic story
+* [Baron Samedit CVE-2021-3156](/stories/baron_samedit_cve-2021-3156)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
index 63bdaeb27b..a5d64251bb 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, some legitimate applications may use advpack.dll or ieadvpack.dll, triggering a false positive.
 
+#### Associated Analytic story
+* [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
index 551faeaa90..75cf61c6b1 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, some legitimate applications may use setupapi triggering a false positive.
 
+#### Associated Analytic story
+* [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
index 3210b16d24..9995c74278 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, some legitimate applications may use syssetup.dll, triggering a false positive.
 
+#### Associated Analytic story
+* [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
index 1de93e1a54..df5b7c1427 100644
--- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
+++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
@@ -81,6 +81,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, some legitimate applications may use Start as a function and call it via the command line. Filter as needed.
 
+#### Associated Analytic story
+* [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity)
+* [Cobalt Strike](/stories/cobalt_strike)
+* [Trickbot](/stories/trickbot)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
index 549a698978..b2f8d76426 100644
--- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
+++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 This is likely to produce false positives and will require some filtering. Tune the query by adding command line paths to known good DLLs, or filtering based on parent process names.
 
+#### Associated Analytic story
+* [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md
index 789f5db52b..281d4edb0f 100644
--- a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md
+++ b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md
@@ -80,6 +80,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, some legitimate applications (ex. web browsers) may spawn a child process. Filter as needed.
 
+#### Associated Analytic story
+* [Suspicious Compiled HTML Activity](/stories/suspicious_compiled_html_activity)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md
index d0f916d569..a202ae9c5e 100644
--- a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md
+++ b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md
@@ -76,6 +76,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
 
+#### Associated Analytic story
+* [Suspicious Regsvcs Regasm Activity](/stories/suspicious_regsvcs_regasm_activity)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md
index be153ef052..3fca77c1f7 100644
--- a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md
+++ b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md
@@ -77,6 +77,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, limited instances of regasm.exe or regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
 
+#### Associated Analytic story
+* [Suspicious Regsvcs Regasm Activity](/stories/suspicious_regsvcs_regasm_activity)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-02-16-detect_regasm_with_network_connection.md b/docs/_posts/2021-02-16-detect_regasm_with_network_connection.md
index 3665d519a8..9311d225c8 100644
--- a/docs/_posts/2021-02-16-detect_regasm_with_network_connection.md
+++ b/docs/_posts/2021-02-16-detect_regasm_with_network_connection.md
@@ -76,6 +76,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Although unlikely, limited instances of regasm.exe with a network connection may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
 
+#### Associated Analytic story
+* [Suspicious Regsvcs Regasm Activity](/stories/suspicious_regsvcs_regasm_activity)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-02-16-detect_regsvcs_with_network_connection.md b/docs/_posts/2021-02-16-detect_regsvcs_with_network_connection.md
index 4e20253732..e554c387a6 100644
--- a/docs/_posts/2021-02-16-detect_regsvcs_with_network_connection.md
+++ b/docs/_posts/2021-02-16-detect_regsvcs_with_network_connection.md
@@ -75,6 +75,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
 
+#### Associated Analytic story
+* [Suspicious Regsvcs Regasm Activity](/stories/suspicious_regsvcs_regasm_activity)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md b/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md
index 07770aad57..6d9c365300 100644
--- a/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md
+++ b/docs/_posts/2021-02-22-aws_create_policy_version_to_allow_all_resources.md
@@ -82,6 +82,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 While this search has no known false positives, it is possible that an AWS admin has legitimately created a policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources
 
+#### Associated Analytic story
+* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md
index cae86a69bd..0c447dcf0b 100644
--- a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md
+++ b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md
@@ -72,6 +72,12 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 The idea of using named pipes with Cobalt Strike is to blend in. Therefore, some of the named pipes identified and added may cause false positives. Filter by process name or pipe name to reduce false positives.
 
+#### Associated Analytic story
+* [Cobalt Strike](/stories/cobalt_strike)
+* [Trickbot](/stories/trickbot)
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md
index 5428e35ec1..e27ff20cfd 100644
--- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md
+++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md
@@ -74,6 +74,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Unknown. Filter as needed.
 
+#### Associated Analytic story
+* [Silver Sparrow](/stories/silver_sparrow)
+* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md
index 765ccdd1f7..66c80f2b20 100644
--- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md
+++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md
@@ -87,6 +87,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Some legitimate applications may use PlistBuddy to create or modify property lists and possibly generate false positives. Review the property list being modified or created to confirm.
 
+#### Associated Analytic story
+* [Silver Sparrow](/stories/silver_sparrow)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md
index bbbe496e18..fd5c3c0389 100644
--- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md
+++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage_via_osquery.md
@@ -75,6 +75,10 @@ OSQuery must be installed and configured to pick up process events (info at http
 #### Known False Positives
 Some legitimate applications may use PlistBuddy to create or modify property lists and possibly generate false positives. Review the property list being modified or created to confirm.
 
+#### Associated Analytic story
+* [Silver Sparrow](/stories/silver_sparrow)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
index 121d82b08f..4202b50957 100644
--- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
+++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
@@ -74,6 +74,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Unknown.
 
+#### Associated Analytic story
+* [Silver Sparrow](/stories/silver_sparrow)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-03-01-any_powershell_downloadfile.md b/docs/_posts/2021-03-01-any_powershell_downloadfile.md
index 0bef56449e..80d4b932d4 100644
--- a/docs/_posts/2021-03-01-any_powershell_downloadfile.md
+++ b/docs/_posts/2021-03-01-any_powershell_downloadfile.md
@@ -82,6 +82,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives may be present and filtering will need to occur by parent process or command line argument. It may be required to modify this query to an EDR product for more granular coverage.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
+* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-03-01-any_powershell_downloadstring.md b/docs/_posts/2021-03-01-any_powershell_downloadstring.md
index da0ec36b57..39e95861b2 100644
--- a/docs/_posts/2021-03-01-any_powershell_downloadstring.md
+++ b/docs/_posts/2021-03-01-any_powershell_downloadstring.md
@@ -81,6 +81,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives may be present and filtering will need to occur by parent process or command line argument. It may be required to modify this query to an EDR product for more granular coverage.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+* [HAFNIUM Group](/stories/hafnium_group)
+* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md
index d7df781863..83ea873a58 100644
--- a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md
+++ b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md
@@ -87,6 +87,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited to no false positives are expected.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 * Privilege Escalation
diff --git a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md
index c6913d9176..609e91a902 100644
--- a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md
+++ b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md
@@ -77,6 +77,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited to no known false positives.
 
+#### Associated Analytic story
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 * Lateral Movement
diff --git a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md
index 6baad1e3ba..b6eb609c7b 100644
--- a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md
+++ b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md
@@ -81,6 +81,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives may be present. Filter as needed by parent process or command line argument.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Exploitation
 * Privilege Escalation
diff --git a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md
index 68da1286d8..68580045bf 100644
--- a/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md
+++ b/docs/_posts/2021-03-02-aws_setdefaultpolicyversion.md
@@ -79,6 +79,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 While this search has no known false positives, it is possible that an AWS admin has legitimately set a default policy to allow a user to access all resources. That said, AWS strongly advises against granting full control to all AWS resources
 
+#### Associated Analytic story
+* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md
index 451e3eae36..8ced3b6b48 100644
--- a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md
+++ b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Unknown. Tune out child processes as needed to limit volume of false positives.
 
+#### Associated Analytic story
+* [HAFNIUM Group](/stories/hafnium_group)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md
index 4014bd1a7b..478fc1bb35 100644
--- a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md
+++ b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md
@@ -74,6 +74,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search.
 
+#### Associated Analytic story
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Delivery
 
diff --git a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md
index 7cbe194dbe..3839c46625 100644
--- a/docs/_posts/2021-03-03-nishang_powershelltcponeline.md
+++ b/docs/_posts/2021-03-03-nishang_powershelltcponeline.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives may be present. Filter as needed based on initial analysis.
 
+#### Associated Analytic story
+* [HAFNIUM Group](/stories/hafnium_group)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md
index fa685a3fd8..45e83e2b38 100644
--- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md
+++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md
@@ -85,6 +85,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Baseline your environment before production. It is possible build systems using IIS will spawn cmd.exe to perform a software build. Filter as needed.
 
+#### Associated Analytic story
+* [HAFNIUM Group](/stories/hafnium_group)
+* [ProxyShell](/stories/proxyshell)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
index 7f8d61d3e7..79ee7a96a0 100644
--- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
+++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
@@ -72,6 +72,12 @@ You must be ingesting data that records the filesystem activity from your hosts
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Clop Ransomware](/stories/clop_ransomware)
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+* [BlackMatter Ransomware](/stories/blackmatter_ransomware)
+
+
 #### Kill Chain Phase
 * Obfuscation
 
diff --git a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md
index ddd6915e59..9abbb94fb4 100644
--- a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md
+++ b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md
@@ -71,6 +71,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 network admin can resize the shadowstorage for valid purposes.
 
+#### Associated Analytic story
+* [Clop Ransomware](/stories/clop_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-03-16-high_file_deletion_frequency.md b/docs/_posts/2021-03-16-high_file_deletion_frequency.md
index b41da01825..b1ba84e878 100644
--- a/docs/_posts/2021-03-16-high_file_deletion_frequency.md
+++ b/docs/_posts/2021-03-16-high_file_deletion_frequency.md
@@ -71,6 +71,11 @@ To successfully implement this search, you need to be ingesting logs with the de
 #### Known False Positives
 user may delete bunch of pictures or files in a folder.
 
+#### Associated Analytic story
+* [Clop Ransomware](/stories/clop_ransomware)
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md
index d52c3f6edd..1dfa1d3685 100644
--- a/docs/_posts/2021-03-16-high_process_termination_frequency.md
+++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md
@@ -70,6 +70,10 @@ To successfully implement this search, you need to be ingesting logs with the Im
 #### Known False Positives
 admin or user tool that can terminate multiple process.
 
+#### Associated Analytic story
+* [Clop Ransomware](/stories/clop_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-03-17-clop_common_exec_parameter.md b/docs/_posts/2021-03-17-clop_common_exec_parameter.md
index 068515d48f..9ff0e39833 100644
--- a/docs/_posts/2021-03-17-clop_common_exec_parameter.md
+++ b/docs/_posts/2021-03-17-clop_common_exec_parameter.md
@@ -76,6 +76,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Operators can execute third party tools using these parameters.
 
+#### Associated Analytic story
+* [Clop Ransomware](/stories/clop_ransomware)
+
+
 #### Kill Chain Phase
 * Obfuscation
 
diff --git a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md
index 11d3adae0e..3187904952 100644
--- a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md
+++ b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md
@@ -71,6 +71,10 @@ To successfully implement this search, you need to be ingesting logs with the Se
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Clop Ransomware](/stories/clop_ransomware)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-03-17-process_deleting_its_process_file_path.md b/docs/_posts/2021-03-17-process_deleting_its_process_file_path.md
index 3639071d7f..4746685d8c 100644
--- a/docs/_posts/2021-03-17-process_deleting_its_process_file_path.md
+++ b/docs/_posts/2021-03-17-process_deleting_its_process_file_path.md
@@ -75,6 +75,12 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Clop Ransomware](/stories/clop_ransomware)
+* [Remcos](/stories/remcos)
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md
index 21fba81d1d..be06dcb77a 100644
--- a/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md
+++ b/docs/_posts/2021-03-23-certutil_download_with_urlcache_and_split_arguments.md
@@ -77,6 +77,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives in most environments, however tune as needed based on parent-child relationship or network connection.
 
+#### Associated Analytic story
+* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md
index dccf148d4f..3bba649773 100644
--- a/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md
+++ b/docs/_posts/2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md
@@ -77,6 +77,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives in most environments, however tune as needed based on parent-child relationship or network connection.
 
+#### Associated Analytic story
+* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md
index 90c16a6c22..1683a7cd83 100644
--- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md
+++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md
@@ -77,6 +77,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Typically seen used to `encode` files, but it is possible to see legitimate use of `decode`. Filter based on parent-child relationship, file paths, endpoint or user.
 
+#### Associated Analytic story
+* [Deobfuscate-Decode Files or Information](/stories/deobfuscate-decode_files_or_information)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md
index afa0789b5e..0fbed53d8f 100644
--- a/docs/_posts/2021-03-29-powershell_start-bitstransfer.md
+++ b/docs/_posts/2021-03-29-powershell_start-bitstransfer.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives. It is possible administrators will utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent process or command-line arguments.
 
+#### Associated Analytic story
+* [BITS Jobs](/stories/bits_jobs)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md
index 9ac197ab0f..5dd055e378 100644
--- a/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md
+++ b/docs/_posts/2021-03-31-aws_iam_successful_group_deletion.md
@@ -76,6 +76,10 @@ The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. T
 #### Known False Positives
 This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
 
+#### Associated Analytic story
+* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
index ba70766735..638189f50e 100644
--- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
+++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 admin may disable firewall during testing or fixing network problem.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-03-31-dsquery_domain_discovery.md b/docs/_posts/2021-03-31-dsquery_domain_discovery.md
index 8f061790c4..b8bcb7c42f 100644
--- a/docs/_posts/2021-03-31-dsquery_domain_discovery.md
+++ b/docs/_posts/2021-03-31-dsquery_domain_discovery.md
@@ -77,6 +77,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives. If there is a true false positive, filter based on command-line or parent process.
 
+#### Associated Analytic story
+* [Domain Trust Discovery](/stories/domain_trust_discovery)
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md
index 1ff8f647af..c863e6d360 100644
--- a/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md
+++ b/docs/_posts/2021-04-01-aws_iam_assume_role_policy_brute_force.md
@@ -73,6 +73,10 @@ The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. T
 #### Known False Positives
 This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users.
 
+#### Associated Analytic story
+* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-04-01-aws_iam_delete_policy.md b/docs/_posts/2021-04-01-aws_iam_delete_policy.md
index 969d7f2d51..7918c72dc9 100644
--- a/docs/_posts/2021-04-01-aws_iam_delete_policy.md
+++ b/docs/_posts/2021-04-01-aws_iam_delete_policy.md
@@ -68,6 +68,10 @@ The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. T
 #### Known False Positives
 This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete policies (least privilege). In addition, this may be saved seperately and tuned for failed or success attempts only.
 
+#### Associated Analytic story
+* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md
index 6cbe48ecc4..38bc84981c 100644
--- a/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md
+++ b/docs/_posts/2021-04-01-aws_iam_failure_group_deletion.md
@@ -68,6 +68,10 @@ The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. T
 #### Known False Positives
 This detection will require tuning to provide high fidelity detection capabilties. Tune based on src addresses (corporate offices, VPN terminations) or by groups of users. Not every user with AWS access should have permission to delete groups (least privilege).
 
+#### Associated Analytic story
+* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md
index 3b2227864e..9ed093a7e9 100644
--- a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md
+++ b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md
@@ -84,6 +84,10 @@ To successfully implement this search, you need to be ingesting Windows System l
 #### Known False Positives
 Creating a hidden powershell service is rare and could key off of those instances.
 
+#### Associated Analytic story
+* [Malicious Powershell](/stories/malicious_powershell)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md b/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md
index a6f539edd3..1f711a83ac 100644
--- a/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md
+++ b/docs/_posts/2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md
@@ -76,6 +76,10 @@ To successfully implement this search, you need to be ingesting Domain Controlle
 #### Known False Positives
 A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, missconfigured systems and multi-user systems like Citrix farms.
 
+#### Associated Analytic story
+* [Active Directory Password Spraying](/stories/active_directory_password_spraying)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md
index 0532aa09d4..207014cc67 100644
--- a/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md
+++ b/docs/_posts/2021-04-08-winevent_scheduled_task_created_within_public_path.md
@@ -81,6 +81,14 @@ To successfully implement this search, you need to be ingesting Windows Security
 #### Known False Positives
 False positives are possible if legitimate applications are allowed to register tasks in public paths. Filter as needed based on paths that are used legitimately.
 
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Ransomware](/stories/ransomware)
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+* [IcedID](/stories/icedid)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-04-12-excel_spawning_powershell.md b/docs/_posts/2021-04-12-excel_spawning_powershell.md
index c55a5c0d0e..0e775ad60c 100644
--- a/docs/_posts/2021-04-12-excel_spawning_powershell.md
+++ b/docs/_posts/2021-04-12-excel_spawning_powershell.md
@@ -80,6 +80,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited, but if any are present, filter as needed.
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md
index 13653d9f0b..5159b09a09 100644
--- a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md
+++ b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md
@@ -75,6 +75,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited, but if any are present, filter as needed. In some instances, `cscript.exe` is used for legitimate business practices.
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md
index d60433d5b9..589fd0ecd7 100644
--- a/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md
+++ b/docs/_posts/2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md
@@ -81,6 +81,12 @@ To successfully implement this search, you need to be ingesting Windows Security
 #### Known False Positives
 False positives are possible if legitimate applications are allowed to register tasks that call a shell to be spawned. Filter as needed based on command-line or processes that are used legitimately.
 
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Ransomware](/stories/ransomware)
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-04-12-winword_spawning_powershell.md b/docs/_posts/2021-04-12-winword_spawning_powershell.md
index b6ef8edc95..cff7381200 100644
--- a/docs/_posts/2021-04-12-winword_spawning_powershell.md
+++ b/docs/_posts/2021-04-12-winword_spawning_powershell.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited, but if any are present, filter as needed.
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md
index 9181dcd42b..1329d297e5 100644
--- a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md
+++ b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md
@@ -75,6 +75,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 There will be limited false positives and it will be different for every environment. Tune by child process or command-line as needed.
 
+#### Associated Analytic story
+* [Spearphishing Attachment](/stories/spearphishing_attachment)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md
index 2beebb149d..7c16d020c3 100644
--- a/docs/_posts/2021-04-13-aws_excessive_security_scanning.md
+++ b/docs/_posts/2021-04-13-aws_excessive_security_scanning.md
@@ -70,6 +70,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 While this search has no known false positives.
 
+#### Associated Analytic story
+* [AWS User Monitoring](/stories/aws_user_monitoring)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md b/docs/_posts/2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md
index a7f6922018..bb808deb34 100644
--- a/docs/_posts/2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md
+++ b/docs/_posts/2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md
@@ -79,6 +79,10 @@ To successfully implement this search, you need to be ingesting Windows Event Lo
 #### Known False Positives
 A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc.
 
+#### Associated Analytic story
+* [Active Directory Password Spraying](/stories/active_directory_password_spraying)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md
index f31477bd45..cc15e9b7f4 100644
--- a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md
+++ b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md
@@ -76,6 +76,10 @@ To successfully implement this search, you need to be ingesting Domain Controlle
 #### Known False Positives
 A host failing to authenticate with multiple valid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host&#39;s local accounts.
 
+#### Associated Analytic story
+* [Active Directory Password Spraying](/stories/active_directory_password_spraying)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md
index d50eee518c..17e38976e8 100644
--- a/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md
+++ b/docs/_posts/2021-04-13-multiple_users_failing_to_authenticate_from_process.md
@@ -80,6 +80,10 @@ To successfully implement this search, you need to be ingesting Windows Event Lo
 #### Known False Positives
 A process failing to authenticate with multiple users is not a common behavior for legitimate user sessions. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems.
 
+#### Associated Analytic story
+* [Active Directory Password Spraying](/stories/active_directory_password_spraying)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md b/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md
index 69b4679d8e..530308b663 100644
--- a/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md
+++ b/docs/_posts/2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md
@@ -79,6 +79,10 @@ To successfully implement this search, you need to be ingesting Windows Event Lo
 #### Known False Positives
 A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc.
 
+#### Associated Analytic story
+* [Active Directory Password Spraying](/stories/active_directory_password_spraying)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
index c2167d1813..be11100b30 100644
--- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
+++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
@@ -80,6 +80,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+* [Trickbot](/stories/trickbot)
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md b/docs/_posts/2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md
index c041d77f50..05ffe64130 100644
--- a/docs/_posts/2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md
+++ b/docs/_posts/2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md
@@ -76,6 +76,10 @@ To successfully implement this search, you need to be ingesting Domain Controlle
 #### Known False Positives
 A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems.
 
+#### Associated Analytic story
+* [Active Directory Password Spraying](/stories/active_directory_password_spraying)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md b/docs/_posts/2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md
index a20aafaae8..eefe7e5904 100644
--- a/docs/_posts/2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md
+++ b/docs/_posts/2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md
@@ -76,6 +76,10 @@ To successfully implement this search, you need to be ingesting Domain Controlle
 #### Known False Positives
 A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems.
 
+#### Associated Analytic story
+* [Active Directory Password Spraying](/stories/active_directory_password_spraying)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
index 7bc753ff9e..40a98dea08 100644
--- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
+++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
@@ -76,6 +76,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md
index 59f4b8372a..b81a360f72 100644
--- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md
+++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md
@@ -76,6 +76,12 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Normal Office Document macro use for automation
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+* [Trickbot](/stories/trickbot)
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md
index 9e7b9b623b..de950203dc 100644
--- a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md
+++ b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md
@@ -76,6 +76,13 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 admin nslookup usage
 
+#### Associated Analytic story
+* [Suspicious DNS Traffic](/stories/suspicious_dns_traffic)
+* [Dynamic DNS](/stories/dynamic_dns)
+* [Command and Control](/stories/command_and_control)
+* [Data Exfiltration](/stories/data_exfiltration)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md b/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md
index 61664ce79a..52737fa38b 100644
--- a/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md
+++ b/docs/_posts/2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md
@@ -76,6 +76,10 @@ To successfully implement this search, you need to be ingesting Domain Controlle
 #### Known False Positives
 A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host&#39;s local accounts.
 
+#### Associated Analytic story
+* [Active Directory Password Spraying](/stories/active_directory_password_spraying)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md b/docs/_posts/2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md
index ac0fbde7e2..a111143787 100644
--- a/docs/_posts/2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives may be present in small environments. Tuning may be required based on parent process.
 
+#### Associated Analytic story
+* [Cobalt Strike](/stories/cobalt_strike)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
index 2432be91b7..25a33b6e2e 100644
--- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
+++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
@@ -75,6 +75,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Trickbot](/stories/trickbot)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md
index d3624676df..35beaa31ba 100644
--- a/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md
+++ b/docs/_posts/2021-04-19-schedule_task_with_http_command_arguments.md
@@ -75,6 +75,10 @@ To successfully implement this search, you need to be ingesting logs with the ta
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md
index 2b828c2e12..43f8ba7e70 100644
--- a/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md
+++ b/docs/_posts/2021-04-19-schedule_task_with_rundll32_command_trigger.md
@@ -75,6 +75,12 @@ To successfully implement this search, you need to be ingesting logs with the ta
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Trickbot](/stories/trickbot)
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md
index b284f803cb..4353e4b153 100644
--- a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md
+++ b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md
@@ -76,6 +76,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Trickbot](/stories/trickbot)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
index 0ae120e202..5c49ee8e5a 100644
--- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
+++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
@@ -70,6 +70,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Trickbot](/stories/trickbot)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
index 3e3d8ebe9b..a669df4f04 100644
--- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
+++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Trickbot](/stories/trickbot)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md
index c8c74bbf9a..fa5d8c389a 100644
--- a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md
+++ b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md
@@ -72,6 +72,13 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Suspicious DNS Traffic](/stories/suspicious_dns_traffic)
+* [Dynamic DNS](/stories/dynamic_dns)
+* [Command and Control](/stories/command_and_control)
+* [Data Exfiltration](/stories/data_exfiltration)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md
index 84bfbf7b99..df21da7db7 100644
--- a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md
+++ b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md
@@ -80,6 +80,11 @@ To successfully implement this search, you need to be ingesting logs with the st
 #### Known False Positives
 Normal archive transfer via HTTP protocol may trip this detection.
 
+#### Associated Analytic story
+* [Command and Control](/stories/command_and_control)
+* [Data Exfiltration](/stories/data_exfiltration)
+
+
 #### Kill Chain Phase
 * Exfiltration
 
diff --git a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md
index f6d33e60fe..08ee666da8 100644
--- a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md
+++ b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md
@@ -78,6 +78,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited as this behavior is not normal for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip.
 
+#### Associated Analytic story
+* [Cobalt Strike](/stories/cobalt_strike)
+* [NOBELIUM Group](/stories/nobelium_group)
+
+
 #### Kill Chain Phase
 * Actions on Objective
 
diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
index d720b81c21..004a7c1a84 100644
--- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
+++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited, but if any are present, filter as needed.
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md
index f218c4ab5e..d37165e880 100644
--- a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md
+++ b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md
@@ -74,6 +74,11 @@ To successfully implement this search, you need to be ingesting logs with the st
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Command and Control](/stories/command_and_control)
+* [Data Exfiltration](/stories/data_exfiltration)
+
+
 #### Kill Chain Phase
 * Exfiltration
 
diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md
index 0bfed594a6..46ae09a583 100644
--- a/docs/_posts/2021-04-22-winword_spawning_cmd.md
+++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited, but if any are present, filter as needed.
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md
index 378a02bcb7..c4d8b8ac61 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_bitsadmin.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 No false positives known. Filter as needed.
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md
index be59d9ec62..3f73b7a5ec 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 No false positives known. Filter as needed.
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md
index 873b0559c4..846a587b19 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md
@@ -81,6 +81,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 No false positives known. Filter as needed.
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md
index d31f359c26..5cc73b7267 100644
--- a/docs/_posts/2021-04-26-trickbot_named_pipe.md
+++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md
@@ -72,6 +72,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Trickbot](/stories/trickbot)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-29-icacls_deny_command.md b/docs/_posts/2021-04-29-icacls_deny_command.md
index f92c477b81..1121bb17b2 100644
--- a/docs/_posts/2021-04-29-icacls_deny_command.md
+++ b/docs/_posts/2021-04-29-icacls_deny_command.md
@@ -71,6 +71,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Unknown. It is possible some administrative scripts use ICacls. Filter as needed.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
index 6228a76226..e337b3ed4d 100644
--- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
+++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
@@ -76,6 +76,10 @@ To successfully implement this search, you need to be ingesting logs with the dr
 #### Known False Positives
 Limited false positives will be present. Some applications do load drivers
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md
index 7d465dd399..4257b5fd09 100644
--- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md
+++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md
@@ -76,6 +76,10 @@ To successfully implement this search, you need to be ingesting logs with the dr
 #### Known False Positives
 False positives should be limited.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-04-deleting_of_net_users.md b/docs/_posts/2021-05-04-deleting_of_net_users.md
index 15c6e1e188..8b92872002 100644
--- a/docs/_posts/2021-05-04-deleting_of_net_users.md
+++ b/docs/_posts/2021-05-04-deleting_of_net_users.md
@@ -77,6 +77,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 System administrators or scripts may delete user accounts via this technique. Filter as needed.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-04-disabling_net_user_account.md b/docs/_posts/2021-05-04-disabling_net_user_account.md
index cfe00516cb..3e3d4f37f9 100644
--- a/docs/_posts/2021-05-04-disabling_net_user_account.md
+++ b/docs/_posts/2021-05-04-disabling_net_user_account.md
@@ -77,6 +77,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md
index 6ab8e32c4b..cdcb82b674 100644
--- a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md
+++ b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md
@@ -72,6 +72,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md
index 391dc6135f..4def015984 100644
--- a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md
+++ b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md
@@ -78,6 +78,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md
index 1120002bde..9240227142 100644
--- a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md
+++ b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md
@@ -76,6 +76,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Unknown. Filter as needed.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-04-icacls_grant_command.md b/docs/_posts/2021-05-04-icacls_grant_command.md
index 24e6cc3b06..62c96cb39f 100644
--- a/docs/_posts/2021-05-04-icacls_grant_command.md
+++ b/docs/_posts/2021-05-04-icacls_grant_command.md
@@ -71,6 +71,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Unknown. Filter as needed.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md b/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md
index 3f19c603e7..08485be8ce 100644
--- a/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md
+++ b/docs/_posts/2021-05-04-modify_acl_permission_to_files_or_folder.md
@@ -71,6 +71,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 administrators may use this command. Filter as needed.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md
index 2c2a2afd71..211503eced 100644
--- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md
+++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Unknown.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-05-suspicious_process_file_path.md b/docs/_posts/2021-05-05-suspicious_process_file_path.md
index c8cb5796e9..8691db51ea 100644
--- a/docs/_posts/2021-05-05-suspicious_process_file_path.md
+++ b/docs/_posts/2021-05-05-suspicious_process_file_path.md
@@ -73,6 +73,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators may allow execution of specific binaries in non-standard paths. Filter as needed.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+* [Remcos](/stories/remcos)
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md
index 5710545397..3f62040f18 100644
--- a/docs/_posts/2021-05-06-download_files_using_telegram.md
+++ b/docs/_posts/2021-05-06-download_files_using_telegram.md
@@ -70,6 +70,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 normal download of file in telegram app. (if it was a common app in network)
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md
index 5b09f57178..3fe5bf838f 100644
--- a/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md
+++ b/docs/_posts/2021-05-06-enumerate_users_local_group_using_telegram.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs with the Ta
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md
index fbf47a5ac1..9752b206bd 100644
--- a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md
+++ b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md
@@ -78,6 +78,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown. Filter as needed. Modify the time span as needed.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md
index f23306920e..2f7fd8871b 100644
--- a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md
+++ b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md
@@ -70,6 +70,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators may allow creation of script or exe in the paths specified. Filter as needed.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+* [Remcos](/stories/remcos)
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md
index d71383e033..01452a6d28 100644
--- a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md
+++ b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md
@@ -72,6 +72,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or administrative scripts may use this application. Filter as needed.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md
index f6f4ba32f4..eaa197c8da 100644
--- a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md
+++ b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators may use to debug Schedule Task entries. Filter as needed.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md
index 120dd18e99..39ab169950 100644
--- a/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md
+++ b/docs/_posts/2021-05-12-delete_shadowcopy_with_powershell.md
@@ -68,6 +68,12 @@ To successfully implement this search, you need to be ingesting logs with the po
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+* [Ransomware](/stories/ransomware)
+* [Revil Ransomware](/stories/revil_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
index 342887e653..1509e1564e 100644
--- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
+++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
@@ -75,6 +75,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Legitimate windows application that are not on the list loading this dll. Filter as needed.
 
+#### Associated Analytic story
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-13-slui_runas_elevated.md b/docs/_posts/2021-05-13-slui_runas_elevated.md
index c151552c3e..01c0553f43 100644
--- a/docs/_posts/2021-05-13-slui_runas_elevated.md
+++ b/docs/_posts/2021-05-13-slui_runas_elevated.md
@@ -78,6 +78,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives should be present as this is not commonly used by legitimate applications.
 
+#### Associated Analytic story
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-13-slui_spawning_a_process.md b/docs/_posts/2021-05-13-slui_spawning_a_process.md
index c16c88fc6e..8dfa9f720a 100644
--- a/docs/_posts/2021-05-13-slui_spawning_a_process.md
+++ b/docs/_posts/2021-05-13-slui_spawning_a_process.md
@@ -78,6 +78,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Certain applications may spawn from `slui.exe` that are legitimate. Filtering will be needed to ensure proper monitoring.
 
+#### Associated Analytic story
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-18-services_escalate_exe.md b/docs/_posts/2021-05-18-services_escalate_exe.md
index 031388332c..2aa133a5e1 100644
--- a/docs/_posts/2021-05-18-services_escalate_exe.md
+++ b/docs/_posts/2021-05-18-services_escalate_exe.md
@@ -73,6 +73,10 @@ To successfully implement this search, you will need to ensure that DNS data is
 #### Known False Positives
 False positives should be limited as `services.exe` should never spawn a process from `ADMIN$`. Filter as needed.
 
+#### Associated Analytic story
+* [Cobalt Strike](/stories/cobalt_strike)
+
+
 #### Kill Chain Phase
 * Exploitation
 * Privilege Escalation
diff --git a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md
index 3814f8801e..f0688b1330 100644
--- a/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md
+++ b/docs/_posts/2021-05-19-allow_inbound_traffic_in_firewall_rule.md
@@ -72,6 +72,10 @@ To successfully implement this search, you need to be ingesting logs with the po
 #### Known False Positives
 administrator may allow inbound traffic in certain network or machine.
 
+#### Associated Analytic story
+* [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md
index 48e19ebeff..3543f22567 100644
--- a/docs/_posts/2021-05-19-mailsniper_invoke_functions.md
+++ b/docs/_posts/2021-05-19-mailsniper_invoke_functions.md
@@ -72,6 +72,10 @@ To successfully implement this search, you need to be ingesting logs with the po
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Data Exfiltration](/stories/data_exfiltration)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
index 0e1a42f719..0f63afb952 100644
--- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
+++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
@@ -91,6 +91,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Unknown. It is possible filtering may be required to ensure fidelity.
 
+#### Associated Analytic story
+* [Cobalt Strike](/stories/cobalt_strike)
+
+
 #### Kill Chain Phase
 * Exploitation
 * Privilege Escalation
diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md
index 0af7335660..657ffff747 100644
--- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md
+++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md
@@ -75,6 +75,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Unknown. Add new processes or filter as needed. It is possible system management software may spawn processes from `wsmprovhost.exe`.
 
+#### Associated Analytic story
+* [Unusual Processes](/stories/unusual_processes)
+
+
 #### Kill Chain Phase
 * Exploitation
 * Privilege Escalation
diff --git a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md
index ee6712b0e1..db302febaa 100644
--- a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md
+++ b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md
@@ -77,6 +77,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md
index a44b78ad45..e3520f70ac 100644
--- a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md
+++ b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md
@@ -94,6 +94,11 @@ To successfully implement this search you need to be ingesting information on fi
 #### Known False Positives
 False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed.
 
+#### Associated Analytic story
+* [Discovery Techniques](/stories/discovery_techniques)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-05-27-detect_sharphound_usage.md b/docs/_posts/2021-05-27-detect_sharphound_usage.md
index 37366fb272..9d5babeb3a 100644
--- a/docs/_posts/2021-05-27-detect_sharphound_usage.md
+++ b/docs/_posts/2021-05-27-detect_sharphound_usage.md
@@ -100,6 +100,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited as this is specific to a file attribute not used by anything else. Filter as needed.
 
+#### Associated Analytic story
+* [Discovery Techniques](/stories/discovery_techniques)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
index d16c9052ee..f8a9e9d194 100644
--- a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
+++ b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
@@ -100,6 +100,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Unknown.
 
+#### Associated Analytic story
+* [Discovery Techniques](/stories/discovery_techniques)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md
index 47ad9e085a..f416331e92 100644
--- a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md
+++ b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md
@@ -94,6 +94,10 @@ To successfully implement this search you need to be ingesting information on fi
 #### Known False Positives
 False positives should be limited as the analytic is specific to a filename with extension .zip. Filter as needed.
 
+#### Associated Analytic story
+* [Discovery Techniques](/stories/discovery_techniques)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
index 84c5558fbd..87b295e673 100644
--- a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
+++ b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
@@ -96,6 +96,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited as the arguments used are specific to SharpHound. Filter as needed or add more command-line arguments as needed.
 
+#### Associated Analytic story
+* [Discovery Techniques](/stories/discovery_techniques)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-06-02-conti_common_exec_parameter.md b/docs/_posts/2021-06-02-conti_common_exec_parameter.md
index 0683acef7c..50acc69bf8 100644
--- a/docs/_posts/2021-06-02-conti_common_exec_parameter.md
+++ b/docs/_posts/2021-06-02-conti_common_exec_parameter.md
@@ -76,6 +76,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 3rd party tool may have commandline parameter that can trigger this detection.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md
index c5edd79a47..b02c194e8a 100644
--- a/docs/_posts/2021-06-02-modification_of_wallpaper.md
+++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md
@@ -72,6 +72,12 @@ To successfully implement this search, you need to be ingesting logs with the Im
 #### Known False Positives
 3rd party tool may used to changed the wallpaper of the machine
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+* [Revil Ransomware](/stories/revil_ransomware)
+* [BlackMatter Ransomware](/stories/blackmatter_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-02-revil_common_exec_parameter.md b/docs/_posts/2021-06-02-revil_common_exec_parameter.md
index 25d2f075b5..ae9c1e4b26 100644
--- a/docs/_posts/2021-06-02-revil_common_exec_parameter.md
+++ b/docs/_posts/2021-06-02-revil_common_exec_parameter.md
@@ -73,6 +73,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 third party tool may have same command line parameters as revil ransomware.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+* [Revil Ransomware](/stories/revil_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
index 657442c7b1..3509ede78c 100644
--- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
+++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
@@ -77,6 +77,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 legitimate process that are not in the exception list may trigger this event.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+* [Revil Ransomware](/stories/revil_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md b/docs/_posts/2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md
index 262c831734..9077068608 100644
--- a/docs/_posts/2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md
+++ b/docs/_posts/2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md
@@ -69,6 +69,10 @@ To successfully implement this search, you need to be ingesting logs with the fu
 #### Known False Positives
 Many benign applications will create processes from executables in Windows\Temp, although unlikely to exceed the given threshold.  Filter as needed.
 
+#### Associated Analytic story
+* [Meterpreter](/stories/meterpreter)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md
index 2cf00401e7..3caa32ea9b 100644
--- a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md
+++ b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md
@@ -68,6 +68,11 @@ To successfully implement this search, you need to be ingesting logs with the 70
 #### Known False Positives
 Admin activities or installing related updates may do a sudden stop to list of services we monitor.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+* [BlackMatter Ransomware](/stories/blackmatter_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md
index 428fd6cbe2..f351346665 100644
--- a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md
+++ b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md
@@ -74,6 +74,10 @@ To successfully implement this search you need to be ingesting events related to
 #### Known False Positives
 Administrators, administrative actions or certain applications may run many instances of taskhost and taskhostex concurrently.  Filter as needed.
 
+#### Associated Analytic story
+* [Meterpreter](/stories/meterpreter)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md
index 04797c98f2..568d814110 100644
--- a/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md
+++ b/docs/_posts/2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md
@@ -80,6 +80,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Limited false positives. Filter as needed.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md
index 1f05be61d4..46337ba380 100644
--- a/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md
+++ b/docs/_posts/2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md
@@ -79,6 +79,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 False positives should be limited. Filter as needed.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
 #### Kill Chain Phase
 * Exploitation
 * Privilege Escalation
diff --git a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md
index 5fafc0211a..3d7a47d2a4 100644
--- a/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md
+++ b/docs/_posts/2021-06-09-detect_empire_with_powershell_script_block_logging.md
@@ -74,6 +74,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 False positives may only pertain to it not being related to Empire, but another framework. Filter as needed if any applications use the same pattern.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md
index 168d8c2853..5489a15211 100644
--- a/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md
+++ b/docs/_posts/2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md
@@ -70,6 +70,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 False positives should be limited as the commands being identifies are quite specific to EventCode 4104 and Mimikatz. Filter as needed.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md
index 00fa349249..7ef9b9e832 100644
--- a/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md
+++ b/docs/_posts/2021-06-09-unloading_amsi_via_reflection.md
@@ -70,6 +70,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Potential for some third party applications to disable AMSI upon invocation. Filter as needed.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md
index 8b6b343038..5e47c3b203 100644
--- a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md
+++ b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md
@@ -80,6 +80,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 administrator may execute this app to manage disk
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md
index 7315fd5660..46d74a004c 100644
--- a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md
+++ b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md
@@ -77,6 +77,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 network operator may disable audit event logs for debugging purposes.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md
index 24588a5bff..4eabb47cd2 100644
--- a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md
+++ b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 takeown.exe is a normal windows application that may used by network operator.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md
index e1a0455655..cd31a84c93 100644
--- a/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md
+++ b/docs/_posts/2021-06-10-powershell_creating_thread_mutex.md
@@ -71,6 +71,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 powershell developer may used this function in their script for instance checking too.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-10-powershell_domain_enumeration.md b/docs/_posts/2021-06-10-powershell_domain_enumeration.md
index f52224f48d..334d3e75cf 100644
--- a/docs/_posts/2021-06-10-powershell_domain_enumeration.md
+++ b/docs/_posts/2021-06-10-powershell_domain_enumeration.md
@@ -72,6 +72,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 It is possible there will be false positives, filter as needed.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md
index 3f6f5036f6..7eb39b4055 100644
--- a/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md
+++ b/docs/_posts/2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md
@@ -74,6 +74,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 False positives should be limited as day to day scripts do not use this method.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md
index 31ed3737ec..e96b448091 100644
--- a/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md
+++ b/docs/_posts/2021-06-10-powershell_processing_stream_of_data.md
@@ -72,6 +72,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 powershell may used this function to process compressed data.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md b/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md
index 8efd18241c..5eb7f0dd2c 100644
--- a/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md
+++ b/docs/_posts/2021-06-10-powershell_using_memory_as_backing_store.md
@@ -67,6 +67,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 powershell may used this function to store out object into memory.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
index 951a24c8cc..94f83aaf72 100644
--- a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
+++ b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators may modify the boot configuration ignore failure during testing and debugging.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md b/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md
index f63ec51be1..0b5a793fd5 100644
--- a/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md
+++ b/docs/_posts/2021-06-10-recon_avproduct_through_pwh_or_wmi.md
@@ -67,6 +67,11 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 network administrator may used this command for checking purposes
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-06-10-recon_using_wmi_class.md b/docs/_posts/2021-06-10-recon_using_wmi_class.md
index d0db06d31a..21b7da7740 100644
--- a/docs/_posts/2021-06-10-recon_using_wmi_class.md
+++ b/docs/_posts/2021-06-10-recon_using_wmi_class.md
@@ -67,6 +67,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 network administrator may used this command for checking purposes
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md
index b811f1695f..4d52e52040 100644
--- a/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md
+++ b/docs/_posts/2021-06-14-wmi_recon_running_process_or_services.md
@@ -67,6 +67,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 network administrator may used this command for checking purposes
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-06-15-wevtutil_usage_to_clear_logs.md b/docs/_posts/2021-06-15-wevtutil_usage_to_clear_logs.md
index 4c870e28fc..d9d9b7054f 100644
--- a/docs/_posts/2021-06-15-wevtutil_usage_to_clear_logs.md
+++ b/docs/_posts/2021-06-15-wevtutil_usage_to_clear_logs.md
@@ -73,6 +73,12 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs.
 
+#### Associated Analytic story
+* [Windows Log Manipulation](/stories/windows_log_manipulation)
+* [Ransomware](/stories/ransomware)
+* [Clop Ransomware](/stories/clop_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-15-wevtutil_usage_to_disable_logs.md b/docs/_posts/2021-06-15-wevtutil_usage_to_disable_logs.md
index 14729bea6d..79213df4b7 100644
--- a/docs/_posts/2021-06-15-wevtutil_usage_to_disable_logs.md
+++ b/docs/_posts/2021-06-15-wevtutil_usage_to_disable_logs.md
@@ -73,6 +73,11 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 network operator may disable audit event logs for debugging purposes.
 
+#### Associated Analytic story
+* [Windows Log Manipulation](/stories/windows_log_manipulation)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
index 8ca3d83352..5d825321fb 100644
--- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
+++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
@@ -77,6 +77,10 @@ To successfully implement this search, you need to be ingesting logs with that p
 #### Known False Positives
 It is possible some applications will create a consumer and may be required to be filtered. For tuning, add any additional LOLBin&#39;s for further depth of coverage.
 
+#### Associated Analytic story
+* [Suspicious WMI Use](/stories/suspicious_wmi_use)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md
index 1da6ef9075..a13cfc3a1b 100644
--- a/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md
+++ b/docs/_posts/2021-06-17-suspicious_event_log_service_behavior.md
@@ -69,6 +69,12 @@ To successfully implement this search, you need to be ingesting Windows event lo
 #### Known False Positives
 It is possible the Event Logging service gets shut down due to system errors or legitimately administration tasks. Filter as needed.
 
+#### Associated Analytic story
+* [Windows Log Manipulation](/stories/windows_log_manipulation)
+* [Ransomware](/stories/ransomware)
+* [Clop Ransomware](/stories/clop_ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md
index ec79c76bbb..8fc395861a 100644
--- a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md
+++ b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md
@@ -76,6 +76,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md
index 6f53fd32e8..569ddd6cbc 100644
--- a/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md
+++ b/docs/_posts/2021-06-22-powershell_enable_smb1protocol_feature.md
@@ -72,6 +72,11 @@ To successfully implement this search, you need to be ingesting logs with the po
 #### Known False Positives
 network operator may enable or disable this windows feature.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
index 85c38d4790..b1f725b807 100644
--- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
+++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 network operator may use this batch command to delete recursively a directory or files within directory
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
index 1ccca1addf..6b8b382676 100644
--- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
+++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 network admin may modify this firewall feature that may cause this rule to be triggered.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
index 1aa2ee453b..fac070cd18 100644
--- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
+++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
@@ -81,6 +81,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 network admin may modify this firewall feature that may cause this rule to be triggered.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+* [Revil Ransomware](/stories/revil_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
index 5243b58a6b..77d8807714 100644
--- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
+++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
@@ -76,6 +76,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 excessive execution of sc.exe is quite suspicious since it can modify or execute app in high privilege permission.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md
index 07edfc4636..11b2d9b243 100644
--- a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md
+++ b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md
@@ -77,6 +77,10 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 Legitimate programs and administrators will execute sc.exe with the start disabled flag.  It is possible, but unlikely from the telemetry of normal Windows operation we observed, that sc.exe will be called more than seven times in a short period of time.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md
index bebbe4a6af..b2e1101642 100644
--- a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md
+++ b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md
@@ -78,6 +78,10 @@ You will need to ensure PrintService Admin and Operational logs are being logged
 #### Known False Positives
 Unknown. This may require filtering.
 
+#### Associated Analytic story
+* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md
index 1334ca4be6..53ccf0ee6d 100644
--- a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md
+++ b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md
@@ -79,6 +79,10 @@ You will need to ensure PrintService Admin and Operational logs are being logged
 #### Known False Positives
 False positives are unknown and filtering may be required.
 
+#### Associated Analytic story
+* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
index 08354695b7..bf4ab7015b 100644
--- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
+++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
@@ -84,6 +84,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives have been identified. There are limited instances where `rundll32.exe` may be spawned by a legitimate print driver.
 
+#### Associated Analytic story
+* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
index 5914e02709..430cec0a0c 100644
--- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
+++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
@@ -76,6 +76,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
index 7808716c14..1cd3fe8f83 100644
--- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
+++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
@@ -70,6 +70,10 @@ To successfully implement this search, you need to be ingesting logs with proces
 #### Known False Positives
 Unknown. Filter as needed.
 
+#### Associated Analytic story
+* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md
index 30c844dc7e..fb89aafcde 100644
--- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md
+++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll.md
@@ -83,6 +83,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Unknown.
 
+#### Associated Analytic story
+* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
index 87f2a30115..8170d12dbf 100644
--- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
+++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
@@ -77,6 +77,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Limited false positives. Filter as needed.
 
+#### Associated Analytic story
+* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md
index b2c91bef2c..11ed468fdc 100644
--- a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md
+++ b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md
@@ -78,6 +78,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 quite minimal false positive expected.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+* [Revil Ransomware](/stories/revil_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md
index d9f6dac472..46a1b16609 100644
--- a/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md
+++ b/docs/_posts/2021-07-05-powershell_disable_security_monitoring.md
@@ -81,6 +81,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives. However, tune based on scripts that may perform this action.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+* [Revil Ransomware](/stories/revil_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-12-net_profiler_uac_bypass.md b/docs/_posts/2021-07-12-net_profiler_uac_bypass.md
index 1ea73760f4..5152615424 100644
--- a/docs/_posts/2021-07-12-net_profiler_uac_bypass.md
+++ b/docs/_posts/2021-07-12-net_profiler_uac_bypass.md
@@ -75,6 +75,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 limited false positive. It may trigger by some windows update that will modify this registry.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
index 259f510409..b7757ae4cd 100644
--- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
+++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
@@ -78,6 +78,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown. all of the dll loaded by mmc.exe is microsoft signed dll.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
index fc69d53d14..7d1b88b003 100644
--- a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
+++ b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
@@ -90,6 +90,10 @@ You must be ingesting the appropriate cloud-infrastructure logs Run the &#34;Pre
 #### Known False Positives
 It&#39;s possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior.
 
+#### Associated Analytic story
+* [Cloud Cryptomining](/stories/cloud_cryptomining)
+
+
 #### Kill Chain Phase
 
 
diff --git a/docs/_posts/2021-07-19-aws_createaccesskey.md b/docs/_posts/2021-07-19-aws_createaccesskey.md
index 56322df085..862fbaf211 100644
--- a/docs/_posts/2021-07-19-aws_createaccesskey.md
+++ b/docs/_posts/2021-07-19-aws_createaccesskey.md
@@ -73,6 +73,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
 
+#### Associated Analytic story
+* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-07-19-aws_createloginprofile.md b/docs/_posts/2021-07-19-aws_createloginprofile.md
index ffaffec65e..d48f8143ce 100644
--- a/docs/_posts/2021-07-19-aws_createloginprofile.md
+++ b/docs/_posts/2021-07-19-aws_createloginprofile.md
@@ -77,6 +77,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 While this search has no known false positives, it is possible that an AWS admin has legitimately created a login profile for another user.
 
+#### Associated Analytic story
+* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-07-19-aws_updateloginprofile.md b/docs/_posts/2021-07-19-aws_updateloginprofile.md
index b6fe10a320..b5ccdd8908 100644
--- a/docs/_posts/2021-07-19-aws_updateloginprofile.md
+++ b/docs/_posts/2021-07-19-aws_updateloginprofile.md
@@ -73,6 +73,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 While this search has no known false positives, it is possible that an AWS admin has legitimately created keys for another user.
 
+#### Associated Analytic story
+* [AWS IAM Privilege Escalation](/stories/aws_iam_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md
index 259f638664..b2f235ea1b 100644
--- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md
+++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets.md
@@ -81,6 +81,10 @@ You must install the AWS App for Splunk.
 #### Known False Positives
 While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the &#34;All Users&#34; group.
 
+#### Associated Analytic story
+* [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
index d73f7413b9..d9caebbd8a 100644
--- a/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
+++ b/docs/_posts/2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
@@ -77,6 +77,10 @@ Note that `detect_new_open_s3_buckets_over_aws_cli_filter` is a empty macro by d
 #### Known False Positives
 While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the &#34;All Users&#34; group.
 
+#### Associated Analytic story
+* [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
index c344f38f11..71f939d4e3 100644
--- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
+++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
@@ -82,6 +82,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 limitted. this anomaly behavior is not commonly seen in clean host.
 
+#### Associated Analytic story
+* [Trickbot](/stories/trickbot)
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
index 180aab45a3..aba4219e77 100644
--- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
+++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 IT or network admin may create an document automation that will run shell script.
 
+#### Associated Analytic story
+* [Trickbot](/stories/trickbot)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md b/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md
index 3e8dbd5742..7613b11d71 100644
--- a/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md
+++ b/docs/_posts/2021-07-20-detect_shared_ec2_snapshot.md
@@ -72,6 +72,11 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 It is possible that an AWS admin has legitimately shared a snapshot with others for  a specific purpose.
 
+#### Associated Analytic story
+* [Suspicious Cloud Instance Activities](/stories/suspicious_cloud_instance_activities)
+* [Data Exfiltration](/stories/data_exfiltration)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md
index 81f21b1c7f..51fdd631af 100644
--- a/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md
+++ b/docs/_posts/2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md
@@ -75,6 +75,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-23-sam_database_file_access_attempt.md b/docs/_posts/2021-07-23-sam_database_file_access_attempt.md
index 36f2ed028f..a4ad539c81 100644
--- a/docs/_posts/2021-07-23-sam_database_file_access_attempt.md
+++ b/docs/_posts/2021-07-23-sam_database_file_access_attempt.md
@@ -70,6 +70,10 @@ To successfully implement this search, you must ingest Windows Security Event lo
 #### Known False Positives
 Natively, `dllhost.exe` will access the files. Every environment will have additional native processes that do as well. Filter by process_name. As an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
index 9ad410defd..1ac00fea96 100644
--- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
+++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
@@ -72,6 +72,10 @@ To successfully implement this search, you need to be ingesting logs with the So
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-26-rundll32_dnsquery.md b/docs/_posts/2021-07-26-rundll32_dnsquery.md
index a1a5ab22d8..bfee752058 100644
--- a/docs/_posts/2021-07-26-rundll32_dnsquery.md
+++ b/docs/_posts/2021-07-26-rundll32_dnsquery.md
@@ -74,6 +74,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
index 69c4061d81..e07ef82bcb 100644
--- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
+++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
index 967e0c52d9..d700ef8ebf 100644
--- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
+++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 limitted. this parameter is not commonly used by windows application but can be used by the network operator.
 
+#### Associated Analytic story
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
index ba8b0c96f5..0100e04011 100644
--- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
+++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 third party application may used this dll export name to execute function.
 
+#### Associated Analytic story
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-27-chcp_command_execution.md b/docs/_posts/2021-07-27-chcp_command_execution.md
index 28ba6c02a2..63e0565539 100644
--- a/docs/_posts/2021-07-27-chcp_command_execution.md
+++ b/docs/_posts/2021-07-27-chcp_command_execution.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 other tools or script may used this to change code page to UTF-* or others
 
+#### Associated Analytic story
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
index bbf9bfda37..2833a0dcdc 100644
--- a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
+++ b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
@@ -83,6 +83,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 minimal. but network operator can use this application to load dll.
 
+#### Associated Analytic story
+* [IcedID](/stories/icedid)
+* [Suspicious Regsvr32 Activity](/stories/suspicious_regsvr32_activity)
+* [Remcos](/stories/remcos)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
index 91b78c8837..5d1269a72b 100644
--- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
+++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
@@ -72,6 +72,10 @@ To successfully implement this search, you need to be ingesting logs with the So
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md
index e2c72ed890..d0cafd705b 100644
--- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md
+++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md
@@ -68,6 +68,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
index 1dc538318e..4ff251d2f7 100644
--- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
+++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
index a8e3fb49dd..659d516f84 100644
--- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
+++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
index f1c40ebc70..6bec47116e 100644
--- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
+++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
@@ -69,6 +69,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
index 636d0f7c3c..b31658f923 100644
--- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
+++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
@@ -72,6 +72,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md
index 444d41b8e4..522faeeb2d 100644
--- a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md
+++ b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md
@@ -77,6 +77,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-08-10-powershell_execute_com_object.md b/docs/_posts/2021-08-10-powershell_execute_com_object.md
index b01790f811..23d378ab9e 100644
--- a/docs/_posts/2021-08-10-powershell_execute_com_object.md
+++ b/docs/_posts/2021-08-10-powershell_execute_com_object.md
@@ -70,6 +70,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 network operrator may use this command.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-08-11-fsutil_zeroing_file.md b/docs/_posts/2021-08-11-fsutil_zeroing_file.md
index 25e088dcb9..a17491c0a5 100644
--- a/docs/_posts/2021-08-11-fsutil_zeroing_file.md
+++ b/docs/_posts/2021-08-11-fsutil_zeroing_file.md
@@ -71,6 +71,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
index 37ba7c5c32..2bfa6c6f8b 100644
--- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
+++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
@@ -75,6 +75,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 not so common. but 3rd part app may load this dll.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
index 965ede12d5..5a44e5978c 100644
--- a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
+++ b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
@@ -81,6 +81,10 @@ To successfully implement this search, you need to be ingesting logs related to
 #### Known False Positives
 network admin or normal user may share files to customer and external team.
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Exfiltration
 
diff --git a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md
index 50283f879e..afee5a519f 100644
--- a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md
+++ b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md
@@ -78,6 +78,10 @@ To successfully implement this search, you need to be ingesting logs related to
 #### Known False Positives
 network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md
index 1d56e4456c..dcd885c546 100644
--- a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md
+++ b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md
@@ -77,6 +77,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md
index 6684677548..334c6b56ee 100644
--- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md
+++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_high.md
@@ -84,6 +84,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
index e32655fa3f..b2c980d11f 100644
--- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
+++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
@@ -84,6 +84,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md
index 7b2876790d..47d4bd1059 100644
--- a/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md
+++ b/docs/_posts/2021-08-17-aws_ecr_container_scanning_findings_medium.md
@@ -84,6 +84,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
index fda3d80db5..dc16a20838 100644
--- a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
+++ b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
@@ -75,6 +75,10 @@ To successfully implement this search, you need to be ingesting logs related to
 #### Known False Positives
 network admin and normal user may send this file attachment as part of their day to day work. having a good protocol in attaching this file type to an e-mail may reduce the risk of having a spear phishing attack.
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-08-18-esentutl_sam_copy.md b/docs/_posts/2021-08-18-esentutl_sam_copy.md
index e0068c1937..3cfadcc403 100644
--- a/docs/_posts/2021-08-18-esentutl_sam_copy.md
+++ b/docs/_posts/2021-08-18-esentutl_sam_copy.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited. Filter as needed.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 * Lateral Movement
diff --git a/docs/_posts/2021-08-18-powershell_4104_hunting.md b/docs/_posts/2021-08-18-powershell_4104_hunting.md
index a99c0b71d7..d9a5c16157 100644
--- a/docs/_posts/2021-08-18-powershell_4104_hunting.md
+++ b/docs/_posts/2021-08-18-powershell_4104_hunting.md
@@ -241,6 +241,10 @@ The following Hunting analytic requires PowerShell operational logs to be import
 #### Known False Positives
 Limited false positives. May filter as needed.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md
index 0e3873a57f..8c3389366b 100644
--- a/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md
+++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_outside_business_hours.md
@@ -80,6 +80,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 When your development is spreaded in different time zones, applying this rule can be difficult.
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
index 735b973a36..56f58d649c 100644
--- a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
+++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
@@ -81,6 +81,10 @@ You must install splunk AWS add on and Splunk App for AWS. This search works wit
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
index 902f03ec69..32a1341f7f 100644
--- a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
+++ b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs related to
 #### Known False Positives
 normal user or normal transaction may contain the subject and file type attachment that this detection try to search.
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md
index 029966014e..ca22152540 100644
--- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md
+++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md
@@ -64,6 +64,10 @@ This search requires you to be ingesting your network traffic, and populating th
 #### Known False Positives
 Some networks may use kerberized FTP or telnet servers, however, this is rare.
 
+#### Associated Analytic story
+* [Use of Cleartext Protocols](/stories/use_of_cleartext_protocols)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 * Actions on Objectives
diff --git a/docs/_posts/2021-08-20-github_commit_changes_in_master.md b/docs/_posts/2021-08-20-github_commit_changes_in_master.md
index 63f2b840f0..8274787cf1 100644
--- a/docs/_posts/2021-08-20-github_commit_changes_in_master.md
+++ b/docs/_posts/2021-08-20-github_commit_changes_in_master.md
@@ -67,6 +67,10 @@ To successfully implement this search, you need to be ingesting logs related to
 #### Known False Positives
 admin can do changes directly to master branch
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md
index 1bc642a305..e7338ae6a5 100644
--- a/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md
+++ b/docs/_posts/2021-08-20-kubernetes_nginx_ingress_lfi.md
@@ -76,6 +76,10 @@ You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md
index 5e7208c6f5..6caea2987f 100644
--- a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md
+++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md
@@ -69,6 +69,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this PowerShell commandlet for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md
index b4bc9d298f..24ce365ed1 100644
--- a/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell_script_block.md
@@ -66,6 +66,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators or power users may use this PowerShell commandlet for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md
index 94bf6b1d7b..5fa7a10b5b 100644
--- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md
+++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md
@@ -69,6 +69,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this PowerShell commandlet for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md
index 6c7f0a97b3..3a824e441e 100644
--- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell_script_block.md
@@ -66,6 +66,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators or power users may use this PowerShell commandlet for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
index 18dc00015c..d47522863c 100644
--- a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
+++ b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs related to
 #### Known False Positives
 normal email contains this link that are known application within the organization or network can be catched by this detection.
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
index 2b8567faf5..b9967305d7 100644
--- a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
+++ b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
@@ -81,6 +81,10 @@ To successfully implement this search, you need to be ingesting logs related to
 #### Known False Positives
 normal user or normal transaction may contain the subject and file type attachment that this detection try to search
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md
index aea2511e79..cb2534cf91 100644
--- a/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md
+++ b/docs/_posts/2021-08-23-kubernetes_nginx_ingress_rfi.md
@@ -71,6 +71,10 @@ You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md
index 74618e251d..0220668c50 100644
--- a/docs/_posts/2021-08-24-adsisearcher_account_discovery.md
+++ b/docs/_posts/2021-08-24-adsisearcher_account_discovery.md
@@ -71,6 +71,10 @@ The following Hunting analytic requires PowerShell operational logs to be import
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md
index b9cf1ffca6..1ced833dc0 100644
--- a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md
+++ b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md
@@ -77,6 +77,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md
index 8b6f328536..ce1b122f58 100644
--- a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md
+++ b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md
@@ -78,6 +78,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md
index eaae81fccb..e74b409fa5 100644
--- a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md
+++ b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md
@@ -77,6 +77,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
index dfb6588b6d..dbe69057fa 100644
--- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
+++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
@@ -76,6 +76,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md
index 51d8197492..91e4bf8798 100644
--- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell_script_block.md
@@ -71,6 +71,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 It is possible certain system management frameworks utilize this command to gather trust information.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell.md b/docs/_posts/2021-08-24-get_aduser_with_powershell.md
index e9667b952b..002fb470d8 100644
--- a/docs/_posts/2021-08-24-get_aduser_with_powershell.md
+++ b/docs/_posts/2021-08-24-get_aduser_with_powershell.md
@@ -77,6 +77,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md
index cc443bae35..2f23d66fc2 100644
--- a/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-24-get_aduser_with_powershell_script_block.md
@@ -71,6 +71,10 @@ The following Hunting analytic requires PowerShell operational logs to be import
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md
index b2f3bce39c..a77d223086 100644
--- a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md
+++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md
@@ -77,6 +77,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md
index d262a49a68..46ab159e26 100644
--- a/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell_script_block.md
@@ -71,6 +71,10 @@ The following Hunting analytic requires PowerShell operational logs to be import
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md
index 0f69ab4fb5..e4493b0f9b 100644
--- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md
+++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md
@@ -77,6 +77,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md
index 0a8857b16d..aae67add03 100644
--- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md
@@ -71,6 +71,10 @@ he following Hunting analytic requires PowerShell operational logs to be importe
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md
index 8d18bf8005..8aa14886e6 100644
--- a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md
+++ b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md
@@ -75,6 +75,10 @@ You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md
index 0785a82acb..9662fc873f 100644
--- a/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md
+++ b/docs/_posts/2021-08-25-domain_group_discovery_with_adsisearcher.md
@@ -70,6 +70,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators or power users may use Adsisearcher for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md
index c5dba6147b..2206509b90 100644
--- a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md
+++ b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md
@@ -79,6 +79,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md
index e6e1ad376d..c04b837758 100644
--- a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md
+++ b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md
@@ -79,6 +79,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md
index 012b231702..e1f29da27c 100644
--- a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md
+++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md
@@ -79,6 +79,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md
index ca7967f2fb..224c7c81cf 100644
--- a/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md
+++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_powerview.md
@@ -70,6 +70,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators or power users may use this PowerView for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md
index fd67f02db7..b3600fc1a2 100644
--- a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md
+++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md
@@ -79,6 +79,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell.md b/docs/_posts/2021-08-25-getadgroup_with_powershell.md
index 4237a159a7..3f20aaac21 100644
--- a/docs/_posts/2021-08-25-getadgroup_with_powershell.md
+++ b/docs/_posts/2021-08-25-getadgroup_with_powershell.md
@@ -79,6 +79,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md b/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md
index 611e2a7bbc..52c911191b 100644
--- a/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-25-getadgroup_with_powershell_script_block.md
@@ -70,6 +70,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators or power users may use this PowerShell commandlet for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md
index 694c34a8f9..5ad581318f 100644
--- a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md
+++ b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md
@@ -79,6 +79,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md
index 4a7b953ba7..ed741820e3 100644
--- a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md
+++ b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md
@@ -75,6 +75,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md
index bfd534892e..303544f962 100644
--- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md
+++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md
@@ -79,6 +79,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md
index fca1a5aef3..bff9af74a4 100644
--- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md
@@ -70,6 +70,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators or power users may use this PowerShell commandlet for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
index 5777570de9..c561c75827 100644
--- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
+++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md
index 7e55a15d7a..4896efdf6e 100644
--- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md
@@ -67,6 +67,10 @@ The following Hunting analytic requires PowerShell operational logs to be import
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
index 80d454e193..75a973821b 100644
--- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
+++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md
index 5cd7284eec..ddd7c2ab64 100644
--- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md
@@ -67,6 +67,10 @@ The following Hunting analytic requires PowerShell operational logs to be import
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md
index e849fd925c..14ebee4b0c 100644
--- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md
+++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md
index e229aa305e..d0232abe6a 100644
--- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell_script_block.md
@@ -67,6 +67,10 @@ The following Hunting analytic requires PowerShell operational logs to be import
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md
index 940a68b8c3..c2e3a8ba80 100644
--- a/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md
+++ b/docs/_posts/2021-08-26-getdomaingroup_with_powershell_script_block.md
@@ -70,6 +70,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators or power users may use this PowerView functions for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md
index 6fed53e6cc..e68f7fecf5 100644
--- a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md
+++ b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md
index a58a8c79aa..a101c585c9 100644
--- a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md
+++ b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md
@@ -83,6 +83,10 @@ You must be ingesting data that records filesystem and process activity from you
 #### Known False Positives
 This detection should yield little or no false positive results. It is uncommon for LNK files to be executed from temporary or user directories.
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+
+
 #### Kill Chain Phase
 * Installation
 * Actions on Objectives
diff --git a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md
index 8baca3b682..4e8434ac4c 100644
--- a/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md
+++ b/docs/_posts/2021-08-27-exchange_powershell_abuse_via_ssrf.md
@@ -74,6 +74,10 @@ The following analytic requires on-premise Exchange to be logging to Splunk usin
 #### Known False Positives
 Limited false positives, however, tune as needed.
 
+#### Associated Analytic story
+* [ProxyShell](/stories/proxyshell)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md
index c497b7c1e8..4b93056cbc 100644
--- a/docs/_posts/2021-08-27-exchange_powershell_module_usage.md
+++ b/docs/_posts/2021-08-27-exchange_powershell_module_usage.md
@@ -78,6 +78,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators or power users may use this PowerShell commandlet for troubleshooting.
 
+#### Associated Analytic story
+* [ProxyShell](/stories/proxyshell)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 * Exploitation
diff --git a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md
index 16b61bac18..f9387c85ff 100644
--- a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md
+++ b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md
@@ -75,6 +75,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md
index 1395787618..df1017057f 100644
--- a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md
+++ b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md
@@ -75,6 +75,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md
index 8cdde95137..53f8824225 100644
--- a/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md
+++ b/docs/_posts/2021-08-31-petitpotam_network_share_access_request.md
@@ -73,6 +73,10 @@ Windows Event Code 5145 is required to utilize this analytic and it may not be e
 #### Known False Positives
 False positives have been limited when the Anonymous Logon is used for Account Name.
 
+#### Associated Analytic story
+* [PetitPotam NTLM Relay on Active Directory Certificate Services](/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services)
+
+
 #### Kill Chain Phase
 * Exploitation
 * Lateral Movement
diff --git a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md
index ee76206438..b937fe2768 100644
--- a/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md
+++ b/docs/_posts/2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md
@@ -69,6 +69,10 @@ The following analytic requires Event Code 4768. Ensure that it is logging no Do
 #### Known False Positives
 False positives are possible if the environment is using certificates for authentication.
 
+#### Associated Analytic story
+* [PetitPotam NTLM Relay on Active Directory Certificate Services](/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services)
+
+
 #### Kill Chain Phase
 * Exploitation
 * Lateral Movement
diff --git a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md
index df985efbf5..92cfbe683b 100644
--- a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md
+++ b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md
@@ -75,6 +75,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md
index ba9838d7fc..7f7ef5a6dd 100644
--- a/docs/_posts/2021-09-01-circle_ci_disable_security_step.md
+++ b/docs/_posts/2021-09-01-circle_ci_disable_security_step.md
@@ -80,6 +80,10 @@ You must index CircleCI logs.
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md
index 99b58384f4..259e79412f 100644
--- a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md
+++ b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md
@@ -75,6 +75,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md
index d86fbfac5e..bfd16b610e 100644
--- a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md
+++ b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md
@@ -79,6 +79,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md
index 14dde03e86..6bc415ea6a 100644
--- a/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-01-getadcomputer_with_powershell_script_block.md
@@ -66,6 +66,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators or power users may use this PowerShell commandlet for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md
index 3e73009293..8edd5f6626 100644
--- a/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md
@@ -66,6 +66,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators or power users may use this PowerShell commandlet for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-01-github_commit_in_develop.md b/docs/_posts/2021-09-01-github_commit_in_develop.md
index dbd5065cb1..03e23b4378 100644
--- a/docs/_posts/2021-09-01-github_commit_in_develop.md
+++ b/docs/_posts/2021-09-01-github_commit_in_develop.md
@@ -65,6 +65,10 @@ To successfully implement this search, you need to be ingesting logs related to
 #### Known False Positives
 admin can do changes directly to develop branch
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-01-github_dependabot_alert.md b/docs/_posts/2021-09-01-github_dependabot_alert.md
index d2765df053..ff70459260 100644
--- a/docs/_posts/2021-09-01-github_dependabot_alert.md
+++ b/docs/_posts/2021-09-01-github_dependabot_alert.md
@@ -81,6 +81,10 @@ You must index GitHub logs. You can follow the url in reference to onboard GitHu
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
index bcae71cacc..bda5a57f46 100644
--- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
+++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
@@ -83,6 +83,10 @@ You must index GitHub logs. You can follow the url in reference to onboard GitHu
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md
index f1c9e16b86..1e1b6078f7 100644
--- a/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md
+++ b/docs/_posts/2021-09-01-remote_system_discovery_with_adsisearcher.md
@@ -66,6 +66,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators or power users may use Adsisearcher for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md
index fef4dd3245..85f2ed6cf3 100644
--- a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md
+++ b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md
@@ -75,6 +75,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md
index ce6e488c3c..3cd5f359d5 100644
--- a/docs/_posts/2021-09-02-circle_ci_disable_security_job.md
+++ b/docs/_posts/2021-09-02-circle_ci_disable_security_job.md
@@ -76,6 +76,10 @@ You must index CircleCI logs.
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
index b5366d7d2c..6135d3ff85 100644
--- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
+++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
@@ -76,6 +76,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives as this requires an active Administrator or adversary to bring in, import, and execute.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md
index c01c31626c..8798939929 100644
--- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell_script_block.md
@@ -71,6 +71,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 UPDATE_KNOWN_FALSE_POSITIVES
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md
index a00a058550..a9165718c1 100644
--- a/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-02-getdomaincomputer_with_powershell_script_block.md
@@ -66,6 +66,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators or power users may use PowerView for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md
index edc01b6d48..0d005a322b 100644
--- a/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-02-getdomaincontroller_with_powershell_script_block.md
@@ -66,6 +66,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators or power users may use this PowerShell commandlet for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
index c2bf35d29b..ee252b0c51 100644
--- a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
+++ b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
@@ -71,6 +71,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [BlackMatter Ransomware](/stories/blackmatter_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md
index 3d4a02ce5b..b2da8e3ec8 100644
--- a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md
+++ b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md
@@ -71,6 +71,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [BlackMatter Ransomware](/stories/blackmatter_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md b/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md
index afdb63f331..13d47cb2a5 100644
--- a/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md
+++ b/docs/_posts/2021-09-06-correlation_by_repository_and_risk.md
@@ -68,6 +68,10 @@ For Dev Sec Ops POC
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-06-correlation_by_user_and_risk.md b/docs/_posts/2021-09-06-correlation_by_user_and_risk.md
index 9364d93eaf..771bb4ebde 100644
--- a/docs/_posts/2021-09-06-correlation_by_user_and_risk.md
+++ b/docs/_posts/2021-09-06-correlation_by_user_and_risk.md
@@ -68,6 +68,10 @@ For Dev Sec Ops POC
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Dev Sec Ops](/stories/dev_sec_ops)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md
index aad6c0b5b7..7e27aff516 100644
--- a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md
+++ b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md
@@ -75,6 +75,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md
index 70292f8264..a32b2e7a26 100644
--- a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md
+++ b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md
@@ -75,6 +75,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use PowerView for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md
index 4de5ff1057..416331b3f4 100644
--- a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md
+++ b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md
@@ -75,6 +75,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use PowerView for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md
index 13654bf7c8..99cb172d6b 100644
--- a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md
+++ b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md
@@ -75,6 +75,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
index 4f51e7bb2a..1f92babcdc 100644
--- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
+++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
@@ -74,6 +74,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 normal application like mmc.exe and other ldap query tool may trigger this detections.
 
+#### Associated Analytic story
+* [blackMatter ransomware](/stories/blackmatter_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-07-system_information_discovery_detection.md b/docs/_posts/2021-09-07-system_information_discovery_detection.md
index ef6861a54a..6a1bd255d9 100644
--- a/docs/_posts/2021-09-07-system_information_discovery_detection.md
+++ b/docs/_posts/2021-09-07-system_information_discovery_detection.md
@@ -72,6 +72,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators debugging servers
 
+#### Associated Analytic story
+* [Discovery Techniques](/stories/discovery_techniques)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md
index 0924cecba3..67dfdc58bb 100644
--- a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md
+++ b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md
@@ -80,6 +80,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives will be present as control.exe does not natively load from writable paths as defined. One may add .cpl or .inf to the command-line if there is any false positives. Tune as needed.
 
+#### Associated Analytic story
+* [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md
index 18a8330854..3002f491e0 100644
--- a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md
+++ b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md
@@ -80,6 +80,10 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 Administrators often leverage net.exe to create admin accounts.
 
+#### Associated Analytic story
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-08-office_spawning_control.md b/docs/_posts/2021-09-08-office_spawning_control.md
index 55ca6189cc..6a511dbd24 100644
--- a/docs/_posts/2021-09-08-office_spawning_control.md
+++ b/docs/_posts/2021-09-08-office_spawning_control.md
@@ -80,6 +80,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives should be present.
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+* [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
index e0cdee3431..ec16b24478 100644
--- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
+++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
@@ -81,6 +81,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 This is a hunting detection, meant to provide a understanding of how voluminous control_rundll is within the environment.
 
+#### Associated Analytic story
+* [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity)
+* [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
index 6b87bb9866..93be658e45 100644
--- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
+++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
@@ -81,6 +81,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 This may be tuned, or a new one related, by adding .cpl to command-line. However, it&#39;s important to look for both. Tune/filter as needed.
 
+#### Associated Analytic story
+* [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity)
+* [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md
index a95c7f840e..7d4cc63a1a 100644
--- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md
+++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md
@@ -81,6 +81,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 It is possible some agent based products will generate false positives. Filter as needed.
 
+#### Associated Analytic story
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md
index a45abf8601..d30f437095 100644
--- a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md
+++ b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md
@@ -75,6 +75,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Limited false positives will be present, however, tune as necessary.
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+* [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md
index 882ce7aa05..f07d0277af 100644
--- a/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-10-getnettcpconnection_with_powershell_script_block.md
@@ -66,6 +66,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators or power users may use this PowerShell commandlet for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md
index 3e34654908..4b635f489b 100644
--- a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md
+++ b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md
@@ -75,6 +75,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md
index 9eb8ef8d86..02d79dedbd 100644
--- a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md
+++ b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md
@@ -75,6 +75,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md
index 200b6f9f42..bd0baab169 100644
--- a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md
+++ b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md
@@ -75,6 +75,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md b/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md
index d19351d4b9..8ecb1f8709 100644
--- a/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md
+++ b/docs/_posts/2021-09-10-office_product_writing_cab_or_inf.md
@@ -79,6 +79,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+* [Microsoft MSHTML Remote Code Execution CVE-2021-40444](/stories/microsoft_mshtml_remote_code_execution_cve-2021-40444)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md
index 1e5f051336..59766fa456 100644
--- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md
+++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md
@@ -76,6 +76,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md
index b3ec13413f..758d4468e1 100644
--- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md
+++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell_script_block.md
@@ -68,6 +68,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators or power users may use this PowerShell commandlet for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md
index bb20cc2205..16b0dd71bf 100644
--- a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md
+++ b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md
@@ -76,6 +76,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [FIN7](/stories/fin7)
+* [Remcos](/stories/remcos)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
index fff24aeb78..d2492ef8c7 100644
--- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
+++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
@@ -75,6 +75,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 automation scripting language may used by network operator to do ldap query.
 
+#### Associated Analytic story
+* [FIN7](/stories/fin7)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
index 7f40076a7b..6d4db48668 100644
--- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
+++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
@@ -75,6 +75,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 automation scripting language may used by network operator to do ldap query.
 
+#### Associated Analytic story
+* [FIN7](/stories/fin7)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-13-office_application_drop_executable.md b/docs/_posts/2021-09-13-office_application_drop_executable.md
index d12e0da794..e3fa4b0c50 100644
--- a/docs/_posts/2021-09-13-office_application_drop_executable.md
+++ b/docs/_posts/2021-09-13-office_application_drop_executable.md
@@ -79,6 +79,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 office macro for automation may do this behavior
 
+#### Associated Analytic story
+* [FIN7](/stories/fin7)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_query.md b/docs/_posts/2021-09-13-system_user_discovery_with_query.md
index da7235fa51..96b5696496 100644
--- a/docs/_posts/2021-09-13-system_user_discovery_with_query.md
+++ b/docs/_posts/2021-09-13-system_user_discovery_with_query.md
@@ -76,6 +76,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md
index a8c5e7ae82..68eddc60c9 100644
--- a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md
+++ b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md
@@ -76,6 +76,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md
index 721dc7d334..ea24003b1f 100644
--- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md
+++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md
@@ -76,6 +76,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md
index e2a910be1c..f7ec2bd4c4 100644
--- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md
+++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell_script_block.md
@@ -68,6 +68,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators or power users may use this PowerShell commandlet for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md
index 2bd6694188..fbed846186 100644
--- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md
+++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md
@@ -73,6 +73,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [FIN7](/stories/fin7)
+* [Suspicious WMI Use](/stories/suspicious_wmi_use)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
index b915b5c803..02641b1c44 100644
--- a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
+++ b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
@@ -80,6 +80,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 A network operator or systems administrator may utilize an automated host discovery application that may generate false positives. Filter as needed.
 
+#### Associated Analytic story
+* [FIN7](/stories/fin7)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md
index eba7416985..235a750595 100644
--- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md
+++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md
@@ -80,6 +80,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives may be present. Tune as needed.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md
index 15172adde5..f0c96898df 100644
--- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md
+++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md
@@ -73,6 +73,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 False positives may be present. Tune as needed.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-14-net_localgroup_discovery.md b/docs/_posts/2021-09-14-net_localgroup_discovery.md
index b335c01326..9e9a107b61 100644
--- a/docs/_posts/2021-09-14-net_localgroup_discovery.md
+++ b/docs/_posts/2021-09-14-net_localgroup_discovery.md
@@ -80,6 +80,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives may be present. Tune as needed.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+* [Windows Discovery Techniques](/stories/windows_discovery_techniques)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md
index d74e1a20df..9b38d568ab 100644
--- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md
+++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md
@@ -80,6 +80,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives may be present. Tune as needed.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md
index e6f8e6e1a9..fe31bcdbd5 100644
--- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md
+++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md
@@ -73,6 +73,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 False positives may be present. Tune as needed.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-14-wmic_group_discovery.md b/docs/_posts/2021-09-14-wmic_group_discovery.md
index b2fcf6fa76..30b06ee6b9 100644
--- a/docs/_posts/2021-09-14-wmic_group_discovery.md
+++ b/docs/_posts/2021-09-14-wmic_group_discovery.md
@@ -82,6 +82,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md
index 2daa389124..a635f0d9c4 100644
--- a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md
+++ b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md
@@ -72,6 +72,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [FIN7](/stories/fin7)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md
index 231bf4614b..dbd889a9a4 100644
--- a/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md
+++ b/docs/_posts/2021-09-15-non_chrome_process_accessing_chrome_default_dir.md
@@ -77,6 +77,11 @@ To successfully implement this search, you must ingest Windows Security Event lo
 #### Known False Positives
 other browser not listed related to firefox may catch by this rule.
 
+#### Associated Analytic story
+* [FIN7](/stories/fin7)
+* [Remcos](/stories/remcos)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md
index 91bf2f88b4..f4f126f606 100644
--- a/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md
+++ b/docs/_posts/2021-09-15-non_firefox_process_access_firefox_profile_dir.md
@@ -77,6 +77,11 @@ To successfully implement this search, you must ingest Windows Security Event lo
 #### Known False Positives
 other browser not listed related to firefox may catch by this rule.
 
+#### Associated Analytic story
+* [FIN7](/stories/fin7)
+* [Remcos](/stories/remcos)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-16-account_discovery_with_net_app.md b/docs/_posts/2021-09-16-account_discovery_with_net_app.md
index 652d289406..7a6234c0e6 100644
--- a/docs/_posts/2021-09-16-account_discovery_with_net_app.md
+++ b/docs/_posts/2021-09-16-account_discovery_with_net_app.md
@@ -82,6 +82,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 admin or power user may used this series of command.
 
+#### Associated Analytic story
+* [Trickbot](/stories/trickbot)
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
index 568283a66f..2cf72cb01b 100644
--- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
+++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
@@ -78,6 +78,10 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 There may be legitimate reasons for administrators to add a certificate to the untrusted certificate store. In such cases, this will typically be done on a large number of systems.
 
+#### Associated Analytic story
+* [Disabling Security Tools](/stories/disabling_security_tools)
+
+
 #### Kill Chain Phase
 * Installation
 * Actions on Objectives
diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
index 394ffc6f86..5e802077d3 100644
--- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
+++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
@@ -82,6 +82,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 None identified.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-16-batch_file_write_to_system32.md b/docs/_posts/2021-09-16-batch_file_write_to_system32.md
index d4883824f6..8bf9262b91 100644
--- a/docs/_posts/2021-09-16-batch_file_write_to_system32.md
+++ b/docs/_posts/2021-09-16-batch_file_write_to_system32.md
@@ -79,6 +79,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 It is possible for this search to generate a notable event for a batch file write to a path that includes the string &#34;system32&#34;, but is not the actual Windows system directory. As such, you should confirm the path of the batch file identified by the search. In addition, a false positive may be generated by an administrator copying a legitimate batch file in this directory tree. You should confirm that the activity is legitimate and modify the search to add exclusions, as necessary.
 
+#### Associated Analytic story
+* [SamSam Ransomware](/stories/samsam_ransomware)
+
+
 #### Kill Chain Phase
 * Delivery
 
diff --git a/docs/_posts/2021-09-16-bits_job_persistence.md b/docs/_posts/2021-09-16-bits_job_persistence.md
index 18b7535423..d713f8f681 100644
--- a/docs/_posts/2021-09-16-bits_job_persistence.md
+++ b/docs/_posts/2021-09-16-bits_job_persistence.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives will be present. Typically, applications will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments (legitimate applications) or parent process.
 
+#### Associated Analytic story
+* [BITS Jobs](/stories/bits_jobs)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-16-bitsadmin_download_file.md b/docs/_posts/2021-09-16-bitsadmin_download_file.md
index 3a0c29d605..7196219fbc 100644
--- a/docs/_posts/2021-09-16-bitsadmin_download_file.md
+++ b/docs/_posts/2021-09-16-bitsadmin_download_file.md
@@ -82,6 +82,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives, however it may be required to filter based on parent process name or network connection.
 
+#### Associated Analytic story
+* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
+* [BITS Jobs](/stories/bits_jobs)
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
index 95d6aff2d4..6d4d072e22 100644
--- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
+++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
@@ -82,6 +82,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Legtimate administrator usage of wmic to create a shadow copy.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
index 335b12f7a8..974ee7205c 100644
--- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
+++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
index 0486d058cf..abd91061a1 100644
--- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
+++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-16-detect_html_help_renamed.md b/docs/_posts/2021-09-16-detect_html_help_renamed.md
index f3730fb3c4..af28233868 100644
--- a/docs/_posts/2021-09-16-detect_html_help_renamed.md
+++ b/docs/_posts/2021-09-16-detect_html_help_renamed.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely a renamed instance of hh.exe will be used legitimately, filter as needed.
 
+#### Associated Analytic story
+* [Suspicious Compiled HTML Activity](/stories/suspicious_compiled_html_activity)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md
index da1fd2a2e0..ac090719d8 100644
--- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md
+++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, some legitimate applications may retrieve a CHM remotely, filter as needed.
 
+#### Associated Analytic story
+* [Suspicious Compiled HTML Activity](/stories/suspicious_compiled_html_activity)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md
index 1e53c41de2..a6f85b6f82 100644
--- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md
+++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 It is rare to see instances of InfoTech Storage Handlers being used, but it does happen in some legitimate instances. Filter as needed.
 
+#### Associated Analytic story
+* [Suspicious Compiled HTML Activity](/stories/suspicious_compiled_html_activity)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md
index 567ab364bb..708d1b49e6 100644
--- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md
+++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, some legitimate applications may exhibit this behavior, triggering a false positive.
 
+#### Associated Analytic story
+* [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-16-detect_mshta_renamed.md b/docs/_posts/2021-09-16-detect_mshta_renamed.md
index 6a6ea4426c..b196f3b186 100644
--- a/docs/_posts/2021-09-16-detect_mshta_renamed.md
+++ b/docs/_posts/2021-09-16-detect_mshta_renamed.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, some legitimate applications may use a moved copy of mshta.exe, but never renamed, triggering a false positive.
 
+#### Associated Analytic story
+* [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md
index e3d1bec40a..29dd4b45c9 100644
--- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md
+++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 It is possible legitimate applications may perform this behavior and will need to be filtered.
 
+#### Associated Analytic story
+* [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
index 24327aeb4e..83b13b29d7 100644
--- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
+++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
@@ -81,6 +81,14 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators can leverage PsExec for accessing remote systems and might pass `accepteula` as an argument if they are running this tool for the first time. However, it is not likely that you&#39;d see multiple occurrences of this event on a machine
 
+#### Associated Analytic story
+* [SamSam Ransomware](/stories/samsam_ransomware)
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+* [HAFNIUM Group](/stories/hafnium_group)
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-16-detect_renamed_7-zip.md b/docs/_posts/2021-09-16-detect_renamed_7-zip.md
index 6aeddd15c1..7b44ca80d6 100644
--- a/docs/_posts/2021-09-16-detect_renamed_7-zip.md
+++ b/docs/_posts/2021-09-16-detect_renamed_7-zip.md
@@ -80,6 +80,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives, however this analytic will need to be modified for each environment if Sysmon is not used.
 
+#### Associated Analytic story
+* [Collection and Staging](/stories/collection_and_staging)
+
+
 #### Kill Chain Phase
 * Exfiltration
 
diff --git a/docs/_posts/2021-09-16-detect_renamed_psexec.md b/docs/_posts/2021-09-16-detect_renamed_psexec.md
index 42761a7925..459161b747 100644
--- a/docs/_posts/2021-09-16-detect_renamed_psexec.md
+++ b/docs/_posts/2021-09-16-detect_renamed_psexec.md
@@ -81,6 +81,14 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives should be present. It is possible some third party applications may use older versions of PsExec, filter as needed.
 
+#### Associated Analytic story
+* [SamSam Ransomware](/stories/samsam_ransomware)
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+* [HAFNIUM Group](/stories/hafnium_group)
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Exploitation
 * Lateral Movement
diff --git a/docs/_posts/2021-09-16-detect_renamed_rclone.md b/docs/_posts/2021-09-16-detect_renamed_rclone.md
index bdda405c1b..d8e7711bd8 100644
--- a/docs/_posts/2021-09-16-detect_renamed_rclone.md
+++ b/docs/_posts/2021-09-16-detect_renamed_rclone.md
@@ -75,6 +75,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited as this analytic identifies renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business use case.
 
+#### Associated Analytic story
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exfiltration
 
diff --git a/docs/_posts/2021-09-16-detect_renamed_winrar.md b/docs/_posts/2021-09-16-detect_renamed_winrar.md
index c93435b1ae..baddec447a 100644
--- a/docs/_posts/2021-09-16-detect_renamed_winrar.md
+++ b/docs/_posts/2021-09-16-detect_renamed_winrar.md
@@ -80,6 +80,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Unknown. It is possible third party applications use renamed instances of WinRAR.
 
+#### Associated Analytic story
+* [Collection and Staging](/stories/collection_and_staging)
+
+
 #### Kill Chain Phase
 * Exploitation
 * Exfiltration
diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
index f44eb0f2f3..6017caa1db 100644
--- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
+++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
@@ -78,6 +78,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 None identified.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+* [HAFNIUM Group](/stories/hafnium_group)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_net.md b/docs/_posts/2021-09-16-local_account_discovery_with_net.md
index 0f16383b80..bbe06b79de 100644
--- a/docs/_posts/2021-09-16-local_account_discovery_with_net.md
+++ b/docs/_posts/2021-09-16-local_account_discovery_with_net.md
@@ -70,6 +70,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md
index 25aa1cff46..c3318139ce 100644
--- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md
+++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md
@@ -70,6 +70,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators or power users may use this command for troubleshooting.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md
index fbb75c85c0..306a102f5b 100644
--- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md
+++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md
@@ -81,6 +81,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 No false positives known. Filter as needed.
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+* [FIN7](/stories/fin7)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md
index 498928836b..5199390a43 100644
--- a/docs/_posts/2021-09-16-processes_launching_netsh.md
+++ b/docs/_posts/2021-09-16-processes_launching_netsh.md
@@ -76,6 +76,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Some VPN applications are known to launch netsh.exe. Outside of these instances, it is unusual for an executable to launch netsh.exe and run commands.
 
+#### Associated Analytic story
+* [Netsh Abuse](/stories/netsh_abuse)
+* [Disabling Security Tools](/stories/disabling_security_tools)
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-20-detect_regasm_with_no_command_line_arguments.md b/docs/_posts/2021-09-20-detect_regasm_with_no_command_line_arguments.md
index 3f14989486..a042c83e58 100644
--- a/docs/_posts/2021-09-20-detect_regasm_with_no_command_line_arguments.md
+++ b/docs/_posts/2021-09-20-detect_regasm_with_no_command_line_arguments.md
@@ -82,6 +82,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, limited instances of regasm.exe or may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
 
+#### Associated Analytic story
+* [Suspicious Regsvcs Regasm Activity](/stories/suspicious_regsvcs_regasm_activity)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-20-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2021-09-20-detect_regsvcs_with_no_command_line_arguments.md
index 5653814e0e..4e02e40beb 100644
--- a/docs/_posts/2021-09-20-detect_regsvcs_with_no_command_line_arguments.md
+++ b/docs/_posts/2021-09-20-detect_regsvcs_with_no_command_line_arguments.md
@@ -82,6 +82,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage.
 
+#### Associated Analytic story
+* [Suspicious Regsvcs Regasm Activity](/stories/suspicious_regsvcs_regasm_activity)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md
index 1dfdba4eb4..f40280c609 100644
--- a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md
+++ b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md
@@ -80,6 +80,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Default browser not in the filter list.
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-20-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2021-09-20-suspicious_dllhost_no_command_line_arguments.md
index b3fe719bed..e81b9d9387 100644
--- a/docs/_posts/2021-09-20-suspicious_dllhost_no_command_line_arguments.md
+++ b/docs/_posts/2021-09-20-suspicious_dllhost_no_command_line_arguments.md
@@ -79,6 +79,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives may be present in small environments. Tuning may be required based on parent process.
 
+#### Associated Analytic story
+* [Cobalt Strike](/stories/cobalt_strike)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-20-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2021-09-20-suspicious_gpupdate_no_command_line_arguments.md
index 5dd179ef59..714d739582 100644
--- a/docs/_posts/2021-09-20-suspicious_gpupdate_no_command_line_arguments.md
+++ b/docs/_posts/2021-09-20-suspicious_gpupdate_no_command_line_arguments.md
@@ -79,6 +79,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Limited false positives may be present in small environments. Tuning may be required based on parent process.
 
+#### Associated Analytic story
+* [Cobalt Strike](/stories/cobalt_strike)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md b/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md
index 92f9407552..7c754b0624 100644
--- a/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md
+++ b/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md
@@ -85,6 +85,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, some legitimate applications may use a moved copy of microsoft.workflow.compiler.exe, triggering a false positive.
 
+#### Associated Analytic story
+* [Trusted Developer Utilities Proxy Execution](/stories/trusted_developer_utilities_proxy_execution)
+* [Cobalt Strike](/stories/cobalt_strike)
+* [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-20-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2021-09-20-suspicious_rundll32_no_command_line_arguments.md
index af9f524a9a..a0e27de3a3 100644
--- a/docs/_posts/2021-09-20-suspicious_rundll32_no_command_line_arguments.md
+++ b/docs/_posts/2021-09-20-suspicious_rundll32_no_command_line_arguments.md
@@ -83,6 +83,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive.
 
+#### Associated Analytic story
+* [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity)
+* [Cobalt Strike](/stories/cobalt_strike)
+* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md b/docs/_posts/2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md
index d0145ff922..8a65c5fdc7 100644
--- a/docs/_posts/2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md
+++ b/docs/_posts/2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives may be present in small environments. Tuning may be required based on parent process.
 
+#### Associated Analytic story
+* [Cobalt Strike](/stories/cobalt_strike)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
index 5d0b961c7b..9a2ac51a22 100644
--- a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
+++ b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
@@ -69,6 +69,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Remcos](/stories/remcos)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md b/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md
index 04a01b9e18..53336ad314 100644
--- a/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md
+++ b/docs/_posts/2021-09-21-suspicious_image_creation_in_appdata_folder.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Remcos](/stories/remcos)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md b/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md
index 5dda4bcf29..6b346c1cf3 100644
--- a/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md
+++ b/docs/_posts/2021-09-21-suspicious_wav_file_in_appdata_folder.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Remcos](/stories/remcos)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-27-change_default_file_association.md b/docs/_posts/2021-09-27-change_default_file_association.md
index 876d040f42..865c16553e 100644
--- a/docs/_posts/2021-09-27-change_default_file_association.md
+++ b/docs/_posts/2021-09-27-change_default_file_association.md
@@ -76,6 +76,11 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md
index 094f57a928..08205164ff 100644
--- a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md
+++ b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md
@@ -76,6 +76,11 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md
index bf6a101721..e7fd1fc309 100644
--- a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md
+++ b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md
@@ -76,6 +76,11 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md
index 4c864c270b..acb99d13c2 100644
--- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md
+++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md
@@ -78,6 +78,11 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 possible new printer installation may add driver component on this registry.
 
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md
index 9a945646b1..72d73f496f 100644
--- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md
+++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 windows can used this application for its normal COM object validation.
 
+#### Associated Analytic story
+* [Unusual Processes](/stories/unusual_processes)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md
index b59ccb0560..74931701d5 100644
--- a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md
+++ b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md
@@ -80,6 +80,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [FIN7](/stories/fin7)
+* [Remcos](/stories/remcos)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md
index 630241e430..7be85976e7 100644
--- a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md
+++ b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md
@@ -76,6 +76,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited as developers do not spawn MSBuild via a WSH.
 
+#### Associated Analytic story
+* [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
index a66980dcc8..625222ba92 100644
--- a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
+++ b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
@@ -83,6 +83,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Other third part application may used this parameter but not so common in base windows environment.
 
+#### Associated Analytic story
+* [Suspicious Regsvr32 Activity](/stories/suspicious_regsvr32_activity)
+* [Remcos](/stories/remcos)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-05-detect_exchange_web_shell.md b/docs/_posts/2021-10-05-detect_exchange_web_shell.md
index dc349a5095..705f8bbeba 100644
--- a/docs/_posts/2021-10-05-detect_exchange_web_shell.md
+++ b/docs/_posts/2021-10-05-detect_exchange_web_shell.md
@@ -81,6 +81,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
 
+#### Associated Analytic story
+* [HAFNIUM Group](/stories/hafnium_group)
+* [ProxyShell](/stories/proxyshell)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md
index ef79a48cf9..626f555131 100644
--- a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md
+++ b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md
@@ -80,6 +80,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited, filter as needed. In our test case, Remcos used regsvr32.exe to modify the registry. It may be required, dependent upon the EDR tool producing registry events, to remove (Default) from the command-line.
 
+#### Associated Analytic story
+* [Suspicious Regsvr32 Activity](/stories/suspicious_regsvr32_activity)
+* [Remcos](/stories/remcos)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md
index 341b80e448..b4961b4bf4 100644
--- a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md
+++ b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md
@@ -80,6 +80,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited, however it is possible to filter by Processes.process_name and specific processes (ex. wscript.exe). Filter as needed. This may need modification based on EDR telemetry and how it brings in registry data. For example, removal of (Default).
 
+#### Associated Analytic story
+* [Remcos](/stories/remcos)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
index 90fe606905..17e8040214 100644
--- a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
+++ b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
@@ -77,6 +77,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Unusual Processes](/stories/unusual_processes)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
index 60adf88691..53eb4d47e9 100644
--- a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
+++ b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 every user may do this event but very un-ussual.
 
+#### Associated Analytic story
+* [Unusual Processes](/stories/unusual_processes)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md
index 62dd30cad5..8757d560f1 100644
--- a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md
+++ b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md
@@ -77,6 +77,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited as winhlp32.exe is typically not used with the latest flavors of Windows OS. However, filter as needed.
 
+#### Associated Analytic story
+* [Remcos](/stories/remcos)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md b/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md
index 26dc2d9c62..7a7f8a0542 100644
--- a/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md
+++ b/docs/_posts/2021-10-06-dns_query_length_with_high_standard_deviation.md
@@ -76,6 +76,12 @@ To successfully implement this search, you will need to ensure that DNS data is
 #### Known False Positives
 It&#39;s possible there can be long domain names that are legitimate.
 
+#### Associated Analytic story
+* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
+* [Suspicious DNS Traffic](/stories/suspicious_dns_traffic)
+* [Command and Control](/stories/command_and_control)
+
+
 #### Kill Chain Phase
 * Command and Control
 
diff --git a/docs/_posts/2021-10-06-sdelete_application_execution.md b/docs/_posts/2021-10-06-sdelete_application_execution.md
index ef19d78a8c..17dd343fb6 100644
--- a/docs/_posts/2021-10-06-sdelete_application_execution.md
+++ b/docs/_posts/2021-10-06-sdelete_application_execution.md
@@ -85,6 +85,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 user may execute and use this application
 
+#### Associated Analytic story
+* [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md
index 3356e67a7c..fe2da0e523 100644
--- a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md
+++ b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md
@@ -92,6 +92,13 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators may create vbs or js script that use several tool as part of its execution. Filter as needed.
 
+#### Associated Analytic story
+* [FIN7](/stories/fin7)
+* [Remcos](/stories/remcos)
+* [Unusual Processes](/stories/unusual_processes)
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md
index 9466679701..eb1472ba59 100644
--- a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md
+++ b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md
@@ -74,6 +74,12 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 The wevtutil.exe application is a legitimate Windows event log utility. Administrators may use it to manage Windows event logs.
 
+#### Associated Analytic story
+* [Windows Log Manipulation](/stories/windows_log_manipulation)
+* [Ransomware](/stories/ransomware)
+* [Clop Ransomware](/stories/clop_ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-10-13-dllhost_with_no_command_line_arguments_with_network.md b/docs/_posts/2021-10-13-dllhost_with_no_command_line_arguments_with_network.md
index 65df4e9360..ea6306a6ba 100644
--- a/docs/_posts/2021-10-13-dllhost_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2021-10-13-dllhost_with_no_command_line_arguments_with_network.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, some legitimate third party applications may use a moved copy of dllhost, triggering a false positive.
 
+#### Associated Analytic story
+* [Cobalt Strike](/stories/cobalt_strike)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-13-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2021-10-13-rundll32_with_no_command_line_arguments_with_network.md
index 3e174fd23d..fb7c32d9f0 100644
--- a/docs/_posts/2021-10-13-rundll32_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2021-10-13-rundll32_with_no_command_line_arguments_with_network.md
@@ -88,6 +88,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive.
 
+#### Associated Analytic story
+* [Suspicious Rundll32 Activity](/stories/suspicious_rundll32_activity)
+* [Cobalt Strike](/stories/cobalt_strike)
+* [PrintNightmare CVE-2021-34527](/stories/printnightmare_cve-2021-34527)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-13-searchprotocolhost_with_no_command_line_with_network.md b/docs/_posts/2021-10-13-searchprotocolhost_with_no_command_line_with_network.md
index 47b7ebb958..b5725c00b2 100644
--- a/docs/_posts/2021-10-13-searchprotocolhost_with_no_command_line_with_network.md
+++ b/docs/_posts/2021-10-13-searchprotocolhost_with_no_command_line_with_network.md
@@ -77,6 +77,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives may be present in small environments. Tuning may be required based on parent process.
 
+#### Associated Analytic story
+* [Cobalt Strike](/stories/cobalt_strike)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md
index 4d3307d240..b8057ac435 100644
--- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md
+++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_powershell.md
@@ -78,6 +78,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 False positives should be limited, however filter as needed.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md
index b855a6466d..9ecf2cfc66 100644
--- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md
+++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md
@@ -84,6 +84,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives may be caused by Administrators resetting SPNs or querying for SPNs. Filter as needed.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-10-18-disable_schedule_task.md b/docs/_posts/2021-10-18-disable_schedule_task.md
index b1fc0b2bcf..0db45ce047 100644
--- a/docs/_posts/2021-10-18-disable_schedule_task.md
+++ b/docs/_posts/2021-10-18-disable_schedule_task.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 admin may disable problematic schedule task
 
+#### Associated Analytic story
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md
index e1db7154f8..507cb31584 100644
--- a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md
+++ b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md
@@ -79,6 +79,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 It is possible Administrators or super users will use Curl for legitimate purposes. Filter as needed.
 
+#### Associated Analytic story
+* [IceID](/stories/iceid)
+* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md
index 10ae5b6084..2dece601df 100644
--- a/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md
+++ b/docs/_posts/2021-10-19-winevent_windows_task_scheduler_event_action_started.md
@@ -72,6 +72,11 @@ Task Scheduler logs are required to be collected. Enable logging with inputs.con
 #### Known False Positives
 False positives will be present. Filter based on ActionName paths or specify keywords of interest.
 
+#### Associated Analytic story
+* [IcedID](/stories/icedid)
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md
index 01c2128212..5e9045c2be 100644
--- a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md
+++ b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md
@@ -80,6 +80,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 third party application may use this approach to uninstall there application
 
+#### Associated Analytic story
+* [IceID](/stories/iceid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md
index aacbf66567..016c224585 100644
--- a/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md
+++ b/docs/_posts/2021-10-24-gdrive_suspicious_file_sharing.md
@@ -70,6 +70,11 @@ Need to implement Gsuite logging targeting Google suite drive activity. In order
 #### Known False Positives
 This is an anomaly search, you must specify your domain in the parameters so it either filters outside domains or focus on internal domains. This search may also help investigate compromise of accounts. By looking at for example source ip addresses, document titles and abnormal number of shares and shared target users.
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+* [Data Exfiltration](/stories/data_exfiltration)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md
index 084540a975..2496d39e26 100644
--- a/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md
+++ b/docs/_posts/2021-10-24-gsuite_suspicious_calendar_invite.md
@@ -70,6 +70,10 @@ In order to successfully implement this search, you need to be ingesting logs re
 #### Known False Positives
 This search will also produce normal activity statistics. Fields such as email, ip address, name, parameters.organizer_calendar_id, parameters.target_calendar_id and parameters.event_title may give away phishing intent.For more specific results use email parameter.
 
+#### Associated Analytic story
+* [Spearphishing Attachments](/stories/spearphishing_attachments)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-03-windows_adfind_exe.md b/docs/_posts/2021-11-03-windows_adfind_exe.md
index f15aa4470c..4ed539d0fd 100644
--- a/docs/_posts/2021-11-03-windows_adfind_exe.md
+++ b/docs/_posts/2021-11-03-windows_adfind_exe.md
@@ -72,6 +72,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 administrators rarely use adfind, usually not used for legitimate reasons
 
+#### Associated Analytic story
+* [NOBELIUM Group](/stories/nobelium_group)
+* [Domain Trust Discovery](/stories/domain_trust_discovery)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md
index 6bf430bdda..7b59d413ea 100644
--- a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md
+++ b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md
@@ -87,6 +87,13 @@ To successfully implement this search, you must be ingesting data that records p
 #### Known False Positives
 Some administrator activity can be potentially triggered, please add those users to the filter macro.
 
+#### Associated Analytic story
+* [Monitor for Unauthorized Software](/stories/monitor_for_unauthorized_software)
+* [XMRig](/stories/xmrig)
+* [SamSam Ransomware](/stories/samsam_ransomware)
+* [Unusual Processes](/stories/unusual_processes)
+
+
 #### Kill Chain Phase
 * Installation
 * Command and Control
diff --git a/docs/_posts/2021-11-05-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md b/docs/_posts/2021-11-05-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md
index 3e56d5ad96..ad83a31865 100644
--- a/docs/_posts/2021-11-05-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md
+++ b/docs/_posts/2021-11-05-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md
@@ -82,6 +82,10 @@ You must be ingesting Windows Security logs from devices of interest - at least
 #### Known False Positives
 Environments in which NTLM is used extremely rarely and for benign purposes (such as a rare use of SMB shares).
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md
index 7142e64882..c14550658c 100644
--- a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md
+++ b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md
@@ -81,6 +81,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives may be limited to source control applications and may be required to be filtered out.
 
+#### Associated Analytic story
+* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
+
+
 #### Kill Chain Phase
 * Exfiltration
 
diff --git a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
index 4e83ffa6ec..20e6085c62 100644
--- a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
@@ -82,6 +82,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators may create Windows Services on remote systems, but this activity is usually limited to a small set of hosts or users.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
index 7ffcdd6daf..77f9fb15fa 100644
--- a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
@@ -82,6 +82,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators may start Windows Services on remote systems, but this activity is usually limited to a small set of hosts or users.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
index 5be1606447..965702e860 100644
--- a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
+++ b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
@@ -80,6 +80,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators may leverage WinRM and WinRs to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
index b84f77c590..6d651c9df5 100644
--- a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
+++ b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
@@ -84,6 +84,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators may create scheduled tasks on remote systems, but this activity is usually limited to a small set of hosts or users.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
index bd47a26fb2..c934491637 100644
--- a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
@@ -84,6 +84,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators may start scheduled tasks on remote systems, but this activity is usually limited to a small set of hosts or users.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md b/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md
index 39a20b1c7e..f8ec11c32f 100644
--- a/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md
+++ b/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md
@@ -78,6 +78,11 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 Administrators may create scheduled tasks on remote systems, but this activity is usually limited to a small set of hosts or users. It is important to validate and investigate as appropriate.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+* [NOBELIUM Group](/stories/nobelium_group)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md
index e9cfecd406..5b31526a77 100644
--- a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md
+++ b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md
@@ -77,6 +77,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives are limited as legitimate applications typically do not download files or xsl using WMIC. Filter as needed.
 
+#### Associated Analytic story
+* [Suspicious WMI Use](/stories/suspicious_wmi_use)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md
index 1ce1e30f06..b6d405718a 100644
--- a/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md
+++ b/docs/_posts/2021-11-12-aws_iam_accessdenied_discovery_events.md
@@ -71,6 +71,10 @@ The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. T
 #### Known False Positives
 It is possible to start this detection will need to be tuned by source IP or user. In addition, change the count values to an upper threshold to restrict false positives.
 
+#### Associated Analytic story
+* [Suspicious Cloud User Activities](/stories/suspicious_cloud_user_activities)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
index 1bbc926782..d9e21dab7d 100644
--- a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
+++ b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 A network operator or systems administrator may utilize an automated powershell script taht execute .net code that may generate false positive. filter is needed.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md
index a5f502c11a..acc93ec128 100644
--- a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md
+++ b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md
@@ -77,6 +77,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 A network operator or systems administrator may utilize an automated or manual execution of this firewall rule that may generate false positives. Filter as needed.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
index cf06088d96..14ea7c8552 100644
--- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
+++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 A network operator or systems administrator may utilize an automated host discovery application that may generate false positives or an amazon ec2 script that uses this application. Filter as needed.
 
+#### Associated Analytic story
+* [Active Directory Discovery](/stories/active_directory_discovery)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
index 1a2bccfc70..e52dfcd403 100644
--- a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
+++ b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
@@ -77,6 +77,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 The wmic.exe utility is a benign Windows application. It may be used legitimately by Administrators with these parameters for remote system administration, but it&#39;s relatively uncommon.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+* [Suspicious WMI Use](/stories/suspicious_wmi_use)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-11-12-runas_execution_in_commandline.md b/docs/_posts/2021-11-12-runas_execution_in_commandline.md
index 40c0850991..8f685e0347 100644
--- a/docs/_posts/2021-11-12-runas_execution_in_commandline.md
+++ b/docs/_posts/2021-11-12-runas_execution_in_commandline.md
@@ -80,6 +80,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 A network operator or systems administrator may utilize an automated or manual execute this command that may generate false positives. filter is needed.
 
+#### Associated Analytic story
+* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md
index 61ca76115c..cc3097ca71 100644
--- a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md
+++ b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md
@@ -83,6 +83,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Typically this will not trigger as by it&#39;s very nature InstallUtil does not need credentials. Filter as needed.
 
+#### Associated Analytic story
+* [Signed Binary Proxy Execution InstallUtil](/stories/signed_binary_proxy_execution_installutil)
+
+
 #### Kill Chain Phase
 * Exploitation
 * Privilege Escalation
diff --git a/docs/_posts/2021-11-12-windows_installutil_remote_network_connection.md b/docs/_posts/2021-11-12-windows_installutil_remote_network_connection.md
index 9c7308a5c6..b2d5eead94 100644
--- a/docs/_posts/2021-11-12-windows_installutil_remote_network_connection.md
+++ b/docs/_posts/2021-11-12-windows_installutil_remote_network_connection.md
@@ -92,6 +92,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements.
 
+#### Associated Analytic story
+* [Signed Binary Proxy Execution InstallUtil](/stories/signed_binary_proxy_execution_installutil)
+
+
 #### Kill Chain Phase
 * Exploitation
 * Privilege Escalation
diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
index 2459c2cdee..a5303ed25a 100644
--- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
+++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
@@ -85,6 +85,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives should be present. Filter as needed by parent process or application.
 
+#### Associated Analytic story
+* [Signed Binary Proxy Execution InstallUtil](/stories/signed_binary_proxy_execution_installutil)
+
+
 #### Kill Chain Phase
 * Exploitation
 * Privilege Escalation
diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option_with_network.md
index 4f8305b5bf..c7c35b0345 100644
--- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option_with_network.md
+++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option_with_network.md
@@ -93,6 +93,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements.
 
+#### Associated Analytic story
+* [Signed Binary Proxy Execution InstallUtil](/stories/signed_binary_proxy_execution_installutil)
+
+
 #### Kill Chain Phase
 * Exploitation
 * Privilege Escalation
diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
index 13c8ee8758..acd2e14fc3 100644
--- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
+++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
@@ -84,6 +84,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements.
 
+#### Associated Analytic story
+* [Signed Binary Proxy Execution InstallUtil](/stories/signed_binary_proxy_execution_installutil)
+
+
 #### Kill Chain Phase
 * Exploitation
 * Privilege Escalation
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
index 04e7cc9a34..1d7efb8ccc 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
@@ -81,6 +81,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators may leverage DCOM to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md
index f023d116f6..31c362d421 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md
@@ -70,6 +70,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators may leverage DCOM to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
index f694398ec8..650a366015 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
@@ -77,6 +77,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators may leverage WWMI and powershell.exe to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md
index 8e9697bb9f..49dd9cba40 100644
--- a/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md
+++ b/docs/_posts/2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md
@@ -66,6 +66,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators may leverage WWMI and powershell.exe to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-15-sdelete_application_execution.md b/docs/_posts/2021-11-15-sdelete_application_execution.md
index b7fa69bbe0..3f17310abb 100644
--- a/docs/_posts/2021-11-15-sdelete_application_execution.md
+++ b/docs/_posts/2021-11-15-sdelete_application_execution.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited, filter as needed.
 
+#### Associated Analytic story
+* [Information Sabotage](/stories/information_sabotage)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md
index 16dbd729d0..e45248901a 100644
--- a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md
+++ b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md
@@ -76,6 +76,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 It is possible false positives may be present based on the internal name dcinst.exe, filter as needed. It may be worthy to alert on the service name.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md b/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md
index 19dc3c8403..41ed212657 100644
--- a/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md
+++ b/docs/_posts/2021-11-16-high_frequency_copy_of_files_in_network_share.md
@@ -74,6 +74,10 @@ o successfully implement this search, you need to be ingesting Windows Security
 #### Known False Positives
 this behavior may seen in normal transfer of file within network if network share is common place for sharing documents.
 
+#### Associated Analytic story
+* [Information Sabotage](/stories/information_sabotage)
+
+
 #### Kill Chain Phase
 * Exfiltration
 
diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
index e9815dca41..af40fbb3a6 100644
--- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
+++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
@@ -81,6 +81,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrators may leverage WinRM and `Invoke-Command` to start a process on remote systems for system administration or automation use cases. However, this activity is usually limited to a small set of hosts or users.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md
index 9e46e88859..1bcf227830 100644
--- a/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md
+++ b/docs/_posts/2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md
@@ -70,6 +70,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators may leverage WinRM and `Invoke-Command` to start a process on remote systems for system administration or automation use cases. This activity is usually limited to a small set of hosts or users. In certain environments, tuning may not be possible.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-17-windows_dism_remove_defender.md b/docs/_posts/2021-11-17-windows_dism_remove_defender.md
index f6f1d98bbf..8e77df5f17 100644
--- a/docs/_posts/2021-11-17-windows_dism_remove_defender.md
+++ b/docs/_posts/2021-11-17-windows_dism_remove_defender.md
@@ -80,6 +80,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Some legitimate administrative tools leverage `dism.exe` to manipulate packages and features of the operating system. Filter as needed.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
index 2da588a047..b605ebb24c 100644
--- a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
+++ b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
@@ -75,6 +75,11 @@ To successfully implement this search, you need to be ingesting Windows Security
 #### Known False Positives
 System Administrators may use looks like PsExec for troubleshooting or administrations tasks. However, this will typically come only from certain users and certain systems that can be added to an allow list.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+* [Trickbot](/stories/trickbot)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-18-interactive_session_on_remote_endpoint_with_powershell.md b/docs/_posts/2021-11-18-interactive_session_on_remote_endpoint_with_powershell.md
index e1f0222d70..ad920c5640 100644
--- a/docs/_posts/2021-11-18-interactive_session_on_remote_endpoint_with_powershell.md
+++ b/docs/_posts/2021-11-18-interactive_session_on_remote_endpoint_with_powershell.md
@@ -69,6 +69,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 Administrators may leverage WinRM and `Enter-PSSession` for administrative and troubleshooting tasks. This activity is usually limited to a small set of hosts or users. In certain environments, tuning may not be possible.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
index 03cad349a3..ee29a20b83 100644
--- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
+++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
@@ -79,6 +79,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited, however it is possible to filter by Processes.process_name and specific processes (ex. wscript.exe). Filter as needed. This may need modification based on EDR telemetry and how it brings in registry data. For example, removal of (Default).
 
+#### Associated Analytic story
+* [Remcos](/stories/remcos)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md
index 4eed840474..490823f2f9 100644
--- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md
+++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md
@@ -77,6 +77,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 This commandline can be used by a network administrator to audit host machine specifications. Thus, a filter is needed.
 
+#### Associated Analytic story
+* [Remcos](/stories/remcos)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 
diff --git a/docs/_posts/2021-11-22-anomalous_usage_of_archive_tools.md b/docs/_posts/2021-11-22-anomalous_usage_of_archive_tools.md
index 4f5944a01f..19f5b47965 100644
--- a/docs/_posts/2021-11-22-anomalous_usage_of_archive_tools.md
+++ b/docs/_posts/2021-11-22-anomalous_usage_of_archive_tools.md
@@ -73,6 +73,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives can be ligitmate usage of archive tools from the command line.
 
+#### Associated Analytic story
+* [Cobalt Strike](/stories/cobalt_strike)
+* [NOBELIUM Group](/stories/nobelium_group)
+
+
 #### Kill Chain Phase
 * Actions on Objective
 
diff --git a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md
index 484de028c9..1c0e8720c5 100644
--- a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md
+++ b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md
@@ -80,6 +80,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 False positive is quite limited. Filter is needed
 
+#### Associated Analytic story
+* [Remcos](/stories/remcos)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
index 0f96ad7e07..f9bbabd63d 100644
--- a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
@@ -82,6 +82,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Legitimate applications may trigger this behavior, filter as needed.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
index bf67f1c7be..82c11e57f5 100644
--- a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
@@ -84,6 +84,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Legitimate applications may trigger this behavior, filter as needed.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md
index c7e954a989..2634f0736c 100644
--- a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md
+++ b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md
@@ -72,6 +72,11 @@ To successfully implement this search, you need to be ingesting logs with the Se
 #### Known False Positives
 Legitimate applications may install services with uncommon services paths.
 
+#### Associated Analytic story
+* [Clop Ransomware](/stories/clop_ransomware)
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 * Lateral Movement
diff --git a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md
index 976ce2235e..f62d5b2e57 100644
--- a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md
+++ b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md
@@ -74,6 +74,10 @@ To successfully implement this search, you need to be ingesting logs with the Se
 #### Known False Positives
 Legitimate applications may install services with uncommon services paths.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
index 39df0f3eaf..0efbc2f49d 100644
--- a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
@@ -76,6 +76,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Legitimate applications may trigger this behavior, filter as needed.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
index ebe504352b..b0ebd18967 100644
--- a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
@@ -80,6 +80,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Legitimate applications may trigger this behavior, filter as needed.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
index af71f126a7..6440895765 100644
--- a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
@@ -80,6 +80,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Legitimate applications may trigger this behavior, filter as needed.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-11-24-attempt_to_delete_services.md b/docs/_posts/2021-11-24-attempt_to_delete_services.md
index ae067e66de..9302887f2d 100644
--- a/docs/_posts/2021-11-24-attempt_to_delete_services.md
+++ b/docs/_posts/2021-11-24-attempt_to_delete_services.md
@@ -78,6 +78,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 It is possible administrative scripts may start/stop/delete services. Filter as needed.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-24-attempt_to_disable_services.md b/docs/_posts/2021-11-24-attempt_to_disable_services.md
index f4f6e4e736..fad2f00ae8 100644
--- a/docs/_posts/2021-11-24-attempt_to_disable_services.md
+++ b/docs/_posts/2021-11-24-attempt_to_disable_services.md
@@ -68,6 +68,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 It is possible administrative scripts may start/stop/delete services. Filter as needed.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md
index 67d1d8e664..265396e9d5 100644
--- a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md
+++ b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md
@@ -80,6 +80,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Admin or user may choose to use this windows features. Filter as needed.
 
+#### Associated Analytic story
+* [Remcos](/stories/remcos)
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md
index b4d8260afc..969349fd4d 100644
--- a/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md
+++ b/docs/_posts/2021-11-25-powershell_windows_defender_exclusion_commands.md
@@ -72,6 +72,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 admin or user may choose to use this windows features.
 
+#### Associated Analytic story
+* [Remcos](/stories/remcos)
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md b/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md
index 02891ef519..516edaa1f9 100644
--- a/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md
+++ b/docs/_posts/2021-11-25-windows_defender_exclusion_registry_entry.md
@@ -79,6 +79,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 admin or user may choose to use this windows features.
 
+#### Associated Analytic story
+* [Remcos](/stories/remcos)
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-29-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-11-29-attempted_credential_dump_from_registry_via_reg_exe.md
index 2644d70f3d..9b79654157 100644
--- a/docs/_posts/2021-11-29-attempted_credential_dump_from_registry_via_reg_exe.md
+++ b/docs/_posts/2021-11-29-attempted_credential_dump_from_registry_via_reg_exe.md
@@ -72,6 +72,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 None identified.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-11-29-deny_permission_using_cacls_utility.md b/docs/_posts/2021-11-29-deny_permission_using_cacls_utility.md
index c63bcd258b..457cc07576 100644
--- a/docs/_posts/2021-11-29-deny_permission_using_cacls_utility.md
+++ b/docs/_posts/2021-11-29-deny_permission_using_cacls_utility.md
@@ -68,6 +68,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 System administrators may use cacls utilities but this is not a common practice. Filter as needed.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-29-detect_dump_lsass_memory_using_comsvcs.md b/docs/_posts/2021-11-29-detect_dump_lsass_memory_using_comsvcs.md
index 825fde23dd..a339aa5d9e 100644
--- a/docs/_posts/2021-11-29-detect_dump_lsass_memory_using_comsvcs.md
+++ b/docs/_posts/2021-11-29-detect_dump_lsass_memory_using_comsvcs.md
@@ -69,6 +69,10 @@ You must be ingesting endpoint data that tracks process activity, including Wind
 #### Known False Positives
 False positives should be limited, filter as needed.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
index 5adf251bb4..76cdac2964 100644
--- a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
+++ b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
@@ -74,6 +74,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited as this is restricted to the Rclone process name. Filter or tune the analytic as needed.
 
+#### Associated Analytic story
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exfiltration
 
diff --git a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
index 8a413f49c0..86e05f4201 100644
--- a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
+++ b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
@@ -103,6 +103,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Legitimate applications may spawn PowerShell as a child process of the the identified processes. Filter as needed.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+* [Malicious PowerShell](/stories/malicious_powershell)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 * Malicious PowerShell
diff --git a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md
index d6f0460fe1..e164fa1163 100644
--- a/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md
+++ b/docs/_posts/2021-11-29-randomly_generated_scheduled_task_name.md
@@ -77,6 +77,10 @@ To successfully implement this search, you need to be ingesting Windows Security
 #### Known False Positives
 Legitimate applications may use random Scheduled Task names.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 * Lateral Movement
diff --git a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md
index 28187f8fa3..5ba0161e69 100644
--- a/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md
+++ b/docs/_posts/2021-11-29-randomly_generated_windows_service_name.md
@@ -76,6 +76,10 @@ To successfully implement this search, you need to be ingesting logs with the Se
 #### Known False Positives
 Legitimate applications may use random Windows Service names.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 * Lateral Movement
diff --git a/docs/_posts/2021-11-30-delete_a_net_user.md b/docs/_posts/2021-11-30-delete_a_net_user.md
index a457119fef..6421067430 100644
--- a/docs/_posts/2021-11-30-delete_a_net_user.md
+++ b/docs/_posts/2021-11-30-delete_a_net_user.md
@@ -68,6 +68,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 System administrators or scripts may delete user accounts via this technique. Filter as needed.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-30-disable_net_user_account.md b/docs/_posts/2021-11-30-disable_net_user_account.md
index 12b552e8a2..d1e27763ef 100644
--- a/docs/_posts/2021-11-30-disable_net_user_account.md
+++ b/docs/_posts/2021-11-30-disable_net_user_account.md
@@ -75,6 +75,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 System administrators or automated scripts may disable an account but not a common practice. Filter as needed.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-30-first_time_seen_command_line_argument.md b/docs/_posts/2021-11-30-first_time_seen_command_line_argument.md
index 13a916b385..4176a5a754 100644
--- a/docs/_posts/2021-11-30-first_time_seen_command_line_argument.md
+++ b/docs/_posts/2021-11-30-first_time_seen_command_line_argument.md
@@ -78,6 +78,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Legitimate programs use command-line arguments to execute. Verify the command-line arguments to check what command/program is being executed. Filtering will be needed.
 
+#### Associated Analytic story
+* [Unusual Processes](/stories/unusual_processes)
+
+
 #### Kill Chain Phase
 * Command and Control
 * Actions on Objectives
diff --git a/docs/_posts/2021-11-30-grant_permission_using_cacls_utility.md b/docs/_posts/2021-11-30-grant_permission_using_cacls_utility.md
index dead39ccd1..b7ee185816 100644
--- a/docs/_posts/2021-11-30-grant_permission_using_cacls_utility.md
+++ b/docs/_posts/2021-11-30-grant_permission_using_cacls_utility.md
@@ -68,6 +68,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 System administrators may use cacls utilities but this is not a common practice. Filter as needed.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-30-modify_acls_permission_of_files_or_folders.md b/docs/_posts/2021-11-30-modify_acls_permission_of_files_or_folders.md
index 1cc2330c41..140d48235c 100644
--- a/docs/_posts/2021-11-30-modify_acls_permission_of_files_or_folders.md
+++ b/docs/_posts/2021-11-30-modify_acls_permission_of_files_or_folders.md
@@ -68,6 +68,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 System administrators may use this windows utility. filter is needed.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-30-potential_pass_the_token_or_hash_observed_at_the_destination_device.md b/docs/_posts/2021-11-30-potential_pass_the_token_or_hash_observed_at_the_destination_device.md
index 11503231ac..ec50ffb429 100644
--- a/docs/_posts/2021-11-30-potential_pass_the_token_or_hash_observed_at_the_destination_device.md
+++ b/docs/_posts/2021-11-30-potential_pass_the_token_or_hash_observed_at_the_destination_device.md
@@ -82,6 +82,10 @@ You must be ingesting Windows Security logs from endpoint devices, i.e., destina
 #### Known False Positives
 Environments in which NTLM is used extremely rarely and for benign purposes (such as a rare use of SMB shares).
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-11-30-rare_parent-child_process_relationship.md b/docs/_posts/2021-11-30-rare_parent-child_process_relationship.md
index 0bfaaeb35f..984825bc9c 100644
--- a/docs/_posts/2021-11-30-rare_parent-child_process_relationship.md
+++ b/docs/_posts/2021-11-30-rare_parent-child_process_relationship.md
@@ -91,6 +91,10 @@ Collect endpoint data such as sysmon or 4688 events.
 #### Known False Positives
 Some custom tools used by administrators could be used rarely to launch remotely applications. This might trigger false positives at the beginning when it has not collected yet enough data to construct the baseline.
 
+#### Associated Analytic story
+* [Unusual Processes](/stories/unusual_processes)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-11-30-resize_shadowstorage_volume.md b/docs/_posts/2021-11-30-resize_shadowstorage_volume.md
index 769c0ebf06..799464a3c7 100644
--- a/docs/_posts/2021-11-30-resize_shadowstorage_volume.md
+++ b/docs/_posts/2021-11-30-resize_shadowstorage_volume.md
@@ -68,6 +68,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 System administrators may resize the shadowstorage for valid purposes. Filter as needed.
 
+#### Associated Analytic story
+* [Clop Ransomware](/stories/clop_ransomware)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md
index bcf836eee4..8dc2c055f3 100644
--- a/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md
+++ b/docs/_posts/2021-12-01-unusual_number_of_computer_service_tickets_requested.md
@@ -76,6 +76,10 @@ To successfully implement this search, you need to be ingesting Domain Controlle
 #### Known False Positives
 An single endpoint requesting a large number of computer service tickets is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, administration systeams and missconfigured systems.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 * Exploitation
diff --git a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md
index aff624f962..e700f17467 100644
--- a/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md
+++ b/docs/_posts/2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md
@@ -77,6 +77,10 @@ To successfully implement this search, you need to be ingesting Windows Event Lo
 #### Known False Positives
 An single endpoint authenticating to a large number of hosts is not common behavior. Possible false positive scenarios include but are not limited to vulnerability scanners, jump servers and missconfigured systems.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 * Lateral Movement
diff --git a/docs/_posts/2021-12-03-detect_rclone_command-line_usage.md b/docs/_posts/2021-12-03-detect_rclone_command-line_usage.md
index f43941ff92..6b89f0a352 100644
--- a/docs/_posts/2021-12-03-detect_rclone_command-line_usage.md
+++ b/docs/_posts/2021-12-03-detect_rclone_command-line_usage.md
@@ -70,6 +70,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited as this is restricted to the Rclone process name. Filter or tune the analytic as needed.
 
+#### Associated Analytic story
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exfiltration
 
diff --git a/docs/_posts/2021-12-03-short_lived_scheduled_task.md b/docs/_posts/2021-12-03-short_lived_scheduled_task.md
index b9013da028..2aa8452b36 100644
--- a/docs/_posts/2021-12-03-short_lived_scheduled_task.md
+++ b/docs/_posts/2021-12-03-short_lived_scheduled_task.md
@@ -72,6 +72,10 @@ To successfully implement this search, you need to be ingesting Windows Security
 #### Known False Positives
 Although uncommon, legitimate applications may create and delete a Scheduled Task within 30 seconds. Filter as needed.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2021-12-03-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-12-03-windows_curl_upload_to_remote_destination.md
index 7917f87231..df2b4494c1 100644
--- a/docs/_posts/2021-12-03-windows_curl_upload_to_remote_destination.md
+++ b/docs/_posts/2021-12-03-windows_curl_upload_to_remote_destination.md
@@ -76,6 +76,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives may be limited to source control applications and may be required to be filtered out.
 
+#### Associated Analytic story
+* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
+
+
 #### Kill Chain Phase
 * Exfiltration
 
diff --git a/docs/_posts/2021-12-07-anomalous_usage_of_account_credentials.md b/docs/_posts/2021-12-07-anomalous_usage_of_account_credentials.md
index 77e1f46de6..92781e721f 100644
--- a/docs/_posts/2021-12-07-anomalous_usage_of_account_credentials.md
+++ b/docs/_posts/2021-12-07-anomalous_usage_of_account_credentials.md
@@ -71,6 +71,10 @@ To successfully implement this detection, you need to be ingesting logon events
 #### Known False Positives
 Shared workstations can cause false positives
 
+#### Associated Analytic story
+* [Insider Threat](/stories/insider_threat)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 * Lateral Movement
diff --git a/docs/_posts/2021-12-07-bcdedit_failure_recovery_modification.md b/docs/_posts/2021-12-07-bcdedit_failure_recovery_modification.md
index df34edacf3..45f5ad0ac5 100644
--- a/docs/_posts/2021-12-07-bcdedit_failure_recovery_modification.md
+++ b/docs/_posts/2021-12-07-bcdedit_failure_recovery_modification.md
@@ -68,6 +68,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators may modify the boot configuration.
 
+#### Associated Analytic story
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2021-12-07-dns_exfiltration_using_nslookup_app.md b/docs/_posts/2021-12-07-dns_exfiltration_using_nslookup_app.md
index 8a1029620a..dc6f05edf9 100644
--- a/docs/_posts/2021-12-07-dns_exfiltration_using_nslookup_app.md
+++ b/docs/_posts/2021-12-07-dns_exfiltration_using_nslookup_app.md
@@ -70,6 +70,13 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 It is possible for some legitimate administrative utilities to use similar cmd_line parameters. Filter as needed.
 
+#### Associated Analytic story
+* [Suspicious DNS Traffic](/stories/suspicious_dns_traffic)
+* [Dynamic DNS](/stories/dynamic_dns)
+* [Command and Control](/stories/command_and_control)
+* [Data Exfiltration](/stories/data_exfiltration)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-07-excessive_number_of_office_files_copied.md b/docs/_posts/2021-12-07-excessive_number_of_office_files_copied.md
index c21e2213d8..d737cce0e2 100644
--- a/docs/_posts/2021-12-07-excessive_number_of_office_files_copied.md
+++ b/docs/_posts/2021-12-07-excessive_number_of_office_files_copied.md
@@ -71,6 +71,9 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 user may copy a lot of office fies from one folder to another
 
+#### Associated Analytic story
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-07-fsutil_zeroing_file.md b/docs/_posts/2021-12-07-fsutil_zeroing_file.md
index 1445eb5043..9d4f64b89a 100644
--- a/docs/_posts/2021-12-07-fsutil_zeroing_file.md
+++ b/docs/_posts/2021-12-07-fsutil_zeroing_file.md
@@ -68,6 +68,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 System administrators or scripts may delete user accounts via this technique. Filter as needed.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-07-high_file_deletion_frequency.md b/docs/_posts/2021-12-07-high_file_deletion_frequency.md
index f8b4ffc149..af592b6d9c 100644
--- a/docs/_posts/2021-12-07-high_file_deletion_frequency.md
+++ b/docs/_posts/2021-12-07-high_file_deletion_frequency.md
@@ -71,6 +71,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 user may delete bunch of pictures or files in a folder.
 
+#### Associated Analytic story
+* [Clop Ransomware](/stories/clop_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-07-microsoft_exchange_mailbox_replication_service_writing_active_server_pages.md b/docs/_posts/2021-12-07-microsoft_exchange_mailbox_replication_service_writing_active_server_pages.md
index bf1788ee6f..685850030a 100644
--- a/docs/_posts/2021-12-07-microsoft_exchange_mailbox_replication_service_writing_active_server_pages.md
+++ b/docs/_posts/2021-12-07-microsoft_exchange_mailbox_replication_service_writing_active_server_pages.md
@@ -88,6 +88,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product.
 
+#### Associated Analytic story
+* [ProxyShell](/stories/proxyshell)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-07-wbadmin_delete_system_backups.md b/docs/_posts/2021-12-07-wbadmin_delete_system_backups.md
index 158187a82e..c938228e12 100644
--- a/docs/_posts/2021-12-07-wbadmin_delete_system_backups.md
+++ b/docs/_posts/2021-12-07-wbadmin_delete_system_backups.md
@@ -68,6 +68,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrators may modify the boot configuration.
 
+#### Associated Analytic story
+* [Ryuk Ransomware](/stories/ryuk_ransomware)
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md
index 044a1c38dd..71de4d0d45 100644
--- a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md
+++ b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md
@@ -76,6 +76,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited, however filter as needed.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-08-disable_defender_antivirus_registry.md b/docs/_posts/2021-12-08-disable_defender_antivirus_registry.md
index 74231a5f60..e6a93e9ad7 100644
--- a/docs/_posts/2021-12-08-disable_defender_antivirus_registry.md
+++ b/docs/_posts/2021-12-08-disable_defender_antivirus_registry.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs with the re
 #### Known False Positives
 Admin or user may choose to disable windows defender product
 
+#### Associated Analytic story
+* [IceID](/stories/iceid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
index 40afbb3942..fd7f8bf0f0 100644
--- a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
+++ b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
@@ -82,6 +82,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 It is possible some Administrative utilities will load msi.dll outside of normal system paths, filter as needed.
 
+#### Associated Analytic story
+* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md
index 2a9bc5fdc3..c94eb70ab9 100644
--- a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md
+++ b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md
@@ -77,6 +77,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 False positives should be limited, however filtering may be required.
 
+#### Associated Analytic story
+* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
+* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md
index 70708a7591..c851860a38 100644
--- a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md
+++ b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md
@@ -77,6 +77,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 False positives should be limited, however filtering may be required.
 
+#### Associated Analytic story
+* [Ingress Tool Transfer](/stories/ingress_tool_transfer)
+* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md
index c1c63fc62d..5ece6f277d 100644
--- a/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md
+++ b/docs/_posts/2021-12-13-detect_outbound_ldap_traffic.md
@@ -73,6 +73,10 @@ You must be ingesting Zeek DNS and Zeek Conn data into Splunk. Zeek data should
 #### Known False Positives
 Unknown at this moment. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. Please check those servers to verify if the activity is legitimate.
 
+#### Associated Analytic story
+* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
+
+
 #### Kill Chain Phase
 * Command and Control
 * Actions on Objectives
diff --git a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md
index fd3abfd0c4..7183d921ee 100644
--- a/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md
+++ b/docs/_posts/2021-12-13-java_class_file_download_by_java_user_agent.md
@@ -71,6 +71,10 @@ To successfully implement this search, you need to be ingesting web or proxy log
 #### Known False Positives
 Filtering may be required in some instances, filter as needed.
 
+#### Associated Analytic story
+* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-13-linux_java_spawning_shell.md b/docs/_posts/2021-12-13-linux_java_spawning_shell.md
index b7726d9ad6..50fbcfd330 100644
--- a/docs/_posts/2021-12-13-linux_java_spawning_shell.md
+++ b/docs/_posts/2021-12-13-linux_java_spawning_shell.md
@@ -78,6 +78,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Filtering may be required on internal developer build systems or classify assets as web facing and restrict the analytic based on asset type.
 
+#### Associated Analytic story
+* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md
index f1f2ca57b1..e24ae67179 100644
--- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md
+++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_attempt.md
@@ -80,6 +80,10 @@ This detection requires the Web datamodel to be populated from a supported Techn
 #### Known False Positives
 If there is a vulnerablility scannner looking for log4shells this will trigger, otherwise likely to have low false positives.
 
+#### Associated Analytic story
+* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
+
+
 #### Kill Chain Phase
 * Reconnaissance
 * Exploitation
diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
index e5fd647f8e..974244c92d 100644
--- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
+++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
@@ -89,6 +89,10 @@ This detection requires the Web datamodel to be populated from a supported Techn
 #### Known False Positives
 If there is a vulnerablility scannner looking for log4shells this will trigger, otherwise likely to have low false positives.
 
+#### Associated Analytic story
+* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md
index 9d7773f4e6..10b60d8dde 100644
--- a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md
+++ b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md
@@ -79,6 +79,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Legitimate Java applications may use perform outbound connections to these ports. Filter as needed
 
+#### Associated Analytic story
+* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md
index 8309693947..0cb9f72e70 100644
--- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md
+++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md
@@ -80,6 +80,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Filtering may be required on internal developer build systems or classify assets as web facing and restrict the analytic based on that.
 
+#### Associated Analytic story
+* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-14-hunting_for_log4shell.md b/docs/_posts/2021-12-14-hunting_for_log4shell.md
index 2b9aaf1354..2803a88c41 100644
--- a/docs/_posts/2021-12-14-hunting_for_log4shell.md
+++ b/docs/_posts/2021-12-14-hunting_for_log4shell.md
@@ -194,6 +194,10 @@ Out of the box, the Web datamodel is required to be pre-filled. However, tested
 #### Known False Positives
 It is highly possible you will find false positives, however, the base score is set to 2 for _any_ jndi found in raw logs. tune and change as needed, include any filtering.
 
+#### Associated Analytic story
+* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md
index c2c89c4040..5152c627eb 100644
--- a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md
+++ b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md
@@ -78,6 +78,11 @@ To successfully implement this search, you need to be ingesting logs with the fi
 #### Known False Positives
 Administrator or network operator can create file in crontab folders for automation purposes. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md
index 5258bd977c..a3babaa500 100644
--- a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md
+++ b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md
@@ -78,6 +78,11 @@ To successfully implement this search, you need to be ingesting logs with the fi
 #### Known False Positives
 Administrator or network operator can create this file for automation purposes. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-17-linux_at_application_execution.md b/docs/_posts/2021-12-17-linux_at_application_execution.md
index 528875e390..67b8a675f7 100644
--- a/docs/_posts/2021-12-17-linux_at_application_execution.md
+++ b/docs/_posts/2021-12-17-linux_at_application_execution.md
@@ -80,6 +80,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md
index d0a1c340d8..339978e964 100644
--- a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md
+++ b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md
@@ -80,6 +80,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md b/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md
index 88507d092e..a60a50b51c 100644
--- a/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md
+++ b/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md
@@ -80,6 +80,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md
index fc1c288449..71526a77d8 100644
--- a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md
+++ b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md
@@ -80,6 +80,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md
index ccfee44fa4..e4f17d7539 100644
--- a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md
+++ b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md
@@ -80,6 +80,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-20-clear_unallocated_sector_using_cipher_app.md b/docs/_posts/2021-12-20-clear_unallocated_sector_using_cipher_app.md
index aeb1daf305..4793a21302 100644
--- a/docs/_posts/2021-12-20-clear_unallocated_sector_using_cipher_app.md
+++ b/docs/_posts/2021-12-20-clear_unallocated_sector_using_cipher_app.md
@@ -76,6 +76,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 administrator may execute this app to manage disk
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+* [Information Sabotage](/stories/information_sabotage)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-20-hiding_files_and_directories_with_attrib_exe.md b/docs/_posts/2021-12-20-hiding_files_and_directories_with_attrib_exe.md
index b52be2de6e..d62effeb2c 100644
--- a/docs/_posts/2021-12-20-hiding_files_and_directories_with_attrib_exe.md
+++ b/docs/_posts/2021-12-20-hiding_files_and_directories_with_attrib_exe.md
@@ -65,6 +65,12 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 Some applications and users may legitimately use attrib.exe to interact with the files. 
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Information Sabotage](/stories/information_sabotage)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md
index 1abe911ed3..70ca9d5667 100644
--- a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md
+++ b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md
@@ -76,6 +76,11 @@ To successfully implement this search, you need to be ingesting logs with the fi
 #### Known False Positives
 Administrator or network operator can create file in this folders for automation purposes. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md
index 282c65f35e..3a31074eb1 100644
--- a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md
+++ b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md
@@ -76,6 +76,11 @@ To successfully implement this search, you need to be ingesting logs with the fi
 #### Known False Positives
 Administrator or network operator can create file in profile.d folders for automation purposes. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md
index 23c4b577d1..489b2c3aee 100644
--- a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md
+++ b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md
@@ -78,6 +78,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md
index 0eab742f91..b5e9a04920 100644
--- a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md
+++ b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md
@@ -78,6 +78,11 @@ To successfully implement this search, you need to be ingesting logs with the fi
 #### Known False Positives
 Administrator or network operator can create file in systemd folders for automation purposes. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-20-linux_service_restarted.md b/docs/_posts/2021-12-20-linux_service_restarted.md
index aa028400c5..d3f0e5daa0 100644
--- a/docs/_posts/2021-12-20-linux_service_restarted.md
+++ b/docs/_posts/2021-12-20-linux_service_restarted.md
@@ -80,6 +80,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md
index 398104fe14..f569401d66 100644
--- a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md
+++ b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md
@@ -80,6 +80,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md
index 94a0e66159..bc8b5448c2 100644
--- a/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md
+++ b/docs/_posts/2021-12-20-suspicious_computer_account_name_change.md
@@ -78,6 +78,10 @@ To successfully implement this search, you need to be ingesting Windows event lo
 #### Known False Positives
 Renaming a computer account name to a name that not end with &#39;$&#39; is highly unsual and may not have any legitimate scenarios.
 
+#### Associated Analytic story
+* [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md
index eb3367ff4d..d9971c5334 100644
--- a/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md
+++ b/docs/_posts/2021-12-20-suspicious_kerberos_service_ticket_request.md
@@ -80,6 +80,10 @@ To successfully implement this search, you need to be ingesting Domain Controlle
 #### Known False Positives
 We have tested this detection logic with ~2 million 4769 events and did not identify false positives. However, they may be possible in certain environments. Filter as needed.
 
+#### Associated Analytic story
+* [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-21-linux_add_user_account.md b/docs/_posts/2021-12-21-linux_add_user_account.md
index 45f689150f..f4e3ac46f6 100644
--- a/docs/_posts/2021-12-21-linux_add_user_account.md
+++ b/docs/_posts/2021-12-21-linux_add_user_account.md
@@ -76,6 +76,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md
index 0dff48962b..3d8943df40 100644
--- a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md
+++ b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md
@@ -76,6 +76,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md
index e2e15e4b28..f17c0891e8 100644
--- a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md
+++ b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md
@@ -78,6 +78,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md
index 653de10ac3..201372e990 100644
--- a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md
+++ b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md
@@ -78,6 +78,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md
index 48d7203a69..585594f569 100644
--- a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md
+++ b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md
@@ -78,6 +78,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md
index d08b453bd9..ce41fed013 100644
--- a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md
+++ b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md
@@ -78,6 +78,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md
index 447876db45..596365663c 100644
--- a/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md
+++ b/docs/_posts/2021-12-21-suspicious_ticket_granting_ticket_request.md
@@ -80,6 +80,10 @@ To successfully implement this search, you need to be ingesting Domain Controlle
 #### Known False Positives
 A computer account name change event inmediately followed by a kerberos TGT request with matching fields is unsual. However, legitimate behavior may trigger it. Filter as needed.
 
+#### Associated Analytic story
+* [sAMAccountName Spoofing and Domain Controller Impersonation](/stories/samaccountname_spoofing_and_domain_controller_impersonation)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md
index 51b605c196..0091309750 100644
--- a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md
+++ b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md
@@ -76,6 +76,11 @@ To successfully implement this search, you need to be ingesting logs with the fi
 #### Known False Positives
 Administrator or network operator can create file in this folders for automation purposes. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md
index cadc06c93f..cc743a6317 100644
--- a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md
+++ b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md
@@ -78,6 +78,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md
index d23ff2aa9e..354a4a0097 100644
--- a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md
+++ b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md
@@ -78,6 +78,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md
index 0c29f0a300..1c9c29e949 100644
--- a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md
+++ b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md
@@ -80,6 +80,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md
index bfc1c81175..118d20e4bd 100644
--- a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md
+++ b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md
@@ -78,6 +78,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md
index c7440a0e45..d7a906592f 100644
--- a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md
+++ b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md
@@ -76,6 +76,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md
index e350e631a2..f207019a9a 100644
--- a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md
+++ b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md
@@ -78,6 +78,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md
index 8165e2e463..2d4edd907c 100644
--- a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md
+++ b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md
@@ -76,6 +76,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2022-01-05-linux_doas_tool_execution.md b/docs/_posts/2022-01-05-linux_doas_tool_execution.md
index 3c45b43911..a2e7aad807 100644
--- a/docs/_posts/2022-01-05-linux_doas_tool_execution.md
+++ b/docs/_posts/2022-01-05-linux_doas_tool_execution.md
@@ -78,6 +78,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md
index cc117215d2..7f6f7490d2 100644
--- a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md
+++ b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md
@@ -76,6 +76,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md
index 15dcc62695..bf9dcbd7b4 100644
--- a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md
+++ b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md
@@ -78,6 +78,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 administrator or network operator can execute this command. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md
index f413350326..68c2684609 100644
--- a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md
+++ b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md
@@ -76,6 +76,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md
index 2376eeec42..3f204e6358 100644
--- a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md
+++ b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md
@@ -74,6 +74,11 @@ To successfully implement this search, you need to be ingesting logs with the fi
 #### Known False Positives
 Administrator or network operator can create file in ~/.ssh folders for automation purposes. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+* [Linux Persistence Techniques](/stories/linux_persistence_techniques)
+
+
 #### Kill Chain Phase
 * Privilege Escalation
 
diff --git a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md
index c20e6485d4..d2132781db 100644
--- a/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md
+++ b/docs/_posts/2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md
@@ -81,6 +81,13 @@ You must be ingesting data that records process activity from your hosts to popu
 #### Known False Positives
 Legitimate process can have this combination of command-line options, but it&#39;s not common.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+* [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns)
+* [HAFNIUM Group](/stories/hafnium_group)
+* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
+
+
 #### Kill Chain Phase
 * Command and Control
 * Actions on Objectives
diff --git a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
index b7a8723dbf..45bcd24b33 100644
--- a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
+++ b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
@@ -75,6 +75,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 False positives will occur based on GrantedAccess and SourceUser, filter based on source image as needed.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
index d9f95580ac..fa3994bf8b 100644
--- a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
+++ b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
@@ -75,6 +75,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 False positives will occur based on legitimate application requests, filter based on source image as needed.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
index 9c4d5125f9..397fd6e0a5 100644
--- a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
+++ b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
@@ -78,6 +78,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 This model is an anomaly detector that identifies usage of APIs and scripting constructs that are correllated with malicious activity.  These APIs and scripting constructs are part of the programming langauge and advanced scripts may generate false positives.
 
+#### Associated Analytic story
+* [Suspicious Command-Line Executions](/stories/suspicious_command-line_executions)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
index 351fb562ff..a891f74f40 100644
--- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
+++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
@@ -80,6 +80,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives may be high based on legitimate scripted code in any environment. Filter as needed.
 
+#### Associated Analytic story
+* [IcedID](/stories/icedid)
+* [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md
index e6e030637a..f97c07a952 100644
--- a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md
+++ b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md
@@ -93,6 +93,11 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Although uncommon, Administrators may leverage Impackets tools to start a process on remote systems for system administration or automation use cases.
 
+#### Associated Analytic story
+* [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Lateral Movement
 
diff --git a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md
index 44ccb02fe1..a3a7cb6c84 100644
--- a/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md
+++ b/docs/_posts/2022-01-18-malicious_powershell_process_-_encoded_command.md
@@ -80,6 +80,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 System administrators may use this option, but it&#39;s not common.
 
+#### Associated Analytic story
+* [Malicious PowerShell](/stories/malicious_powershell)
+* [NOBELIUM Group](/stories/nobelium_group)
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Command and Control
 * Actions on Objectives
diff --git a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
index 2b06a9469c..c700b9ca00 100644
--- a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
+++ b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
@@ -74,6 +74,11 @@ This detection relies on sysmon logs with the Event ID 22, DNS Query. We suggest
 #### Known False Positives
 Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, a filter is needed.
 
+#### Associated Analytic story
+* [Remcos](/stories/remcos)
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md
index ddaa5127ea..7b91a5acff 100644
--- a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md
+++ b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md
@@ -75,6 +75,10 @@ his detection relies on sysmon logs with the Event ID 22, DNS Query.
 #### Known False Positives
 Noise and false positive can be seen if the following instant messaging is allowed to use within corporate network. In this case, a filter is needed.
 
+#### Associated Analytic story
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
index 33d79fa554..bf057bff01 100644
--- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
+++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
@@ -96,6 +96,14 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application in use.
 
+#### Associated Analytic story
+* [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities)
+* [Unusual Processes](/stories/unusual_processes)
+* [Ransomware](/stories/ransomware)
+* [Signed Binary Proxy Execution InstallUtil](/stories/signed_binary_proxy_execution_installutil)
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
index 573df6dd01..4b1368edc5 100644
--- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
+++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
@@ -89,6 +89,14 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives may be present and filtering may be required. Certain utilities will run from non-standard paths based on the third-party application in use.
 
+#### Associated Analytic story
+* [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities)
+* [Unusual Processes](/stories/unusual_processes)
+* [Ransomware](/stories/ransomware)
+* [Signed Binary Proxy Execution InstallUtil](/stories/signed_binary_proxy_execution_installutil)
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
index eca7d0f220..fc05fc993f 100644
--- a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
+++ b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
@@ -71,6 +71,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Windows Defender AV updates may cause this alert. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md
index f418b04252..029d6e3423 100644
--- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md
+++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md
@@ -83,6 +83,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 Administrator or network operator may execute this command. Please update the filter macros to remove false positives.
 
+#### Associated Analytic story
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-20-powershell_remove_windows_defender_directory.md b/docs/_posts/2022-01-20-powershell_remove_windows_defender_directory.md
index ba0de913dc..de45894194 100644
--- a/docs/_posts/2022-01-20-powershell_remove_windows_defender_directory.md
+++ b/docs/_posts/2022-01-20-powershell_remove_windows_defender_directory.md
@@ -72,6 +72,10 @@ To successfully implement this analytic, you will need to enable PowerShell Scri
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md
index 1e9c3e44ef..43706a9f76 100644
--- a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md
+++ b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md
@@ -76,6 +76,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives should be limited as it is specific to AdvancedRun. Filter as needed based on legitimate usage.
 
+#### Associated Analytic story
+* [Unusual Processes](/stories/unusual_processes)
+* [Ransomware](/stories/ransomware)
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
index fe518178eb..c961456605 100644
--- a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
+++ b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
@@ -83,6 +83,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 False positives may be present. Filtering may be required before setting to alert.
 
+#### Associated Analytic story
+* [WhisperGate](/stories/whispergate)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-26-active_setup_registry_autostart.md b/docs/_posts/2022-01-26-active_setup_registry_autostart.md
index 87a314b7ea..460bf6c2e2 100644
--- a/docs/_posts/2022-01-26-active_setup_registry_autostart.md
+++ b/docs/_posts/2022-01-26-active_setup_registry_autostart.md
@@ -80,6 +80,11 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 Active setup installer may add or modify this registry.
 
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md b/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md
index 9ca9671949..ca6a157521 100644
--- a/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md
+++ b/docs/_posts/2022-01-26-add_defaultuser_and_password_in_registry.md
@@ -77,6 +77,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [BlackMatter Ransomware](/stories/blackmatter_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md b/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md
index e0e8ca42e4..a7b15e6750 100644
--- a/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md
+++ b/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md
@@ -85,6 +85,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 network admin may add/remove/modify public inbound firewall rule that may cause this rule to be triggered.
 
+#### Associated Analytic story
+* [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md
index eb3d158aac..80f33518a0 100644
--- a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md
+++ b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md
@@ -74,6 +74,10 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-26-disable_amsi_through_registry.md b/docs/_posts/2022-01-26-disable_amsi_through_registry.md
index d7fa91f7ef..0621aa8625 100644
--- a/docs/_posts/2022-01-26-disable_amsi_through_registry.md
+++ b/docs/_posts/2022-01-26-disable_amsi_through_registry.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 network operator may disable this feature of windows but not so common.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md b/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md
index f38d88daba..65057953af 100644
--- a/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md
+++ b/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md
@@ -79,6 +79,10 @@ To successfully implement this search, you need to be ingesting logs with the re
 #### Known False Positives
 admin or user may choose to disable windows defender product
 
+#### Associated Analytic story
+* [IceID](/stories/iceid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md
index 4374479233..a09d6314d3 100644
--- a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md
+++ b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md
@@ -79,6 +79,10 @@ To successfully implement this search, you need to be ingesting logs with the re
 #### Known False Positives
 admin or user may choose to disable windows defender product
 
+#### Associated Analytic story
+* [IceID](/stories/iceid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md
index 391edcd454..c52614d3b8 100644
--- a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md
+++ b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md
@@ -79,6 +79,10 @@ To successfully implement this search, you need to be ingesting logs with the re
 #### Known False Positives
 user may choose to disable windows defender AV
 
+#### Associated Analytic story
+* [IceID](/stories/iceid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md b/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md
index 104801d0cf..b0a530f68a 100644
--- a/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md
+++ b/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md
@@ -79,6 +79,10 @@ To successfully implement this search, you need to be ingesting logs with the re
 #### Known False Positives
 admin or user may choose to disable windows defender product
 
+#### Associated Analytic story
+* [IceID](/stories/iceid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md
index 48a1494b99..e51092b463 100644
--- a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md
+++ b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md
@@ -79,6 +79,10 @@ To successfully implement this search, you need to be ingesting logs with the re
 #### Known False Positives
 admin or user may choose to disable windows defender product
 
+#### Associated Analytic story
+* [IceID](/stories/iceid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md
index 5d2784ce7d..f05592e28b 100644
--- a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md
+++ b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md
@@ -79,6 +79,10 @@ To successfully implement this search, you need to be ingesting logs with the re
 #### Known False Positives
 admin or user may choose to disable windows defender product
 
+#### Associated Analytic story
+* [IceID](/stories/iceid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md
index 50649cd82f..294978966c 100644
--- a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md
+++ b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md
@@ -79,6 +79,18 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 There are many legitimate applications that must execute on system startup and will use these registry keys to accomplish that task.
 
+#### Associated Analytic story
+* [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities)
+* [Suspicious MSHTA Activity](/stories/suspicious_mshta_activity)
+* [DHS Report TA18-074A](/stories/dhs_report_ta18-074a)
+* [Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns](/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns)
+* [Ransomware](/stories/ransomware)
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
+* [IcedID](/stories/icedid)
+* [Remcos](/stories/remcos)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md b/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md
index f548cc9cc6..7dfdde8d2f 100644
--- a/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md
+++ b/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md
@@ -78,6 +78,12 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 There are many legitimate applications that must execute upon system startup and will use these registry keys to accomplish that task.
 
+#### Associated Analytic story
+* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+* [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities)
+* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md b/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md
index 81e9293cc4..bfea23a4ad 100644
--- a/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md
+++ b/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md
@@ -74,6 +74,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Remcos](/stories/remcos)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md b/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md
index 4dca1bd853..e3efff97ef 100644
--- a/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md
+++ b/docs/_posts/2022-01-26-start_up_during_safe_mode_boot.md
@@ -79,6 +79,10 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 updated windows application needed in safe boot may used this registry
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-26-time_provider_persistence_registry.md b/docs/_posts/2022-01-26-time_provider_persistence_registry.md
index 3811717b17..0ca7694ccd 100644
--- a/docs/_posts/2022-01-26-time_provider_persistence_registry.md
+++ b/docs/_posts/2022-01-26-time_provider_persistence_registry.md
@@ -80,6 +80,11 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-27-disable_etw_through_registry.md b/docs/_posts/2022-01-27-disable_etw_through_registry.md
index 2b23c0c2a0..45cf120da4 100644
--- a/docs/_posts/2022-01-27-disable_etw_through_registry.md
+++ b/docs/_posts/2022-01-27-disable_etw_through_registry.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 network operator may disable this feature of windows but not so common.
 
+#### Associated Analytic story
+* [Ransomware](/stories/ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-27-disable_registry_tool.md b/docs/_posts/2022-01-27-disable_registry_tool.md
index 8e62752fc8..4ac46cd21e 100644
--- a/docs/_posts/2022-01-27-disable_registry_tool.md
+++ b/docs/_posts/2022-01-27-disable_registry_tool.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 admin may disable this application for non technical user.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md b/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md
index bfe7e9e796..016237d022 100644
--- a/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md
+++ b/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md
@@ -75,6 +75,10 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 Unknown.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-27-disable_show_hidden_files.md b/docs/_posts/2022-01-27-disable_show_hidden_files.md
index 3798d39cd9..4b7389618c 100644
--- a/docs/_posts/2022-01-27-disable_show_hidden_files.md
+++ b/docs/_posts/2022-01-27-disable_show_hidden_files.md
@@ -86,6 +86,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-27-disable_uac_remote_restriction.md b/docs/_posts/2022-01-27-disable_uac_remote_restriction.md
index feb3adb78e..faaf0f4fe8 100644
--- a/docs/_posts/2022-01-27-disable_uac_remote_restriction.md
+++ b/docs/_posts/2022-01-27-disable_uac_remote_restriction.md
@@ -81,6 +81,11 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 admin may set this policy for non-critical machine.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md b/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md
index 4e01953a8e..1cc4d3a015 100644
--- a/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md
+++ b/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md
@@ -77,6 +77,10 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md
index 066d88ff7b..136c3add9e 100644
--- a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md
+++ b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md
@@ -78,6 +78,12 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 admin or user may choose to disable this windows features.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Ransomware](/stories/ransomware)
+* [Revil Ransomware](/stories/revil_ransomware)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md b/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md
index 3ad2f8976c..3c6e276535 100644
--- a/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md
+++ b/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 admin or user may choose to disable this windows features.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-27-disabling_cmd_application.md b/docs/_posts/2022-01-27-disabling_cmd_application.md
index fc2cd727ec..73e7642282 100644
--- a/docs/_posts/2022-01-27-disabling_cmd_application.md
+++ b/docs/_posts/2022-01-27-disabling_cmd_application.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 admin may disable this application for non technical user.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-27-disabling_controlpanel.md b/docs/_posts/2022-01-27-disabling_controlpanel.md
index 54ca852a1c..52838b09fa 100644
--- a/docs/_posts/2022-01-27-disabling_controlpanel.md
+++ b/docs/_posts/2022-01-27-disabling_controlpanel.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 admin may disable this application for non technical user.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
index 9b69e0ec6f..26844d786a 100644
--- a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
+++ b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
@@ -79,6 +79,12 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 False positives will occur based on GrantedAccess 0x1010 and 0x1400, filter based on source image as needed or remove them. Concern is Cobalt Strike usage of Mimikatz will generate 0x1010 initially, but later be caught.
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+* [Detect Zerologon Attack](/stories/detect_zerologon_attack)
+* [DarkSide Ransomware](/stories/darkside_ransomware)
+
+
 #### Kill Chain Phase
 * Actions on Objectives
 
diff --git a/docs/_posts/2022-01-28-disabling_defender_services.md b/docs/_posts/2022-01-28-disabling_defender_services.md
index 01fd7d052f..f81b37212a 100644
--- a/docs/_posts/2022-01-28-disabling_defender_services.md
+++ b/docs/_posts/2022-01-28-disabling_defender_services.md
@@ -79,6 +79,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 admin or user may choose to disable windows defender product
 
+#### Associated Analytic story
+* [IceID](/stories/iceid)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md b/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md
index ccf1aab0b5..4358b4c47e 100644
--- a/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md
+++ b/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 admin may disable this application for non technical user.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-28-disabling_norun_windows_app.md b/docs/_posts/2022-01-28-disabling_norun_windows_app.md
index e7e6258985..6d80b7dc70 100644
--- a/docs/_posts/2022-01-28-disabling_norun_windows_app.md
+++ b/docs/_posts/2022-01-28-disabling_norun_windows_app.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 admin may disable this application for non technical user.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md b/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md
index 6da465c519..5e417a47c8 100644
--- a/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md
+++ b/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 in some cases admin can disable systemrestore on a machine.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-28-disabling_task_manager.md b/docs/_posts/2022-01-28-disabling_task_manager.md
index be5a04f4d8..e31d7f2223 100644
--- a/docs/_posts/2022-01-28-disabling_task_manager.md
+++ b/docs/_posts/2022-01-28-disabling_task_manager.md
@@ -78,6 +78,10 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 admin may disable this application for non technical user.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md b/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md
index 7b3c5a8e8e..fdc3707321 100644
--- a/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md
+++ b/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md
@@ -73,6 +73,10 @@ To successfully implement this search, you need to be ingesting logs with the pr
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md b/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md
index d92ad4605a..8f7d038d05 100644
--- a/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md
+++ b/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md
@@ -79,6 +79,10 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Credential Dumping](/stories/credential_dumping)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-28-etw_registry_disabled.md b/docs/_posts/2022-01-28-etw_registry_disabled.md
index 439b41469d..8748cce5b2 100644
--- a/docs/_posts/2022-01-28-etw_registry_disabled.md
+++ b/docs/_posts/2022-01-28-etw_registry_disabled.md
@@ -83,6 +83,11 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 unknown
 
+#### Associated Analytic story
+* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-28-eventvwr_uac_bypass.md b/docs/_posts/2022-01-28-eventvwr_uac_bypass.md
index 3068b0c631..2bde8515cf 100644
--- a/docs/_posts/2022-01-28-eventvwr_uac_bypass.md
+++ b/docs/_posts/2022-01-28-eventvwr_uac_bypass.md
@@ -80,6 +80,11 @@ To successfully implement this search you need to be ingesting information on pr
 #### Known False Positives
 Some false positives may be present and will need to be filtered.
 
+#### Associated Analytic story
+* [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [IcedID](/stories/icedid)
+
+
 #### Kill Chain Phase
 * Exploitation
 * Privilege Escalation
diff --git a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
index 1a0b512e57..9779d2edd5 100644
--- a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
+++ b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
@@ -77,6 +77,10 @@ To successfully implement this search, you must be ingesting data that records r
 #### Known False Positives
 Unknown. Filter as needed.
 
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md
index f8dd1479bd..70fec62f2d 100644
--- a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md
+++ b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md
@@ -78,6 +78,10 @@ Depending on the EDR product in use, there are multiple ways to &#34;null&#34; t
 #### Known False Positives
 False positives may be present, filter as needed.
 
+#### Associated Analytic story
+* [Linux Privilege Escalation](/stories/linux_privilege_escalation)
+
+
 #### Kill Chain Phase
 * Exploitation
 
diff --git a/docs/_posts/2021-01-26-o365_added_service_principal.md b/docs/_posts/2022-02-03-o365_added_service_principal.md
similarity index 92%
rename from docs/_posts/2021-01-26-o365_added_service_principal.md
rename to docs/_posts/2022-02-03-o365_added_service_principal.md
index c41e86e168..103f6f4c37 100644
--- a/docs/_posts/2021-01-26-o365_added_service_principal.md
+++ b/docs/_posts/2022-02-03-o365_added_service_principal.md
@@ -3,7 +3,7 @@ title: "O365 Added Service Principal"
 excerpt: "Cloud Account, Create Account"
 categories:
   - Cloud
-last_modified_at: 2021-01-26
+last_modified_at: 2022-02-03
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ This search detects the creation of a new Federation setting by alerting about a
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: 
-- **Last Updated**: 2021-01-26
+- **Last Updated**: 2022-02-03
 - **Author**: Rod Soto, Splunk
 - **ID**: 1668812a-6047-11eb-ae93-0242ac130002
 
@@ -44,8 +44,8 @@ This search detects the creation of a new Federation setting by alerting about a
 #### Search
 
 ```
-`o365_management_activity` Workload=AzureActiveDirectory signature="Add service principal credentials." 
-| stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue) as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress signature 
+`o365_management_activity` Workload=AzureActiveDirectory Operation="Add service principal credentials." 
+| stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue) as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress Operation 
 | `security_content_ctime(firstTime)`
 | `security_content_ctime(lastTime)` 
 | `o365_added_service_principal_filter`
@@ -75,6 +75,11 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365
 #### Known False Positives
 The creation of a new Federation is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider.
 
+#### Associated Analytic story
+* [Office 365 Detections](/stories/office_365_detections)
+* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
+
+
 #### Kill Chain Phase
 * Actions on Objective
 
diff --git a/docs/_posts/2021-07-19-o365_bypass_mfa_via_trusted_ip.md b/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md
similarity index 94%
rename from docs/_posts/2021-07-19-o365_bypass_mfa_via_trusted_ip.md
rename to docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md
index fb65e505ce..d8bd5c3b46 100644
--- a/docs/_posts/2021-07-19-o365_bypass_mfa_via_trusted_ip.md
+++ b/docs/_posts/2022-02-03-o365_bypass_mfa_via_trusted_ip.md
@@ -3,7 +3,7 @@ title: "O365 Bypass MFA via Trusted IP"
 excerpt: "Disable or Modify Cloud Firewall, Impair Defenses"
 categories:
   - Cloud
-last_modified_at: 2021-07-19
+last_modified_at: 2022-02-03
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: 
-- **Last Updated**: 2021-07-19
+- **Last Updated**: 2022-02-03
 - **Author**: Bhavin Patel, Splunk
 - **ID**: c783dd98-c703-4252-9e8a-f19d9f66949e
 
@@ -44,13 +44,13 @@ This search detects newly added IP addresses/CIDR blocks to the list of MFA Trus
 #### Search
 
 ```
-`o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy 
+`o365_management_activity` Operation="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy 
 | rex max_match=100 field=ModifiedProperties{}.NewValue "(?<ip_addresses_new_added>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" 
 | rex max_match=100 field=ModifiedProperties{}.OldValue "(?<ip_addresses_old>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" 
 | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") 
 | mvexpand ip_addresses_new_added 
 | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) 
-|stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature Workload vendor_account status user_id action 
+|stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added Operation Workload vendor_account status user_id action 
 | `security_content_ctime(firstTime)`
 | `security_content_ctime(lastTime)`
 | `o365_bypass_mfa_via_trusted_ip_filter`
@@ -82,6 +82,10 @@ You must install Splunk Microsoft Office 365 add-on. This search works with o365
 #### Known False Positives
 Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration.
 
+#### Associated Analytic story
+* [Office 365 Detections](/stories/office_365_detections)
+
+
 #### Kill Chain Phase
 * Actions on Objective
 
diff --git a/docs/_posts/2020-12-16-o365_disable_mfa.md b/docs/_posts/2022-02-03-o365_disable_mfa.md
similarity index 94%
rename from docs/_posts/2020-12-16-o365_disable_mfa.md
rename to docs/_posts/2022-02-03-o365_disable_mfa.md
index 5c0fda596f..37cc71ff03 100644
--- a/docs/_posts/2020-12-16-o365_disable_mfa.md
+++ b/docs/_posts/2022-02-03-o365_disable_mfa.md
@@ -3,7 +3,7 @@ title: "O365 Disable MFA"
 excerpt: "Modify Authentication Process"
 categories:
   - Cloud
-last_modified_at: 2020-12-16
+last_modified_at: 2022-02-03
 toc: true
 toc_label: ""
 tags:
@@ -28,7 +28,7 @@ This search detects when multi factor authentication has been disabled, what ent
 - **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
 - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: 
-- **Last Updated**: 2020-12-16
+- **Last Updated**: 2022-02-03
 - **Author**: Rod Soto, Splunk
 - **ID**: c783dd98-c703-4252-9e8a-f19d9f5c949e
 
@@ -43,7 +43,7 @@ This search detects when multi factor authentication has been disabled, what ent
 
 ```
 `o365_management_activity` Operation="Disable Strong Authentication." 
-| stats count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation user status signature dest ResultStatus 
+| stats count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation UserId ResultStatus 
 |`security_content_ctime(firstTime)` 
 |`security_content_ctime(lastTime)` 
 | `o365_disable_mfa_filter`
@@ -73,6 +73,10 @@ You must install splunk Microsoft Office 365 add-on. This search works with o365
 #### Known False Positives
 Unless it is a special case, it is uncommon to disable MFA or Strong Authentication
 
+#### Associated Analytic story
+* [Office 365 Detections](/stories/office_365_detections)
+
+
 #### Kill Chain Phase
 * Actions on Objective
 
diff --git a/docs/_stories/credential_dumping.md b/docs/_stories/credential_dumping.md
index 99b0828fa0..a3f454b5e4 100644
--- a/docs/_stories/credential_dumping.md
+++ b/docs/_stories/credential_dumping.md
@@ -35,8 +35,8 @@ The detection searches in this Analytic Story monitor access to the Local Securi
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
 | [Access LSASS Memory for Dump Creation](/endpoint/access_lsass_memory_for_dump_creation/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
-| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager) | TTP |
+| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Create Remote Thread into LSASS](/endpoint/create_remote_thread_into_lsass/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Creation of Shadow Copy](/endpoint/creation_of_shadow_copy/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Creation of Shadow Copy with wmic and powershell](/endpoint/creation_of_shadow_copy_with_wmic_and_powershell/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |

From 3340cc1ade2ebd02a83159facc0aece2fbe847b7 Mon Sep 17 00:00:00 2001
From: d1vious <josehelps@gmail.com>
Date: Mon, 7 Feb 2022 15:32:17 -0500
Subject: [PATCH 5/5] removing duplicate detection

---
 ...f_lolbas_executed_in_short_time_window.yml | 69 -------------------
 1 file changed, 69 deletions(-)
 delete mode 100644 detections/endpoint/ssa___unusual_number_of_lolbas_executed_in_short_time_window.yml

diff --git a/detections/endpoint/ssa___unusual_number_of_lolbas_executed_in_short_time_window.yml b/detections/endpoint/ssa___unusual_number_of_lolbas_executed_in_short_time_window.yml
deleted file mode 100644
index a8875ed776..0000000000
--- a/detections/endpoint/ssa___unusual_number_of_lolbas_executed_in_short_time_window.yml
+++ /dev/null
@@ -1,69 +0,0 @@
-name: Unusual number of LOLBAS executed in short time window
-id: 59c0dd70-169c-4900-9a1f-bfcf13302f93
-version: 3
-date: '2021-11-30'
-author: Ignacio Bermudez Corrales, Splunk
-type: Anomaly
-datamodel: []
-description: Living Off The Land Binaries, Scripts, and Libraries (LOLBAS) are native system tools that threat actors leverage to run discovery on a system, move laterally, or increase their privileges.
-  Common threat actor behavior is to run scripts that execute many of these tools together in a short time window to accomplish their objectives.
-  This detection looks for a high distinct count (outlier > 99% distribution) of these executables launched in a window of 300 seconds on a single device.
-  It is not uncommon for an administrator to use these tools for system management, it is unusual to see many of them leverage in short time windows unless done by a script.
-search: '| from read_ssa_enriched_events()
-  | eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), "string", null)), username=ucast(map_get(input_event, "dest_user_primary_artifact"), "string", null)
-  | where process_name=="regsvcs.exe" OR process_name=="ftp.exe" OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe" OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe"
-  OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe" OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe" OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe" OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe"
-  OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe" OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe" OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe" OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe" OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe" OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe" OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe" OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe"
-  OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe" OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe" OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe" OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe"
-  OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe" OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe" OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe"
-  OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe" OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe" OR process_name=="msconfig.exe"
-  | stats estdc(process_name) as lolbas_counter by device, process_name, username, span(timestamp, 300s)
-  | eval lolbas_counter=lolbas_counter*1.0
-  | rename window_end as timestamp
-  | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device" window=2419200000L
-  | where label AND quantile>0.99
-  | eval start_time = window_start, end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter", lolbas_counter, "quantile", quantile, "device", device, "process_name", process_name, "user", username])
-  | into write_ssa_detected_events();'
-how_to_implement: Collect endpoint data such as sysmon or 4688 events.
-known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS
-  applications, usually when this detection triggers as a false positive, it tends to be due to a administrative script leveraging these tools.'
-references:
-- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
-tags:
-  analytic_story:
-  - Unusual Processes
-  cis20:
-  - CIS 8
-  confidence: 50
-  context:
-  - source:endpoint
-  - stage: Defense Evasion
-  impact: 50
-  kill_chain_phases:
-  - Exploitation
-  message: A system process $process_name$ with commandline $cmd_line$ spawn iin short
-    period of time in host $dest_device_id$
-  mitre_attack_id:
-  - T1059
-  - T1053
-  nist:
-  - PR.PT
-  - DE.CM
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process Name
-    role:
-    - Others
-  product:
-  - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - _time
-  - process_name
-  risk_score: 25
-  risk_severity: low
-  security_domain: endpoint