From 7939d2fa83912c6aa431f9b94a4defdd6ebdfd5a Mon Sep 17 00:00:00 2001
From: Teoderick Contreras <tcontreras@splunk.com>
Date: Mon, 24 Feb 2025 11:52:22 +0100
Subject: [PATCH] headless_bee

---
 .../endpoint/any_powershell_downloadfile.yml  | 26 +++++------
 .../endpoint/detect_rare_executables.yml      |  2 +-
 detections/endpoint/detect_renamed_psexec.yml | 22 +++++-----
 detections/endpoint/detect_renamed_winrar.yml | 14 +++---
 ..._or_script_creation_in_suspicious_path.yml |  2 +-
 ...tables_or_script_creation_in_temp_path.yml |  2 +-
 ...file_permission_modification_via_chmod.yml | 16 +++----
 ..._auditd_nopasswd_entry_in_sudoers_file.yml | 10 ++---
 ...td_possible_access_to_credential_files.yml | 10 ++---
 ...auditd_possible_access_to_sudoers_file.yml | 10 ++---
 ...ux_auditd_preload_hijack_library_calls.yml | 10 ++---
 ...x_common_process_for_elevation_control.yml | 10 ++---
 ...x_file_creation_in_init_boot_directory.yml | 10 ++---
 .../linux_iptables_firewall_modification.yml  | 12 ++---
 .../linux_nopasswd_entry_in_sudoers_file.yml  | 14 +++---
 ...ux_possible_access_to_credential_files.yml | 10 ++---
 .../linux_possible_access_to_sudoers_file.yml | 14 +++---
 .../linux_preload_hijack_library_calls.yml    | 14 +++---
 .../linux_sudoers_tmp_file_creation.yml       | 14 +++---
 ...hell_process___execution_policy_bypass.yml | 14 +++---
 ...e_process_accessing_chrome_default_dir.yml |  2 +-
 ...fox_process_access_firefox_profile_dir.yml |  2 +-
 .../endpoint/powershell_4104_hunting.yml      | 24 +++++-----
 .../registry_keys_used_for_persistence.yml    |  2 +-
 .../remote_process_instantiation_via_wmi.yml  |  9 ++--
 ...eduled_task_deleted_or_created_via_cmd.yml | 44 +++++++++----------
 ...ious_regsvr32_register_suspicious_path.yml | 16 +++----
 ...s_scheduled_task_from_public_directory.yml | 28 ++++++------
 ...ss_token_manipulation_sedebugprivilege.yml |  2 +-
 .../windows_anonymous_pipe_activity.yml       |  2 +-
 ...windows_archive_collected_data_via_rar.yml | 10 ++---
 ...ssword_stores_chrome_localstate_access.yml |  2 +-
 ...ssword_stores_chrome_login_data_access.yml |  2 +-
 ...ndows_curl_download_to_suspicious_path.yml |  9 ++--
 ...uery_registry_browser_list_application.yml |  2 +-
 ...ws_replication_through_removable_media.yml |  9 ++--
 ...ws_service_creation_on_remote_endpoint.yml |  2 +-
 ..._service_creation_using_registry_entry.yml |  2 +-
 ...windows_snappybee_create_test_registry.yml |  2 +-
 .../windows_suspicious_process_file_path.yml  |  2 +-
 ...ows_svchost_exe_parent_process_anomaly.yml |  2 +-
 .../windows_unsigned_dll_side_loading.yml     |  7 +--
 ..._dll_side_loading_in_same_process_path.yml |  2 +-
 .../windows_unsigned_ms_dll_side_loading.yml  |  7 +--
 ...swow64_process_run_system32_executable.yml |  2 +-
 ..._scheduled_task_created_to_spawn_shell.yml | 26 +++++------
 ...eduled_task_created_within_public_path.yml | 36 +++++++--------
 .../detect_large_outbound_icmp_packets.yml    |  7 +--
 stories/china_nexus_threat_activity.yml       | 22 ++++++++++
 stories/nexus_apt_threat_activity.yml         | 21 ---------
 50 files changed, 274 insertions(+), 267 deletions(-)
 create mode 100644 stories/china_nexus_threat_activity.yml
 delete mode 100644 stories/nexus_apt_threat_activity.yml

diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml
index 65a6733058..ecde18edbe 100644
--- a/detections/endpoint/any_powershell_downloadfile.yml
+++ b/detections/endpoint/any_powershell_downloadfile.yml
@@ -1,7 +1,7 @@
 name: Any Powershell DownloadFile
 id: 1a93b7ea-7af7-11eb-adb5-acde48001122
-version: 11
-date: '2025-02-10'
+version: '12'
+date: '2025-02-24'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -71,18 +71,19 @@ rba:
     type: process_name
 tags:
   analytic_story:
-  - Data Destruction
   - Ingress Tool Transfer
-  - DarkCrystal RAT
-  - PXA Stealer
-  - Braodo Stealer
-  - Phemedrone Stealer
-  - Log4Shell CVE-2021-44228
-  - Malicious PowerShell
-  - Hermetic Wiper
+  - China-Nexus Threat Activity
   - Crypto Stealer
-  - Nexus APT Threat Activity
+  - Hermetic Wiper
+  - DarkCrystal RAT
+  - Malicious PowerShell
   - Earth Estries
+  - Phemedrone Stealer
+  - Braodo Stealer
+  - PXA Stealer
+  - Nexus APT Threat Activity
+  - Data Destruction
+  - Log4Shell CVE-2021-44228
   asset_type: Endpoint
   cve:
   - CVE-2021-44228
@@ -97,7 +98,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: XmlWinEventLog
diff --git a/detections/endpoint/detect_rare_executables.yml b/detections/endpoint/detect_rare_executables.yml
index 60255c6204..a19ca4ff86 100644
--- a/detections/endpoint/detect_rare_executables.yml
+++ b/detections/endpoint/detect_rare_executables.yml
@@ -60,7 +60,7 @@ tags:
   analytic_story:
   - SnappyBee
   - Rhysida Ransomware
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Crypto Stealer
   - Earth Estries
   - Unusual Processes
diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
index 27479f9d15..b182aba8d4 100644
--- a/detections/endpoint/detect_renamed_psexec.yml
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -1,7 +1,7 @@
 name: Detect Renamed PSExec
 id: 683e6196-b8e8-11eb-9a79-acde48001122
-version: 11
-date: '2025-02-10'
+version: '12'
+date: '2025-02-24'
 author: Michael Haag, Splunk, Alex Oberkircher, Github Community
 status: production
 type: Hunting
@@ -39,18 +39,19 @@ references:
 - https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/
 tags:
   analytic_story:
+  - China-Nexus Threat Activity
   - BlackByte Ransomware
-  - DHS Report TA18-074A
-  - DarkSide Ransomware
-  - SamSam Ransomware
-  - CISA AA22-320A
   - HAFNIUM Group
-  - Sandworm Tools
+  - DHS Report TA18-074A
+  - CISA AA22-320A
+  - DarkSide Ransomware
   - Active Directory Lateral Movement
-  - Nexus APT Threat Activity
   - DarkGate Malware
-  - Earth Estries
+  - Sandworm Tools
   - Rhysida Ransomware
+  - Nexus APT Threat Activity
+  - Earth Estries
+  - SamSam Ransomware
   asset_type: Endpoint
   mitre_attack_id:
   - T1569.002
@@ -62,7 +63,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: XmlWinEventLog
diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml
index 5c146b775f..c1d68de9f1 100644
--- a/detections/endpoint/detect_renamed_winrar.yml
+++ b/detections/endpoint/detect_renamed_winrar.yml
@@ -1,7 +1,7 @@
 name: Detect Renamed WinRAR
 id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122
-version: 9
-date: '2025-02-10'
+version: '10'
+date: '2025-02-24'
 author: Michael Haag, Splunk
 status: production
 type: Hunting
@@ -38,10 +38,11 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
 tags:
   analytic_story:
-  - Collection and Staging
-  - Earth Estries
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - CISA AA22-277A
+  - Collection and Staging
+  - Nexus APT Threat Activity
+  - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:
   - T1560.001
@@ -53,7 +54,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: XmlWinEventLog
diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
index fc1bb90dfe..fe61bbabe6 100644
--- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
+++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
@@ -95,7 +95,7 @@ tags:
   - Amadey
   - DarkCrystal RAT
   - Remcos
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Earth Estries
   - Rhysida Ransomware
   - RedLine Stealer
diff --git a/detections/endpoint/executables_or_script_creation_in_temp_path.yml b/detections/endpoint/executables_or_script_creation_in_temp_path.yml
index 9e59e81768..048578c69d 100644
--- a/detections/endpoint/executables_or_script_creation_in_temp_path.yml
+++ b/detections/endpoint/executables_or_script_creation_in_temp_path.yml
@@ -94,7 +94,7 @@ tags:
   - Amadey
   - DarkCrystal RAT
   - Remcos
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Earth Estries
   - Rhysida Ransomware
   - RedLine Stealer
diff --git a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml
index 7ce6b582fc..4b1c37d6fd 100644
--- a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml
+++ b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml
@@ -1,8 +1,8 @@
 name: Linux Auditd File Permission Modification Via Chmod
 id: 5f1d2ea7-eec0-4790-8b24-6875312ad492
-version: 7
-date: '2025-02-10'
-author: Teoderick Contreras, Splunk, Ivar Nygård
+version: '8'
+date: '2025-02-24'
+author: "Teoderick Contreras, Splunk, Ivar Nyg\xE5rd"
 status: production
 type: Anomaly
 description: The following analytic detects suspicious file permission modifications
@@ -58,11 +58,12 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Linux Privilege Escalation
-  - Linux Living Off The Land
-  - Compromised Linux Host
+  - China-Nexus Threat Activity
   - Linux Persistence Techniques
   - XorDDos
+  - Linux Privilege Escalation
+  - Compromised Linux Host
+  - Linux Living Off The Land
   - Nexus APT Threat Activity
   - Earth Estries
   asset_type: Endpoint
@@ -76,7 +77,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chmod_exec_attrib/linux_auditd_chmod_exec_attrib.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chmod_exec_attrib/linux_auditd_chmod_exec_attrib.log
     source: /var/log/audit/audit.log
     sourcetype: linux:audit
diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml
index 2470ddfe8f..1e04a0c022 100644
--- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml
+++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml
@@ -1,7 +1,7 @@
 name: Linux Auditd Nopasswd Entry In Sudoers File
 id: 651df959-ad17-4b73-a323-90cb96d5fa1b
-version: 5
-date: '2025-02-10'
+version: '6'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -57,9 +57,10 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
+  - China-Nexus Threat Activity
+  - Linux Persistence Techniques
   - Linux Privilege Escalation
   - Compromised Linux Host
-  - Linux Persistence Techniques
   - Nexus APT Threat Activity
   - Earth Estries
   asset_type: Endpoint
@@ -73,7 +74,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd.log
     source: /var/log/audit/audit.log
     sourcetype: linux:audit
diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml
index 62158c07f3..c18a158fab 100644
--- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml
+++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml
@@ -1,7 +1,7 @@
 name: Linux Auditd Possible Access To Credential Files
 id: 0419cb7a-57ea-467b-974f-77c303dfe2a3
-version: 5
-date: '2025-02-10'
+version: '6'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -59,9 +59,10 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
+  - China-Nexus Threat Activity
+  - Linux Persistence Techniques
   - Linux Privilege Escalation
   - Compromised Linux Host
-  - Linux Persistence Techniques
   - Nexus APT Threat Activity
   - Earth Estries
   asset_type: Endpoint
@@ -75,7 +76,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log
     source: /var/log/audit/audit.log
     sourcetype: linux:audit
diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml
index ce58e5dae8..100f27d690 100644
--- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml
+++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml
@@ -1,7 +1,7 @@
 name: Linux Auditd Possible Access To Sudoers File
 id: 8be88f46-f7e8-4ae6-b15e-cf1b13392834
-version: 5
-date: '2025-02-10'
+version: '6'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -56,9 +56,10 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
+  - China-Nexus Threat Activity
+  - Linux Persistence Techniques
   - Linux Privilege Escalation
   - Compromised Linux Host
-  - Linux Persistence Techniques
   - Nexus APT Threat Activity
   - Earth Estries
   asset_type: Endpoint
@@ -72,7 +73,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log
     source: /var/log/audit/audit.log
     sourcetype: linux:audit
diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml
index 8eb1a95ce2..5aade0e41b 100644
--- a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml
+++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml
@@ -1,7 +1,7 @@
 name: Linux Auditd Preload Hijack Library Calls
 id: 35c50572-a70b-452f-afa9-bebdf3c3ce36
-version: 5
-date: '2025-02-10'
+version: '6'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -57,9 +57,10 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
+  - China-Nexus Threat Activity
+  - Linux Persistence Techniques
   - Linux Privilege Escalation
   - Compromised Linux Host
-  - Linux Persistence Techniques
   - Nexus APT Threat Activity
   - Earth Estries
   asset_type: Endpoint
@@ -73,7 +74,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_ldpreload/linux_auditd_ldpreload.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_ldpreload/linux_auditd_ldpreload.log
     source: /var/log/audit/audit.log
     sourcetype: linux:audit
diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml
index 221f4c30c6..b5c698c6d5 100644
--- a/detections/endpoint/linux_common_process_for_elevation_control.yml
+++ b/detections/endpoint/linux_common_process_for_elevation_control.yml
@@ -1,7 +1,7 @@
 name: Linux Common Process For Elevation Control
 id: 66ab15c0-63d0-11ec-9e70-acde48001122
-version: 6
-date: '2025-02-10'
+version: '7'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
@@ -44,9 +44,10 @@ references:
 - https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/privilege_escalation/T1548.001_ElevationControl_CommonProcesses.xml
 tags:
   analytic_story:
+  - China-Nexus Threat Activity
+  - Linux Persistence Techniques
   - Linux Privilege Escalation
   - Linux Living Off The Land
-  - Linux Persistence Techniques
   - Nexus APT Threat Activity
   - Earth Estries
   asset_type: Endpoint
@@ -60,7 +61,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
     sourcetype: sysmon:linux
diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml
index 05900fd9fa..8c97b26dc2 100644
--- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml
+++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml
@@ -1,7 +1,7 @@
 name: Linux File Creation In Init Boot Directory
 id: 97d9cfb2-61ad-11ec-bb2d-acde48001122
-version: 7
-date: '2025-02-10'
+version: '8'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -49,10 +49,11 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Linux Privilege Escalation
+  - China-Nexus Threat Activity
   - Backdoor Pingpong
   - Linux Persistence Techniques
   - XorDDos
+  - Linux Privilege Escalation
   - Nexus APT Threat Activity
   asset_type: Endpoint
   mitre_attack_id:
@@ -65,7 +66,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
     sourcetype: sysmon:linux
diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml
index 395f7c7c45..961ca11c19 100644
--- a/detections/endpoint/linux_iptables_firewall_modification.yml
+++ b/detections/endpoint/linux_iptables_firewall_modification.yml
@@ -1,7 +1,7 @@
 name: Linux Iptables Firewall Modification
 id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7
-version: 8
-date: '2025-02-10'
+version: '9'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -66,10 +66,11 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Sandworm Tools
+  - China-Nexus Threat Activity
   - Backdoor Pingpong
-  - Nexus APT Threat Activity
   - Cyclops Blink
+  - Sandworm Tools
+  - Nexus APT Threat Activity
   asset_type: Endpoint
   mitre_attack_id:
   - T1562.004
@@ -81,7 +82,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
     sourcetype: sysmon:linux
diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
index 42d8d99f84..83ff35031f 100644
--- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
+++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
@@ -1,7 +1,7 @@
 name: Linux NOPASSWD Entry In Sudoers File
 id: ab1e0d52-624a-11ec-8e0b-acde48001122
-version: 6
-date: '2025-02-10'
+version: '7'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -58,10 +58,11 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Linux Privilege Escalation
-  - Earth Estries
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Linux Persistence Techniques
+  - Linux Privilege Escalation
+  - Nexus APT Threat Activity
+  - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:
   - T1548.003
@@ -73,7 +74,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
     sourcetype: sysmon:linux
diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml
index 9bbbe61f67..b9c427b519 100644
--- a/detections/endpoint/linux_possible_access_to_credential_files.yml
+++ b/detections/endpoint/linux_possible_access_to_credential_files.yml
@@ -1,7 +1,7 @@
 name: Linux Possible Access To Credential Files
 id: 16107e0e-71fc-11ec-b862-acde48001122
-version: 7
-date: '2025-02-10'
+version: '8'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -57,9 +57,10 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Linux Privilege Escalation
+  - China-Nexus Threat Activity
   - Linux Persistence Techniques
   - XorDDos
+  - Linux Privilege Escalation
   - Nexus APT Threat Activity
   - Earth Estries
   asset_type: Endpoint
@@ -73,7 +74,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
     sourcetype: sysmon:linux
diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml
index 92ff1b6f97..005a8e172f 100644
--- a/detections/endpoint/linux_possible_access_to_sudoers_file.yml
+++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml
@@ -1,7 +1,7 @@
 name: Linux Possible Access To Sudoers File
 id: 4479539c-71fc-11ec-b2e2-acde48001122
-version: 6
-date: '2025-02-10'
+version: '7'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -57,10 +57,11 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Linux Privilege Escalation
-  - Earth Estries
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Linux Persistence Techniques
+  - Linux Privilege Escalation
+  - Nexus APT Threat Activity
+  - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:
   - T1548.003
@@ -72,7 +73,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
     sourcetype: sysmon:linux
diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml
index 051c3c042d..6e9968e904 100644
--- a/detections/endpoint/linux_preload_hijack_library_calls.yml
+++ b/detections/endpoint/linux_preload_hijack_library_calls.yml
@@ -1,7 +1,7 @@
 name: Linux Preload Hijack Library Calls
 id: cbe2ca30-631e-11ec-8670-acde48001122
-version: 6
-date: '2025-02-10'
+version: '7'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -57,10 +57,11 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Linux Privilege Escalation
-  - Earth Estries
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Linux Persistence Techniques
+  - Linux Privilege Escalation
+  - Nexus APT Threat Activity
+  - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:
   - T1574.006
@@ -72,7 +73,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/lib_hijack/sysmon_linux.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/lib_hijack/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
     sourcetype: sysmon:linux
diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
index cd67ed8058..df9d9a6933 100644
--- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml
+++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
@@ -1,7 +1,7 @@
 name: Linux Sudoers Tmp File Creation
 id: be254a5c-63e7-11ec-89da-acde48001122
-version: 6
-date: '2025-02-10'
+version: '7'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -51,10 +51,11 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Linux Privilege Escalation
-  - Earth Estries
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Linux Persistence Techniques
+  - Linux Privilege Escalation
+  - Nexus APT Threat Activity
+  - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:
   - T1548.003
@@ -66,7 +67,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
     sourcetype: sysmon:linux
diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
index ecc670ddcd..351bf4e982 100644
--- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
+++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
@@ -1,7 +1,7 @@
 name: Malicious PowerShell Process - Execution Policy Bypass
 id: 9be56c82-b1cc-4318-87eb-d138afaaca39
-version: 10
-date: '2025-02-10'
+version: '11'
+date: '2025-02-24'
 author: Rico Valdez, Mauricio Velazco, Splunk
 status: production
 type: Anomaly
@@ -60,11 +60,12 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - DHS Report TA18-074A
-  - AsyncRAT
-  - DarkCrystal RAT
+  - China-Nexus Threat Activity
   - HAFNIUM Group
+  - DHS Report TA18-074A
+  - DarkCrystal RAT
   - Nexus APT Threat Activity
+  - AsyncRAT
   - Earth Estries
   - Volt Typhoon
   asset_type: Endpoint
@@ -78,7 +79,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/windows-sysmon.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: XmlWinEventLog
diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
index 1e39d1e1f8..8e927a7a6b 100644
--- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
+++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
@@ -58,7 +58,7 @@ tags:
   - FIN7
   - Earth Estries
   - Warzone RAT
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - DarkGate Malware
   - Remcos
   - RedLine Stealer
diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
index 66508ecda2..c9e182d0f7 100644
--- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
+++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
@@ -55,7 +55,7 @@ tags:
   - CISA AA23-347A
   - 3CX Supply Chain Attack
   - Azorult
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Warzone RAT
   - AgentTesla
   - RedLine Stealer
diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml
index e4c1ddafe7..b8e189bc3c 100644
--- a/detections/endpoint/powershell_4104_hunting.yml
+++ b/detections/endpoint/powershell_4104_hunting.yml
@@ -1,7 +1,7 @@
 name: PowerShell 4104 Hunting
 id: d6f2b006-0041-11ec-8885-acde48001122
-version: 11
-date: '2025-02-10'
+version: '12'
+date: '2025-02-24'
 author: Michael Haag, Splunk
 status: production
 type: Hunting
@@ -59,19 +59,20 @@ references:
 - https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
 tags:
   analytic_story:
-  - Data Destruction
+  - China-Nexus Threat Activity
+  - CISA AA24-241A
+  - Nexus APT Threat Activity
+  - Malicious PowerShell
   - Flax Typhoon
   - CISA AA23-347A
-  - Braodo Stealer
-  - Cleo File Transfer Software
-  - Malicious PowerShell
-  - Hermetic Wiper
   - DarkGate Malware
-  - Lumma Stealer
-  - Nexus APT Threat Activity
   - Earth Estries
+  - Cleo File Transfer Software
+  - Braodo Stealer
+  - Lumma Stealer
   - Rhysida Ransomware
-  - CISA AA24-241A
+  - Data Destruction
+  - Hermetic Wiper
   asset_type: Endpoint
   mitre_attack_id:
   - T1059.001
@@ -83,7 +84,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: XmlWinEventLog
diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml
index 6d0fe9d720..8628b1ba88 100644
--- a/detections/endpoint/registry_keys_used_for_persistence.yml
+++ b/detections/endpoint/registry_keys_used_for_persistence.yml
@@ -84,7 +84,7 @@ tags:
   - Chaos Ransomware
   - WinDealer RAT
   - Warzone RAT
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Earth Estries
   - SnappyBee
   - Windows Persistence Techniques
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml
index 45d08b0f06..3706bbda7a 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml
@@ -1,7 +1,7 @@
 name: Remote Process Instantiation via WMI
 id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da
-version: 11
-date: '2025-01-27'
+version: '12'
+date: '2025-02-24'
 author: Rico Valdez, Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -65,10 +65,11 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - CISA AA23-347A
+  - China-Nexus Threat Activity
   - Ransomware
-  - Suspicious WMI Use
   - Active Directory Lateral Movement
+  - CISA AA23-347A
+  - Suspicious WMI Use
   - Nexus APT Threat Activity
   - Earth Estries
   asset_type: Endpoint
diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
index 5090e71991..d185457d0e 100644
--- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
+++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
@@ -1,7 +1,7 @@
 name: Scheduled Task Deleted Or Created via CMD
 id: d5af132c-7c17-439c-9d31-13d55340f36c
-version: 12
-date: '2025-02-10'
+version: '13'
+date: '2025-02-24'
 author: Bhavin Patel, Splunk
 status: production
 type: TTP
@@ -66,32 +66,33 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Windows Persistence Techniques
   - DHS Report TA18-074A
   - Trickbot
-  - CISA AA23-347A
-  - Qakbot
-  - Azorult
-  - ShrinkLocker
-  - AsyncRAT
-  - Phemedrone Stealer
-  - NjRAT
-  - Prestige Ransomware
-  - Scheduled Tasks
-  - AgentTesla
-  - MoonPeak
   - NOBELIUM Group
-  - Living Off The Land
-  - CISA AA22-257A
+  - Prestige Ransomware
+  - Earth Estries
+  - ShrinkLocker
+  - NjRAT
   - CISA AA24-241A
-  - Amadey
   - DarkCrystal RAT
   - Sandworm Tools
-  - Winter Vivern
+  - Living Off The Land
   - Nexus APT Threat Activity
-  - Earth Estries
-  - Rhysida Ransomware
+  - AsyncRAT
+  - Scheduled Tasks
+  - AgentTesla
+  - Windows Persistence Techniques
   - RedLine Stealer
+  - Rhysida Ransomware
+  - Winter Vivern
+  - China-Nexus Threat Activity
+  - Qakbot
+  - CISA AA22-257A
+  - MoonPeak
+  - CISA AA23-347A
+  - Phemedrone Stealer
+  - Azorult
+  - Amadey
   asset_type: Endpoint
   mitre_attack_id:
   - T1053.005
@@ -103,7 +104,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: XmlWinEventLog
diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
index 598771f5eb..25f610fcba 100644
--- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
+++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
@@ -1,7 +1,7 @@
 name: Suspicious Regsvr32 Register Suspicious Path
 id: 62732736-6250-11eb-ae93-0242ac130002
-version: 12
-date: '2025-02-10'
+version: '13'
+date: '2025-02-24'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -73,13 +73,14 @@ rba:
     type: process_name
 tags:
   analytic_story:
+  - China-Nexus Threat Activity
+  - IcedID
   - Qakbot
+  - Derusbi
+  - Living Off The Land
+  - Nexus APT Threat Activity
   - Earth Estries
   - Suspicious Regsvr32 Activity
-  - IcedID
-  - Derusbi
-  - Nexus APT Threat Activity
-  - Living Off The Land
   asset_type: Endpoint
   mitre_attack_id:
   - T1218.010
@@ -91,7 +92,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: XmlWinEventLog
diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
index 8e78c248d6..a6d87b4074 100644
--- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
+++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
@@ -1,7 +1,7 @@
 name: Suspicious Scheduled Task from Public Directory
 id: 7feb7972-7ac3-11eb-bac8-acde48001122
-version: 6
-date: '2025-02-10'
+version: '7'
+date: '2025-02-24'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
@@ -65,19 +65,20 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Windows Persistence Techniques
-  - CISA AA23-347A
-  - Ransomware
-  - DarkCrystal RAT
-  - Scheduled Tasks
-  - Azorult
+  - China-Nexus Threat Activity
   - Crypto Stealer
-  - Nexus APT Threat Activity
-  - Living Off The Land
+  - Ransomware
   - MoonPeak
-  - Ryuk Ransomware
-  - Earth Estries
+  - DarkCrystal RAT
   - CISA AA24-241A
+  - CISA AA23-347A
+  - Windows Persistence Techniques
+  - Living Off The Land
+  - Nexus APT Threat Activity
+  - Azorult
+  - Ryuk Ransomware
+  - Scheduled Tasks
+  - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:
   - T1053.005
@@ -89,7 +90,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: XmlWinEventLog
diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml
index 9bacc10183..e35b05c208 100644
--- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml
+++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml
@@ -65,7 +65,7 @@ tags:
   - AsyncRAT
   - Derusbi
   - PlugX
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - DarkGate Malware
   - Earth Estries
   asset_type: Endpoint
diff --git a/detections/endpoint/windows_anonymous_pipe_activity.yml b/detections/endpoint/windows_anonymous_pipe_activity.yml
index e0eac5c8c4..1102c6ffa3 100644
--- a/detections/endpoint/windows_anonymous_pipe_activity.yml
+++ b/detections/endpoint/windows_anonymous_pipe_activity.yml
@@ -37,7 +37,7 @@ drilldown_searches:
 tags:
   analytic_story:
   - SnappyBee
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:
diff --git a/detections/endpoint/windows_archive_collected_data_via_rar.yml b/detections/endpoint/windows_archive_collected_data_via_rar.yml
index 7a1bc686a4..7b2fcb5e62 100644
--- a/detections/endpoint/windows_archive_collected_data_via_rar.yml
+++ b/detections/endpoint/windows_archive_collected_data_via_rar.yml
@@ -1,7 +1,7 @@
 name: Windows Archive Collected Data via Rar
 id: 2015de95-fe91-413d-9d62-2fe011b67e82
-version: 6
-date: '2025-02-10'
+version: '7'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -61,9 +61,10 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
+  - DarkGate Malware
+  - China-Nexus Threat Activity
   - Earth Estries
   - Nexus APT Threat Activity
-  - DarkGate Malware
   asset_type: Endpoint
   mitre_attack_id:
   - T1560.001
@@ -75,7 +76,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility_darkgate/rar_sys.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility_darkgate/rar_sys.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: XmlWinEventLog
diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml
index 92a303a0cf..299c24b138 100644
--- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml
+++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml
@@ -61,7 +61,7 @@ tags:
   - Amadey
   - PXA Stealer
   - Warzone RAT
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - DarkGate Malware
   - RedLine Stealer
   - Earth Estries
diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml
index 48bcd82e48..4464a24721 100644
--- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml
+++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml
@@ -62,7 +62,7 @@ tags:
   - Amadey
   - PXA Stealer
   - Warzone RAT
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - DarkGate Malware
   - RedLine Stealer
   - Earth Estries
diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
index fc5ad0009f..e38b89ded7 100644
--- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml
+++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
@@ -1,7 +1,7 @@
 name: Windows Curl Download to Suspicious Path
 id: c32f091e-30db-11ec-8738-acde48001122
-version: 8
-date: '2025-01-27'
+version: '9'
+date: '2025-02-24'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -71,11 +71,12 @@ rba:
 tags:
   analytic_story:
   - Ingress Tool Transfer
-  - Forest Blizzard
+  - China-Nexus Threat Activity
   - IcedID
   - Nexus APT Threat Activity
-  - Compromised Windows Host
+  - Forest Blizzard
   - Earth Estries
+  - Compromised Windows Host
   asset_type: Endpoint
   mitre_attack_id:
   - T1105
diff --git a/detections/endpoint/windows_query_registry_browser_list_application.yml b/detections/endpoint/windows_query_registry_browser_list_application.yml
index 2038fd726e..1672d23bfe 100644
--- a/detections/endpoint/windows_query_registry_browser_list_application.yml
+++ b/detections/endpoint/windows_query_registry_browser_list_application.yml
@@ -54,7 +54,7 @@ tags:
   - SnappyBee
   - RedLine Stealer
   - Earth Estries
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   asset_type: Endpoint
   mitre_attack_id:
   - T1012
diff --git a/detections/endpoint/windows_replication_through_removable_media.yml b/detections/endpoint/windows_replication_through_removable_media.yml
index 7817d86c25..fc49bd7b92 100644
--- a/detections/endpoint/windows_replication_through_removable_media.yml
+++ b/detections/endpoint/windows_replication_through_removable_media.yml
@@ -1,7 +1,7 @@
 name: Windows Replication Through Removable Media
 id: 60df805d-4605-41c8-bbba-57baa6a4eb97
-version: 7
-date: '2025-01-27'
+version: '8'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -60,12 +60,13 @@ rba:
     type: file_name
 tags:
   analytic_story:
-  - PlugX
+  - NjRAT
+  - China-Nexus Threat Activity
   - Chaos Ransomware
   - Derusbi
+  - PlugX
   - Nexus APT Threat Activity
   - Earth Estries
-  - NjRAT
   asset_type: Endpoint
   mitre_attack_id:
   - T1091
diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
index 5a734268d8..1a143a424a 100644
--- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
+++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
@@ -65,7 +65,7 @@ tags:
   - SnappyBee
   - CISA AA23-347A
   - Active Directory Lateral Movement
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:
diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml
index 00dc756023..fb96ae4e10 100644
--- a/detections/endpoint/windows_service_creation_using_registry_entry.yml
+++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml
@@ -57,7 +57,7 @@ tags:
   - Brute Ratel C4
   - CISA AA23-347A
   - Suspicious Windows Registry Activities
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Derusbi
   - PlugX
   - Windows Registry Abuse
diff --git a/detections/endpoint/windows_snappybee_create_test_registry.yml b/detections/endpoint/windows_snappybee_create_test_registry.yml
index 107ce74646..2854203d3f 100644
--- a/detections/endpoint/windows_snappybee_create_test_registry.yml
+++ b/detections/endpoint/windows_snappybee_create_test_registry.yml
@@ -49,7 +49,7 @@ rba:
 tags:
   analytic_story:
   - SnappyBee
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:
diff --git a/detections/endpoint/windows_suspicious_process_file_path.yml b/detections/endpoint/windows_suspicious_process_file_path.yml
index 79b151ff2c..f2862efdbb 100644
--- a/detections/endpoint/windows_suspicious_process_file_path.yml
+++ b/detections/endpoint/windows_suspicious_process_file_path.yml
@@ -103,7 +103,7 @@ tags:
   - MoonPeak
   - ValleyRAT
   - Meduza Stealer
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Earth Estries
   - SnappyBee
   asset_type: Endpoint
diff --git a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml
index d04ec4ac62..8714046ce3 100644
--- a/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml
+++ b/detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml
@@ -60,7 +60,7 @@ rba:
 tags:
   analytic_story:
   - SnappyBee
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:
diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml
index f6c7a56920..7034140a74 100644
--- a/detections/endpoint/windows_unsigned_dll_side_loading.yml
+++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml
@@ -1,7 +1,7 @@
 name: Windows Unsigned DLL Side-Loading
 id: 5a83ce44-8e0f-4786-a775-8249a525c879
-version: 7
-date: '2025-01-27'
+version: '8'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -52,10 +52,11 @@ rba:
 tags:
   analytic_story:
   - Warzone RAT
+  - NjRAT
+  - China-Nexus Threat Activity
   - Derusbi
   - Nexus APT Threat Activity
   - Earth Estries
-  - NjRAT
   asset_type: Endpoint
   mitre_attack_id:
   - T1574.002
diff --git a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml
index 8a48c65978..b49c48ff8a 100644
--- a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml
+++ b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml
@@ -56,7 +56,7 @@ tags:
   analytic_story:
   - PlugX
   - Derusbi
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - DarkGate Malware
   - Earth Estries
   - SnappyBee
diff --git a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml
index add7f13b4d..bf38badfc3 100644
--- a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml
+++ b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml
@@ -1,7 +1,7 @@
 name: Windows Unsigned MS DLL Side-Loading
 id: 8d9e0e06-ba71-4dc5-be16-c1a46d58728c
-version: 7
-date: '2025-01-27'
+version: '8'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 data_source:
 - Sysmon EventID 7
@@ -64,9 +64,10 @@ rba:
     type: file_name
 tags:
   analytic_story:
+  - China-Nexus Threat Activity
   - Derusbi
-  - APT29 Diplomatic Deceptions with WINELOADER
   - Nexus APT Threat Activity
+  - APT29 Diplomatic Deceptions with WINELOADER
   - Earth Estries
   group:
   - APT29
diff --git a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml
index bcee3f088a..87beb38b68 100644
--- a/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml
+++ b/detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml
@@ -53,7 +53,7 @@ rba:
     type: process_name
 tags:
   analytic_story:
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - DarkGate Malware
   - Earth Estries
   asset_type: Endpoint
diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
index 36d6515acc..9f9217f4bd 100644
--- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
@@ -1,7 +1,7 @@
 name: WinEvent Scheduled Task Created to Spawn Shell
 id: 203ef0ea-9bd8-11eb-8201-acde48001122
-version: 9
-date: '2025-02-10'
+version: '10'
+date: '2025-02-24'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -54,16 +54,17 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Windows Persistence Techniques
-  - Ransomware
-  - Windows Error Reporting Service Elevation of Privilege Vulnerability
-  - Scheduled Tasks
-  - Winter Vivern
-  - Nexus APT Threat Activity
-  - Compromised Windows Host
-  - Ryuk Ransomware
-  - Earth Estries
+  - China-Nexus Threat Activity
   - CISA AA22-257A
+  - Windows Error Reporting Service Elevation of Privilege Vulnerability
+  - Compromised Windows Host
+  - Ransomware
+  - Windows Persistence Techniques
+  - Nexus APT Threat Activity
+  - Ryuk Ransomware
+  - Scheduled Tasks
+  - Earth Estries
+  - Winter Vivern
   asset_type: Endpoint
   mitre_attack_id:
   - T1053.005
@@ -75,7 +76,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log
     source: XmlWinEventLog:Security
     sourcetype: XmlWinEventLog
diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
index b7a530c00d..756ab1465d 100644
--- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
@@ -1,7 +1,7 @@
 name: WinEvent Scheduled Task Created Within Public Path
 id: 5d9c6eee-988c-11eb-8253-acde48001122
-version: 9
-date: '2025-02-10'
+version: '10'
+date: '2025-02-24'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -54,22 +54,23 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Data Destruction
-  - Windows Persistence Techniques
-  - AsyncRAT
-  - Industroyer2
-  - CISA AA23-347A
-  - Ransomware
-  - Prestige Ransomware
-  - Scheduled Tasks
+  - China-Nexus Threat Activity
   - IcedID
-  - Winter Vivern
-  - Active Directory Lateral Movement
-  - Nexus APT Threat Activity
-  - Compromised Windows Host
-  - Ryuk Ransomware
-  - Earth Estries
   - CISA AA22-257A
+  - Compromised Windows Host
+  - Ransomware
+  - Nexus APT Threat Activity
+  - Active Directory Lateral Movement
+  - CISA AA23-347A
+  - Windows Persistence Techniques
+  - Earth Estries
+  - Prestige Ransomware
+  - Industroyer2
+  - Ryuk Ransomware
+  - AsyncRAT
+  - Scheduled Tasks
+  - Data Destruction
+  - Winter Vivern
   asset_type: Endpoint
   mitre_attack_id:
   - T1053.005
@@ -81,7 +82,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log
     source: XmlWinEventLog:Security
     sourcetype: XmlWinEventLog
diff --git a/detections/network/detect_large_outbound_icmp_packets.yml b/detections/network/detect_large_outbound_icmp_packets.yml
index 9fa1a7f4b5..0e1657e876 100644
--- a/detections/network/detect_large_outbound_icmp_packets.yml
+++ b/detections/network/detect_large_outbound_icmp_packets.yml
@@ -1,7 +1,7 @@
 name: Detect Large Outbound ICMP Packets
 id: e9c102de-4d43-42a7-b1c8-8062ea297419
-version: 9
-date: '2025-01-27'
+version: '10'
+date: '2025-02-24'
 author: Rico Valdez, Dean Luxton, Splunk
 status: production
 type: TTP
@@ -66,9 +66,10 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
+  - Command And Control
+  - China-Nexus Threat Activity
   - Backdoor Pingpong
   - Nexus APT Threat Activity
-  - Command And Control
   asset_type: Endpoint
   mitre_attack_id:
   - T1095
diff --git a/stories/china_nexus_threat_activity.yml b/stories/china_nexus_threat_activity.yml
new file mode 100644
index 0000000000..740f595dde
--- /dev/null
+++ b/stories/china_nexus_threat_activity.yml
@@ -0,0 +1,22 @@
+name: China-Nexus Threat Activity
+id: 43f8062d-4da0-4f48-8cad-6a20e108961b
+version: 2
+date: '2025-02-24'
+author: Teoderick Contreras, Splunk
+status: production
+description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Nexus, Chinese state-nexus adversaries known for its stealth and strategic targeting of high-value sectors. Monitor for indicators such as spear-phishing campaigns, exploitation of zero-day vulnerabilities, and unauthorized lateral movement within your network. Investigate anomalous data exfiltration, encrypted communications, and behaviors aligning with their known tactics, techniques, and procedures (TTPs). Combining threat intelligence with real-time monitoring helps identify and respond to Nexus APT activity, minimizing potential damage and data loss.
+narrative: Chinese state-nexus threat group are known to target the telecommunications and technology sectors in multiple countries, including the US, to maintain sustained access as well as conduct espionage. Compromised entities in either sector represent potential supply chain vectors of concern to Splunk, although telecommunications entities are a more pervasive and acute concern in this regard. These actors are also known to broadly target unpatched routers, switches and other edge devices across various sectors. Given these threats, Splunk Threat Intelligence (TI) undertook a detailed investigation into China-nexus tactics and techniques that could be used in attempts to compromise Splunk. This report is the result of that investigation, detailing noteworthy behaviors and tools employed by China-nexus targeted intrusion actors.
+references:
+- https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/
+- https://www.wsj.com/tech/cybersecurity/typhoon-china-hackers-military-weapons-97d4ef95?st=oe1KKi&reflink=desktopwebshare _permalink
+- https://www.judiciary.senate.gov/imo/media/doc/2024-11-19_pm_-_testimony_-_meyers.pdf
+- https://go.crowdstrike.com/rs/281-OBQ-266/images/GlobalThreatReport2024.pdf
+- https://www.crowdstrike.com/adversaries/envoy-panda/
+tags:
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection
\ No newline at end of file
diff --git a/stories/nexus_apt_threat_activity.yml b/stories/nexus_apt_threat_activity.yml
deleted file mode 100644
index bd6aed1350..0000000000
--- a/stories/nexus_apt_threat_activity.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-name: Nexus APT Threat Activity
-id: 43f8062d-4da0-4f48-8cad-6a20e108961b
-version: 1
-date: '2025-01-27'
-author: Teoderick Contreras, Splunk
-status: production
-description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Nexus, an advanced persistent threat (APT) group known for its stealth and strategic targeting of high-value sectors. Monitor for indicators such as spear-phishing campaigns, exploitation of zero-day vulnerabilities, and unauthorized lateral movement within your network. Investigate anomalous data exfiltration, encrypted communications, and behaviors aligning with their known tactics, techniques, and procedures (TTPs). Combining threat intelligence with real-time monitoring helps identify and respond to Nexus APT activity, minimizing potential damage and data loss.
-narrative: Chinese state-nexus threat actors are known to target the telecommunications and technology sectors in multiple countries, including the US, to maintain sustained access as well as conduct espionage. Compromised entities in either sector represent potential supply chain vectors of concern to Splunk, although telecommunications entities are a more pervasive and acute concern in this regard. These actors are also known to broadly target unpatched routers, switches and other edge devices across various sectors. Given these threats, Splunk Threat Intelligence (TI) undertook a detailed investigation into China-nexus tactics and techniques that could be used in attempts to compromise Splunk. This report is the result of that investigation, detailing noteworthy behaviors and tools employed by China-nexus targeted intrusion actors.
-references:
-- https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/
-- https://www.wsj.com/tech/cybersecurity/typhoon-china-hackers-military-weapons-97d4ef95?st=oe1KKi&reflink=desktopwebshare _permalink
-- https://www.judiciary.senate.gov/imo/media/doc/2024-11-19_pm_-_testimony_-_meyers.pdf
-- https://go.crowdstrike.com/rs/281-OBQ-266/images/GlobalThreatReport2024.pdf
-tags:
-  category:
-  - Malware
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  usecase: Advanced Threat Detection
\ No newline at end of file