Branch was auto-updated.

bin/contentctl_project/contentctl_infrastructure/adapter/finding_report_writer.py

@@ -9,32 +9,6 @@ class FindingReportObject():
 
     @staticmethod
     def writeFindingReport(detection : Detection) -> None:
-    
-        # if detection.tags.confidence < 33:
-        #     detection.tags.confidence_id = 1
-        # elif detection.tags.confidence < 66:
-        #     detection.tags.confidence_id = 2
-        # else:
-        #     detection.tags.confidence_id = 3
-
-        # detection.tags.context_ids = list()
-        # for context in detection.tags.context:
-        #     detection.tags.context_ids.append(SES_CONTEXT_MAPPING[context])
-        
-        # if detection.tags.impact < 20:
-        #     detection.tags.impact_id = 1
-        # elif detection.tags.impact < 40:
-        #     detection.tags.impact_id = 2
-        # elif detection.tags.impact < 60:
-        #     detection.tags.impact_id = 3
-        # elif detection.tags.impact < 80:
-        #     detection.tags.impact_id = 4
-        # else:
-        #     detection.tags.impact_id = 5                 
-
-        # detection.tags.kill_chain_phases_id = dict()
-        # for kill_chain_phase in detection.tags.kill_chain_phases:
-        #     detection.tags.kill_chain_phases_id[kill_chain_phase] = SES_KILL_CHAIN_MAPPINGS[kill_chain_phase]
 
 
         if detection.tags.risk_score < 20:
@@ -53,15 +27,6 @@ class FindingReportObject():
             detection.tags.risk_level_id = 4
             detection.tags.risk_level = "Critical"  
 
-        # observable_str = "["
-        # for i in range(len(detection.tags.observable)):            
-        #     observable_str = observable_str + 'create_map("name", "' + detection.tags.observable[i]["name"] + '", "type_id", ' + str(SES_OBSERVABLE_TYPE_MAPPING[detection.tags.observable[i]["type"]]) + ', "value", ' + detection.tags.observable[i]["name"].replace(".", "_") + ')'
-        #     if not i == (len(detection.tags.observable) - 1):
-        #         observable_str = observable_str + ', '
-        # observable_str = observable_str + ']'
-
-        # detection.tags.observable_str = observable_str
-
         evidence_str = "create_map("
         for i in range(len(detection.tags.observable)):            
             evidence_str = evidence_str + '"' + detection.tags.observable[i]["name"] + '", ' + detection.tags.observable[i]["name"].replace(".", "_")
@@ -71,10 +36,15 @@ class FindingReportObject():
 
         detection.tags.evidence_str = evidence_str
 
+        if "actor.user.name" in detection.tags.required_fields:
+            actor_user_name = "actor_user_name"
+        else:
+            actor_user_name = "\"Unknown\""
+
         j2_env = Environment(
             loader=FileSystemLoader(os.path.join(os.path.dirname(__file__), 'templates')), 
             trim_blocks=True)
         template = j2_env.get_template('finding_report.j2')
-        body = template.render(detection=detection, attack_tactics_id_mapping=SES_ATTACK_TACTICS_ID_MAPPING)
+        body = template.render(detection=detection, attack_tactics_id_mapping=SES_ATTACK_TACTICS_ID_MAPPING, actor_user_name=actor_user_name)
 
         return body

bin/contentctl_project/contentctl_infrastructure/adapter/templates/finding_report.j2

@@ -7,10 +7,10 @@
     ],
     "time", timestamp,
     "evidence", {{ detection.tags.evidence_str }},
-    "message", concat("{{ detection.name }} has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "message", concat("{{ detection.name }} has been triggered on ", device_hostname, " by ", {{ actor_user_name }}, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", {{ actor_user_name }}, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,

bin/contentctl_project/contentctl_infrastructure/builder/sigma_converter.py

@@ -28,7 +28,6 @@ class SigmaConverterInputDto:
     detection_folder : str
     input_path: str
     log_source: str
-    cim_to_ocsf: bool
 
 
 @dataclass(frozen=True)
@@ -159,9 +158,9 @@ class SigmaConverter():
 
                         cim_to_ocsf_mapping = self.get_cim_to_ocsf_mapping(data_source_new)
 
-                    elif input_dto.cim_to_ocsf:
-                        field_mapping = self.get_cim_to_ocsf_mapping(data_source)
-                        cim_to_ocsf_mapping = field_mapping
+                    # elif input_dto.cim_to_ocsf:
+                    #     field_mapping = self.get_cim_to_ocsf_mapping(data_source)
+                    #     cim_to_ocsf_mapping = field_mapping
 
                     else:
                         field_mapping = self.find_mapping(data_source.field_mappings, 'data_model', 'ocsf')
@@ -171,7 +170,7 @@ class SigmaConverter():
                     for field in field_mapping_underline["mapping"].keys():
                         field_mapping_underline["mapping"][field] = field_mapping_underline["mapping"][field].replace(".", "_")     
 
-                    self.add_required_fields(field_mapping, detection)
+                    self.add_required_fields(cim_to_ocsf_mapping, detection)
                     self.add_mappings(cim_to_ocsf_mapping, detection)
 
                     self.update_observables(detection)
@@ -189,7 +188,7 @@ class SigmaConverter():
                         )
                     )
 
-                    detection = self.convert_detection_fields(detection, field_mapping_underline)
+                    detection = self.convert_detection_fields(detection)
                     sigma_rule = self.get_sigma_rule(detection, data_source)
                     sigma_processing_pipeline = self.get_pipeline_from_processing_items(processing_items)
 
@@ -248,15 +247,27 @@ class SigmaConverter():
         }])
 
 
-    def convert_detection_fields(self, detection: Detection, mappings: dict) -> Detection:
+    # def convert_detection_fields(self, detection: Detection, mappings: dict) -> Detection:
+    #     for selection in detection.search.keys():
+    #         if selection != "condition":
+    #             new_selection = copy.deepcopy(detection.search[selection])
+    #             for field in detection.search[selection].keys():
+    #                 for mapping in mappings["mapping"].keys():
+    #                     if mapping == field:
+    #                         new_selection[mappings["mapping"][mapping]] =  detection.search[selection][field]
+    #                         new_selection.pop(field)
+    #             detection.search[selection] = new_selection
+
+    #     return detection
+
+    def convert_detection_fields(self, detection: Detection) -> Detection:
         for selection in detection.search.keys():
             if selection != "condition":
                 new_selection = copy.deepcopy(detection.search[selection])
                 for field in detection.search[selection].keys():
-                    for mapping in mappings["mapping"].keys():
-                        if mapping == field:
-                            new_selection[mappings["mapping"][mapping]] =  detection.search[selection][field]
-                            new_selection.pop(field)
+                    new_field_name = field.replace(".", "_")
+                    new_selection[new_field_name] = detection.search[selection][field]
+                    new_selection.pop(field)
                 detection.search[selection] = new_selection
 
         return detection
@@ -337,14 +348,9 @@ class SigmaConverter():
 
     def add_required_fields(self, field_mapping: dict, detection: Detection) -> None:
         required_fields = list()
-        required_fields = ["process.user.name", "device.hostname"]
+#        required_fields = ["process.user.name", "device.hostname"]
         for mapping in field_mapping["mapping"].keys():
-            for selection in detection.search.keys():
-                if selection != "condition":
-                    for detection_field in detection.search[selection]:
-                        if detection_field.startswith(mapping):
-                            if not field_mapping["mapping"][mapping] in required_fields:
-                                required_fields.append(field_mapping["mapping"][mapping])
+            required_fields.append(field_mapping["mapping"][mapping])
 
         detection.tags.required_fields = required_fields
 
@@ -361,14 +367,19 @@ class SigmaConverter():
     def update_observables(self, detection : Detection) -> None:
         mapping_field_to_type = {
             "process.user.name": "User Name",
+            "actor.user.name": "User Name",
             "device.hostname": "Hostname",
             "process.file.name": "File Name",
             "actor.process.file.name": "File Name",
             "actor.process.file.path": "File Name",
             "actor.process.cmd_line": "Process",
+            "actor.user.uid": "Other",
             "process.cmd_line": "Other",
             "process.file.path": "File",
-            "process.file.name": "File"
+            "process.file.name": "File",
+            "process.uid": "Other",
+            "process.pid": "Other",
+            "actor.process.pid": "Other"
         }
 
         observables = list()

contentctl.py

@@ -312,8 +312,6 @@ def convert(args) -> None:
         data_model = SigmaConverterTarget.RAW
     elif args.data_model == 'ocsf':
         data_model = SigmaConverterTarget.OCSF
-    elif args.data_model == 'all':
-        data_model = SigmaConverterTarget.ALL
     else:
         print("ERROR: data model " + args.data_model + " not supported")
         sys.exit(1)
@@ -323,8 +321,7 @@ def convert(args) -> None:
         detection_path = args.detection_path,
         detection_folder = args.detection_folder, 
         input_path = args.path,
-        log_source = args.log_source,
-        cim_to_ocsf = args.cim_to_ocsf
+        log_source = args.log_source
     )
 
     convert_input_dto = ConvertInputDto(
@@ -414,7 +411,6 @@ def main(args):
     convert_parser.add_argument("-lo", "--log_source", required=False, type=str, help="converter log source")
     convert_parser.add_argument("-dp", "--detection_path", required=False, type=str, help="path to a single detection")
     convert_parser.add_argument("-df", "--detection_folder", required=False, type=str, help="path to a detection folder")
-    convert_parser.add_argument("-cto", "--cim_to_ocsf", action=argparse.BooleanOptionalAction, help="temp: cim to ocsf")
     convert_parser.add_argument("-o", "--output", required=True, type=str, help="output path to store the detections")
     convert_parser.set_defaults(func=convert)
 

data_sources/endpoint/Powershell_4104.yml

@@ -21,4 +21,21 @@ raw_fields:
   - MessageNumber
   - MessageTotal
   - ScriptBlockId
-  - ScriptBlockText
+  - ScriptBlockText
+  - Path
+field_mappings:
+  - data_model: cim
+    data_set: Endpoint.Processes
+    mapping:
+      Computer: Processes.dest
+      Path: Processes.process_path
+      ScriptBlockId: Processes.process_id
+      ScriptBlockText: Processes.process
+      UserID: Processes.user_id
+  - data_model: ocsf
+    mapping:
+      Computer: device.hostname
+      Path: process.file.path
+      ScriptBlockId: process.uid
+      ScriptBlockText: process.cmd_line
+      UserID: actor.user.uid

data_sources/endpoint/Windows_Security_4688.yml

@@ -44,7 +44,7 @@ field_mappings:
       NewProcessName: process.file.path
       NewProcessName|endswith: process.file.name
       Process_Command_Line: process.cmd_line
-      SubjectUserSid: process.user.name
+      SubjectUserSid: actor.user.name
       ProcessId: actor.process.pid
       ParentProcessName: actor.process.file.path
       ParentProcessName|endswith: actor.process.file.name

dev_ssa/endpoint/ssa___anomalous_usage_of_archive_tools.yml

@@ -11,13 +11,13 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: WinRAR.exe
+    process.file.name: WinRAR.exe
   selection2:
-    process_name|startswith: 7z
+    process.file.name|startswith: 7z
   selection3:
-    process_name|startswith: winzip
+    process.file.name|startswith: winzip
   selection4:
-    parent_process_name|endswith:
+    actor.process.file.name|endswith:
     - powershell.exe
     - cmd.exe
   condition: (selection1 or selection2 or selection3) and selection4
@@ -42,33 +42,10 @@ tags:
   mitre_attack_id:
   - T1560.001
   - T1560
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 42

dev_ssa/endpoint/ssa___attempt_to_delete_services.yml

@@ -14,8 +14,8 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: sc.exe
-    process|contains: delete
+    process.file.name: sc.exe
+    process.cmd_line|contains: delete
   condition: selection1
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -39,34 +39,10 @@ tags:
   - T1489
   - T1543
   - T1543.003
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 36

dev_ssa/endpoint/ssa___attempt_to_disable_services.yml

@@ -14,11 +14,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains: config
+    process.cmd_line|contains: config
   selection2:
-    process|contains: disabled
+    process.cmd_line|contains: disabled
   selection3:
-    process_name: sc.exe
+    process.file.name: sc.exe
   condition: selection1 and selection2 and selection3
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -41,33 +41,10 @@ tags:
     on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service.
   mitre_attack_id:
   - T1489
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 36

dev_ssa/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -12,11 +12,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name:
+    process.file.name:
     - reg.exe
     - cmd.exe
   selection2:
-    process|re:
+    process.cmd_line|re:
     - HKEY_LOCAL_MACHINE\System
     - HKEY_LOCAL_MACHINE\SAM
     - HKEY_LOCAL_MACHINE\Security
@@ -24,7 +24,7 @@ search:
     - HKLM\SAM
     - HKLM\Security
   selection3:
-    process|re: save
+    process.cmd_line|re: save
   condition: selection1 and (selection2) and selection3
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -40,32 +40,15 @@ tags:
   asset_type: Endpoint
   confidence: 90
   impact: 70
-  message: An attempt to save registry keys storing credentials has been performed on 
+  message: An attempt to save registry keys storing credentials has been performed
+    on
   mitre_attack_id:
   - T1003
   - T1003.002
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Actor
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - process_name
-  - _time
-  - dest_device_id
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 63

dev_ssa/endpoint/ssa___bcdedit_failure_recovery_modification.yml

@@ -12,11 +12,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: bcdedit.exe
+    process.file.name: bcdedit.exe
   selection2:
-    process|contains: 'no'
+    process.cmd_line|contains: 'no'
   selection3:
-    process|contains: recoveryenabled
+    process.cmd_line|contains: recoveryenabled
   condition: selection1 and (selection2 and selection3)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -37,34 +37,10 @@ tags:
     to recover the endpoint.
   mitre_attack_id:
   - T1490
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 80

dev_ssa/endpoint/ssa___clear_unallocated_sector_using_cipher_app.yml

@@ -12,8 +12,8 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: cipher.exe
-    process|contains: '/W:'
+    process.file.name: cipher.exe
+    process.cmd_line|contains: '/W:'
   condition: selection1
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -35,38 +35,10 @@ tags:
   mitre_attack_id:
   - T1070.004
   - T1070
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 90

dev_ssa/endpoint/ssa___delete_a_net_user.yml

@@ -15,11 +15,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains: user
+    process.cmd_line|contains: user
   selection2:
-    process|contains: /delete
+    process.cmd_line|contains: /delete
   selection3:
-    process_name:
+    process.file.name:
     - net.exe
     - net1.exe
   condition: selection1 and selection2 and (selection3)
@@ -43,34 +43,10 @@ tags:
     account.
   mitre_attack_id:
   - T1531
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 49

dev_ssa/endpoint/ssa___deny_permission_using_cacls_utility.yml

@@ -13,11 +13,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name:
+    process.file.name:
     - icacls.exe
     - xcacls.exe
     - cacls.exe
-    process|re: deny
+    process.cmd_line|re: deny
   condition: (selection1)
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -34,30 +34,14 @@ tags:
   asset_type: Endpoint
   confidence: 70
   impact: 50
-  message: A cacls process $process_name$ with commandline $process$ try to deny
-    a permission of a file or directory in host $dest_device_id$
+  message: A cacls process $process_name$ with commandline $process$ try to deny a
+    permission of a file or directory in host $dest_device_id$
   mitre_attack_id:
   - T1222
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml

@@ -11,27 +11,28 @@ description: The following analytic identifies parent processes, browsers, Windo
   need to be tuned to further enhance the risk.
 data_source:
 - Windows Security 4688
-search: 
+search:
   selection1:
-    parent_process_name:
-      - winword.exe
-      - excel.exe
-      - outlook.exe
-      - acrobat.exe
-      - acrord32.exe
-      - iexplore.exe
-      - opera.exe
-      - firefox.exe
-      - powershell.exe
+    actor.process.file.name:
+    - winword.exe
+    - excel.exe
+    - outlook.exe
+    - acrobat.exe
+    - acrord32.exe
+    - iexplore.exe
+    - opera.exe
+    - firefox.exe
+    - powershell.exe
   selection2:
-    parent_process_name: java.exe
+    actor.process.file.name: java.exe
   selection3:
-    parent_process_name|re: patch1-Hotfix1a
+    actor.process.file.name|re: patch1-Hotfix1a
   selection4:
-    parent_process_name: chrome.exe
+    actor.process.file.name: chrome.exe
   selection5:
-    process: chrome-extension
-  condition: selection1 or (selection2 and not selection3) or (selection4 and not selection5)
+    process.cmd_line: chrome-extension
+  condition: selection1 or (selection2 and not selection3) or (selection4 and not
+    selection5)
 how_to_implement: In order to successfully implement this analytic, you will need
   endpoint process data from a EDR product or Sysmon. This search has been modified
   to process raw sysmon data from attack_range's nxlogs on DSP.
@@ -51,32 +52,10 @@ tags:
     that warrants investigating.
   mitre_attack_id:
   - T1059
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Actor
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - process_name
-  - parent_process_name
-  - _time
-  - dest_device_id
-  - dest_user_id
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___detect_rclone_command_line_usage.yml

@@ -16,7 +16,7 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - --multi-thread-streams
     - --transfers
     - --auto-confirm
@@ -28,7 +28,7 @@ search:
     - pcloud
     - mega
     - copy
-    process_name: rclone.exe
+    process.file.name: rclone.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -53,34 +53,10 @@ tags:
     remote cloud service to move files or folders.
   mitre_attack_id:
   - T1020
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___disable_net_user_account.yml

@@ -13,11 +13,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains: user
+    process.cmd_line|contains: user
   selection2:
-    process|contains: /active:no
+    process.cmd_line|contains: /active:no
   selection3:
-    process_name:
+    process.file.name:
     - net.exe
     - net1.exe
   condition: selection1 and selection2 and (selection3)
@@ -42,34 +42,10 @@ tags:
   mitre_attack_id:
   - T1489
   - T1078
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 49

dev_ssa/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml

@@ -15,13 +15,13 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - -retry=
     - -type=
     - -q=
     - -qt=
     - -querytype=
-    process_name: nslookup.exe
+    process.file.name: nslookup.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -46,34 +46,10 @@ tags:
     to DNS exfiltration.
   mitre_attack_id:
   - T1048
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 72

dev_ssa/endpoint/ssa___fsutil_zeroing_file.yml

@@ -12,8 +12,8 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains: setzerodata
-    process_name: fsutil.exe
+    process.cmd_line|contains: setzerodata
+    process.file.name: fsutil.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -37,34 +37,10 @@ tags:
     deletion.
   mitre_attack_id:
   - T1070
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 54

dev_ssa/endpoint/ssa___grant_permission_using_cacls_utility.yml

@@ -13,11 +13,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name:
+    process.file.name:
     - icacls.exe
     - xcacls.exe
     - cacls.exe
-    process|re: grant
+    process.cmd_line|re: grant
   condition: (selection1)
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -38,26 +38,10 @@ tags:
     user a permission to a file or directory in host $dest_device_id$
   mitre_attack_id:
   - T1222
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml

@@ -13,8 +13,8 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: attrib.exe
-    process|re: ''
+    process.file.name: attrib.exe
+    process.cmd_line|re: ''
   condition: selection1
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
@@ -38,24 +38,10 @@ tags:
   mitre_attack_id:
   - T1222.001
   - T1222
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  - name: dest
-    type: Endpoint
-    role:
-    - Victim
-  - name: parent_process
-    type: Other
-    role:
-    - Attacker
-    - Parent Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 72

dev_ssa/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml

@@ -15,12 +15,12 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|re:
+    process.cmd_line|re:
     - 'S-1-1-0:'
     - 'SYSTEM:'
     - 'everyone:'
   selection2:
-    process_name:
+    process.file.name:
     - icacls.exe
     - xcacls.exe
     - cacls.exe
@@ -43,26 +43,10 @@ tags:
     a permission of a file or directory in host $dest_device_id$
   mitre_attack_id:
   - T1222
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___office_product_spawning_windows_script_host.yml

@@ -12,10 +12,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name:
+    process.file.name:
     - cscript.exe
     - wscript.exe
-    parent_process_name|re:
+    actor.process.file.name|re:
     - visio.exe
     - mspub.exe
     - powerpnt.exe
@@ -41,33 +41,10 @@ tags:
   mitre_attack_id:
   - T1566
   - T1566.001
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 63

dev_ssa/endpoint/ssa___resize_shadowstorage_volume.yml

@@ -13,13 +13,13 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains: shadowstorage
+    process.cmd_line|contains: shadowstorage
   selection2:
-    process|contains: resize
+    process.cmd_line|contains: resize
   selection3:
-    process|contains: maxsize
+    process.cmd_line|contains: maxsize
   selection4:
-    process_name: vssadmin.exe
+    process.file.name: vssadmin.exe
   condition: selection1 and selection2 and selection3 and selection4
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -42,34 +42,10 @@ tags:
     copy to perform offline password cracking.
   mitre_attack_id:
   - T1489
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 64

dev_ssa/endpoint/ssa___sdelete_application_execution.yml

@@ -14,7 +14,7 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - .xls
     - .gz
     - .tar
@@ -42,7 +42,7 @@ search:
     - '-p '
     - '-f '
     - '-c '
-    process_name|contains: sdelete
+    process.file.name|contains: sdelete
   condition: (selection1)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -66,36 +66,10 @@ tags:
   - T1485
   - T1070.004
   - T1070
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest
-  - user
-  - parent_process_name
-  - parent_process
-  - process_name
-  - process
-  - process_id
-  - process_path
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 42

dev_ssa/endpoint/ssa___system_process_running_from_unexpected_location.yml

@@ -15,7 +15,7 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name:
+    process.file.name:
     - xwizard.exe
     - xpsrchvw.exe
     - xcopy.exe
@@ -577,9 +577,9 @@ search:
     - adaptertroubleshooter.exe
     - arp.exe
   selection2:
-    process_path|re: \\windows\\syswow64
+    process.file.path|re: \\windows\\syswow64
   selection3:
-    process_path|re: \\windows\\system32
+    process.file.path|re: \\windows\\system32
   condition: selection1 and not selection2 and not selection3
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 known_false_positives: None
@@ -595,23 +595,10 @@ tags:
     folder path in host $dest_device_id$
   mitre_attack_id:
   - T1036
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 56

dev_ssa/endpoint/ssa___wbadmin_delete_system_backups.yml

@@ -12,9 +12,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: wbadmin.exe
+    process.file.name: wbadmin.exe
   selection2:
-    process|contains:
+    process.cmd_line|contains:
     - systemstatebackup
     - catalog
     - delete
@@ -40,34 +40,10 @@ tags:
     backups.
   mitre_attack_id:
   - T1490
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 15

dev_ssa/endpoint/ssa___wevtutil_usage_to_clear_logs.yml

@@ -12,15 +12,15 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|re:
+    process.cmd_line|re:
     - powershell
     - setup
     - application
     - sysmon
     - system
     - security
-    process|contains: ' cl '
-    process_name: wevtutil.exe
+    process.cmd_line|contains: ' cl '
+    process.file.name: wevtutil.exe
   condition: (selection1)
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
@@ -41,30 +41,15 @@ tags:
   asset_type: Endpoint
   confidence: 90
   impact: 70
-  message: A wevtutil process $process_name$ with commandline $process$ to clear
-    event logs in host $dest_device_id$
+  message: A wevtutil process $process_name$ with commandline $process$ to clear event
+    logs in host $dest_device_id$
   mitre_attack_id:
   - T1070
   - T1070.001
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 63

dev_ssa/endpoint/ssa___wevtutil_usage_to_disable_logs.yml

@@ -12,11 +12,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains: /e:false
+    process.cmd_line|contains: /e:false
   selection2:
-    process|contains: ' sl '
+    process.cmd_line|contains: ' sl '
   selection3:
-    process_name: wevtutil.exe
+    process.file.name: wevtutil.exe
   condition: selection1 and selection2 and selection3
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
@@ -41,25 +41,10 @@ tags:
   mitre_attack_id:
   - T1070
   - T1070.001
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 63

dev_ssa/endpoint/ssa___windows_bits_job_persistence.yml

@@ -16,7 +16,7 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - resume
     - setcustomheaders
     - setminretrydelay
@@ -24,7 +24,7 @@ search:
     - setnotifyflags
     - addfile
     - create
-    process_name: bitsadmin.exe
+    process.file.name: bitsadmin.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -50,34 +50,10 @@ tags:
     on endpoint $dest$ by user $dest_user_id$ attempting to persist using BITS.
   mitre_attack_id:
   - T1197
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 56

dev_ssa/endpoint/ssa___windows_bitsadmin_download_file.yml

@@ -21,8 +21,8 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains: transfer
-    process_name: bitsadmin.exe
+    process.cmd_line|contains: transfer
+    process.file.name: bitsadmin.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -50,34 +50,10 @@ tags:
   mitre_attack_id:
   - T1197
   - T1105
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 49

dev_ssa/endpoint/ssa___windows_certutil_decode_file.yml

@@ -17,8 +17,8 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains: decode
-    process_name: certutil.exe
+    process.cmd_line|contains: decode
+    process.file.name: certutil.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -45,34 +45,10 @@ tags:
     on disk.
   mitre_attack_id:
   - T1140
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 40

dev_ssa/endpoint/ssa___windows_certutil_urlcache_download.yml

@@ -16,13 +16,13 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: certutil.exe
+    process.file.name: certutil.exe
   selection2:
-    process|contains: split
+    process.cmd_line|contains: split
   selection3:
-    process|contains: urlcache
+    process.cmd_line|contains: urlcache
   selection4:
-    process|contains: urlcache
+    process.cmd_line|contains: urlcache
   condition: selection1 and selection2 and selection3 or selection4
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -45,34 +45,10 @@ tags:
     on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
   mitre_attack_id:
   - T1105
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 90

dev_ssa/endpoint/ssa___windows_certutil_verifyctl_download.yml

@@ -16,13 +16,13 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: certutil.exe
+    process.file.name: certutil.exe
   selection2:
-    process|contains: split
+    process.cmd_line|contains: split
   selection3:
-    process|contains: verifyctl
+    process.cmd_line|contains: verifyctl
   selection4:
-    process|contains: verifyctl
+    process.cmd_line|contains: verifyctl
   condition: selection1 and selection2 and selection3 or selection4
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -46,34 +46,10 @@ tags:
     on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
   mitre_attack_id:
   - T1105
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 90

dev_ssa/endpoint/ssa___windows_com_hijacking_inprocserver32_modification.yml

@@ -17,8 +17,8 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|re: inprocserver32
-    process_name: reg.exe
+    process.cmd_line|re: inprocserver32
+    process.file.name: reg.exe
   condition: selection1
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -40,34 +40,10 @@ tags:
   mitre_attack_id:
   - T1546.015
   - T1546
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 64

dev_ssa/endpoint/ssa___windows_curl_upload_to_remote_destination.yml

@@ -27,13 +27,13 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - '-F '
     - '--data '
     - '-d '
     - '--upload-file '
     - '-T '
-    process_name|re: curl.exe
+    process.file.name|re: curl.exe
   condition: selection1
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -56,34 +56,10 @@ tags:
     destination.
   mitre_attack_id:
   - T1105
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 80

dev_ssa/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml

@@ -11,11 +11,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name|re: mpcmdrun.exe
+    process.file.name|re: mpcmdrun.exe
   selection2:
-    process_path|re: \\windows defender
+    process.file.path|re: \\windows defender
   selection3:
-    process_path|re: \\microsoft\\windows defender\\platform
+    process.file.path|re: \\microsoft\\windows defender\\platform
   condition: selection1 and not selection2 and not selection3
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 known_false_positives: False positives may be present and filtering may be required.
@@ -33,24 +33,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
-  - process
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 56

dev_ssa/endpoint/ssa___windows_diskshadow_proxy_execution.yml

@@ -15,10 +15,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - /s
     - -S
-    process_name: diskshadow.exe
+    process.file.name: diskshadow.exe
   condition: selection1
 how_to_implement: To successfully implement this search you need to be ingesting information
   on processes that include the name of the process responsible for the changes from
@@ -37,34 +37,10 @@ tags:
     on endpoint $dest_device_id$ by user $dest_user_id$ attempting to run a script.
   mitre_attack_id:
   - T1218
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 49

dev_ssa/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml

@@ -15,7 +15,7 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name|re:
+    process.file.name|re:
     - MSBuild.exe
     - comsvcconfig.exe
     - dfsradmin.exe
@@ -60,7 +60,7 @@ search:
     - filehistory.exe
     - secureassessmentbrowser.exe
   selection2:
-    process_path|re:
+    process.file.path|re:
     - \\windows\\system32
     - \\windows\\syswow64
     - \\windows\\adws
@@ -95,24 +95,10 @@ tags:
   - T1036.003
   - T1218
   - T1218.004
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
-  - process
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 49

dev_ssa/endpoint/ssa___windows_exchange_powershell_module_usage.yml

@@ -28,10 +28,10 @@ description: 'The following analytic identifies the usage of Exchange PowerShell
   This cmdlet returns all mail-enabled objects (for example, mailboxes, mail users,
   mail contacts, and distribution groups).'
 data_source:
-- Windows Security 4688
+- Powershell 4104
 search:
   selection1:
-    process|re:
+    process.cmd_line|re:
     - get-recipient
     - new-mailboxsearch
     - new-managementroleassignment
@@ -63,22 +63,10 @@ tags:
   mitre_attack_id:
   - T1059
   - T1059.001
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 32

dev_ssa/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml

@@ -14,20 +14,20 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - ms-msdt:/id
     - ms-msdt:-id
     - ms-msdt:/id
     - 'ms-msdt:'
     - msdt
-    process_name: msdt.exe
+    process.file.name: msdt.exe
   selection2:
-    process|re:
+    process.cmd_line|re:
     - .xml
     - it_rebrowseforfile=
     - it_browseforfile=
   selection3:
-    process|re: pcwdiagnostic
+    process.cmd_line|re: pcwdiagnostic
   condition: selection1 and selection2 and selection3
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -54,30 +54,10 @@ tags:
     of indirect command execution.
   mitre_attack_id:
   - T1218
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 100

dev_ssa/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml

@@ -17,10 +17,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - https://
     - http://
-    process_name: explorer.exe
+    process.file.name: explorer.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -40,34 +40,10 @@ tags:
     destination to download an additional payload.
   mitre_attack_id:
   - T1105
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 25

dev_ssa/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml

@@ -12,9 +12,9 @@ description: The following analytic identifies native living off the land binari
   regedit.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries.
 data_source:
 - Windows Security 4688
-search: 
+search:
   selection1:
-    process_name:
+    process.file.name:
     - bitsadmin.exe
     - certoc.exe
     - certreq.exe
@@ -96,7 +96,7 @@ search:
     - wuauclt.exe
     - xwizard.exe
   selection2:
-    process_path|re:
+    process.file.path|re:
     - (?i)\\windows\\system32
     - (?i)\\windows\\syswow64
     - (?i)\\windows\\networkcontrolle
@@ -128,24 +128,10 @@ tags:
   - T1036.003
   - T1218
   - T1218.004
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
-  - process
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 49

dev_ssa/endpoint/ssa___windows_mshta_child_process.yml

@@ -13,7 +13,7 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name:
+    process.file.name:
     - wscript.exe
     - cscript.exe
     - searchprotocolhost.exe
@@ -23,7 +23,7 @@ search:
     - scrcons.exe
     - cmd.exe
     - powershell.exe
-    parent_process_name|endswith: mshta.exe
+    actor.process.file.name|endswith: mshta.exe
   condition: selection1
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -47,34 +47,10 @@ tags:
   mitre_attack_id:
   - T1218.005
   - T1218
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 80

dev_ssa/endpoint/ssa___windows_mshta_command_line_url.yml

@@ -16,10 +16,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - https://
     - http://
-    process_name: mshta.exe
+    process.file.name: mshta.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -45,34 +45,10 @@ tags:
   mitre_attack_id:
   - T1218.005
   - T1218
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 80

dev_ssa/endpoint/ssa___windows_mshta_inline_hta_execution.yml

@@ -14,11 +14,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - about
     - javascript
     - vbscript
-    process_name: mshta.exe
+    process.file.name: mshta.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -44,34 +44,10 @@ tags:
   mitre_attack_id:
   - T1218.005
   - T1218
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 80

dev_ssa/endpoint/ssa___windows_odbcconf_load_response_file.yml

@@ -14,12 +14,12 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - '/f '
     - '-f '
-    process_name: odbcconf.exe
+    process.file.name: odbcconf.exe
   selection2:
-    process|contains: .rsp
+    process.cmd_line|contains: .rsp
   condition: (selection1) and selection2
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -41,30 +41,10 @@ tags:
   mitre_attack_id:
   - T1218.008
   - T1218
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 42

dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml

@@ -20,11 +20,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: ntdsutil.exe
+    process.file.name: ntdsutil.exe
   selection2:
-    process|contains: create
+    process.cmd_line|contains: create
   selection3:
-    process|contains: ntds
+    process.cmd_line|contains: ntds
   condition: selection1 and (selection2 and selection3)
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -50,30 +50,10 @@ tags:
   mitre_attack_id:
   - T1003.003
   - T1003
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 50

dev_ssa/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml

@@ -19,14 +19,14 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - '-ma '
     - '-mm '
-    process_name:
+    process.file.name:
     - procdump64.exe
     - procdump.exe
   selection2:
-    process|contains: lsass
+    process.cmd_line|contains: lsass
   condition: (selection1) and selection2
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -49,30 +49,10 @@ tags:
   mitre_attack_id:
   - T1003.001
   - T1003
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 80

dev_ssa/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml

@@ -18,7 +18,7 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name:
+    process.file.name:
     - powershell_ise.exe
     - powershell.exe
     - sqltoolsps.exe
@@ -26,7 +26,7 @@ search:
     - pwsh.exe
     - pwsh.exe
   selection2:
-    process|re: '(?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]'
+    process.cmd_line|re: (?i)[\-|\/]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]
   condition: selection1 and not selection2
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
@@ -55,34 +55,10 @@ tags:
     $dest$ executed by user $user$.
   mitre_attack_id:
   - T1020
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml

@@ -14,12 +14,12 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack
   their passwords offline.
 data_source:
-- Windows Security 4688
+- Powershell 4104
 search:
   selection1:
-    process|contains: '4194304'
+    process.cmd_line|contains: '4194304'
   selection2:
-    process|re: get-aduser
+    process.cmd_line|re: get-aduser
   condition: selection1 and selection2
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -40,22 +40,10 @@ tags:
   mitre_attack_id:
   - T1558
   - T1558.004
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 54

dev_ssa/endpoint/ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml

@@ -14,12 +14,12 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts
   and attempt to crack their passwords offline.
 data_source:
-- Windows Security 4688
+- Powershell 4104
 search:
   selection1:
-    process|re: preauthnotrequired
+    process.cmd_line|re: preauthnotrequired
   selection2:
-    process|re: get-domainuser
+    process.cmd_line|re: get-domainuser
   condition: selection1 and selection2
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -39,22 +39,10 @@ tags:
   mitre_attack_id:
   - T1558
   - T1558.004
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 54

dev_ssa/endpoint/ssa___windows_powershell_downloadfile.yml

@@ -14,7 +14,7 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name:
+    process.file.name:
     - powershell_ise.exe
     - powershell.exe
     - sqltoolsps.exe
@@ -22,7 +22,7 @@ search:
     - pwsh.exe
     - pwsh.exe
   selection2:
-    process|re: downloadfile
+    process.cmd_line|re: downloadfile
   condition: selection1 and selection2
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -49,34 +49,10 @@ tags:
     within PowerShell.
   mitre_attack_id:
   - T1020
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___windows_powershell_start_bitstransfer.yml

@@ -16,7 +16,7 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name:
+    process.file.name:
     - powershell_ise.exe
     - powershell.exe
     - sqltoolsps.exe
@@ -24,7 +24,7 @@ search:
     - pwsh.exe
     - pwsh.exe
   selection2:
-    process|re: start-bitstransfer
+    process.cmd_line|re: start-bitstransfer
   condition: selection1 and selection2
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -47,34 +47,10 @@ tags:
   mitre_attack_id:
   - T1197
   - T1105
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 49

dev_ssa/endpoint/ssa___windows_rasautou_dll_execution.yml

@@ -13,11 +13,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: rasautou.exe
+    process.file.name: rasautou.exe
   selection2:
-    process|re: '-p '
+    process.cmd_line|re: '-p '
   selection3:
-    process|re: '-d '
+    process.cmd_line|re: '-d '
   condition: selection1 and selection2 and selection3
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -44,34 +44,10 @@ tags:
   - T1055.001
   - T1218
   - T1055
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 80

dev_ssa/endpoint/ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml

@@ -13,9 +13,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: acccheckconsole.exe
+    process.file.name: acccheckconsole.exe
   selection2:
-    process_path|re: \\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker
+    process.file.path|re: \\program files (x86)\\windows kits\\10\\bin\\10.0.22000.0\\arm64\\accchecker
   condition: selection1 and not selection2
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -39,23 +39,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 14

dev_ssa/endpoint/ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml

@@ -13,9 +13,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: adplus.exe
+    process.file.name: adplus.exe
   selection2:
-    process_path|re: \\program files (x86)\\windows kits\\10\\debuggers\\x86
+    process.file.path|re: \\program files (x86)\\windows kits\\10\\debuggers\\x86
   condition: selection1 and not selection2
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -39,23 +39,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 14

dev_ssa/endpoint/ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml

@@ -13,9 +13,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: advpack.dll
+    process.file.name: advpack.dll
   selection2:
-    process_path|re: \\windows\\syswow64
+    process.file.path|re: \\windows\\syswow64
   condition: selection1 and not selection2
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -39,23 +39,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 14

dev_ssa/endpoint/ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml

@@ -13,9 +13,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: agentexecutor.exe
+    process.file.name: agentexecutor.exe
   selection2:
-    process_path|re: \\program files (x86)
+    process.file.path|re: \\program files (x86)
   condition: selection1 and not selection2
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -39,23 +39,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 14

dev_ssa/endpoint/ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml

@@ -13,9 +13,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: appinstaller.exe
+    process.file.name: appinstaller.exe
   selection2:
-    process_path|re: \\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe
+    process.file.path|re: \\program files\\windowsapps\\microsoft.desktopappinstaller_1.11.2521.0_x64__8wekyb3d8bbwe
   condition: selection1 and not selection2
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -39,23 +39,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 14

dev_ssa/endpoint/ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml

@@ -13,9 +13,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: appvlp.exe
+    process.file.name: appvlp.exe
   selection2:
-    process_path|re: \\program files (x86)\\microsoft office\\root\\client
+    process.file.path|re: \\program files (x86)\\microsoft office\\root\\client
   condition: selection1 and not selection2
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -39,23 +39,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 14

dev_ssa/endpoint/ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml

@@ -13,9 +13,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: aspnet_compiler.exe
+    process.file.name: aspnet_compiler.exe
   selection2:
-    process_path|re: \\windows\\microsoft.net\\framework64\\v4.0.30319
+    process.file.path|re: \\windows\\microsoft.net\\framework64\\v4.0.30319
   condition: selection1 and not selection2
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -39,23 +39,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 14

dev_ssa/endpoint/ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml

@@ -13,9 +13,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: at.exe
+    process.file.name: at.exe
   selection2:
-    process_path|re: \\windows\\syswow64
+    process.file.path|re: \\windows\\syswow64
   condition: selection1 and not selection2
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -39,23 +39,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 14

dev_ssa/endpoint/ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml

@@ -13,9 +13,9 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: atbroker.exe
+    process.file.name: atbroker.exe
   selection2:
-    process_path|re: \\windows\\syswow64
+    process.file.path|re: \\windows\\syswow64
   condition: selection1 and not selection2
 how_to_implement: To successfully implement this search, you must be ingesting logs
   with the process name, command-line arguments, and parent processes from your endpoints.
@@ -39,23 +39,10 @@ tags:
   mitre_attack_id:
   - T1036
   - T1036.003
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 14

dev_ssa/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml

@@ -12,10 +12,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|re: minidump
-    process_name: 'rundll32.exe'
+    process.cmd_line|re: minidump
+    process.file.name: rundll32.exe
   selection2:
-    process|re: comsvcs.dll
+    process.cmd_line|re: comsvcs.dll
   condition: selection1 and selection2
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including Windows command line logging. You can see how we test this with [Event
@@ -37,23 +37,10 @@ tags:
   mitre_attack_id:
   - T1003.003
   - T1003
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Actor
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - process_name
-  - _tenant
-  - _time
-  - dest_device_id
-  - process
+  required_fields: []
   kill_chain_phases:
   - Actions on Objectives
   risk_score: 40

dev_ssa/endpoint/ssa___windows_rundll32_inline_hta_execution.yml

@@ -16,11 +16,11 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - about
     - javascript
     - vbscript
-    process_name: rundll32.exe
+    process.file.name: rundll32.exe
   condition: selection1
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -45,34 +45,10 @@ tags:
   mitre_attack_id:
   - T1218
   - T1218.005
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 56

dev_ssa/endpoint/ssa___windows_script_host_spawn_msbuild.yml

@@ -15,10 +15,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: MSBuild.exe
-    parent_process_name|re:
-    - 'cscript.exe'
-    - 'wscript.exe'
+    process.file.name: MSBuild.exe
+    actor.process.file.name|re:
+    - cscript.exe
+    - wscript.exe
   condition: selection1
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -42,34 +42,10 @@ tags:
   mitre_attack_id:
   - T1127.001
   - T1127
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process Name
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 80

dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml

@@ -15,8 +15,8 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains: -decompile
-    process_name: hh.exe
+    process.cmd_line|contains: -decompile
+    process.file.name: hh.exe
   condition: selection1
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -40,30 +40,10 @@ tags:
   mitre_attack_id:
   - T1218.001
   - T1218
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 90

dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml

@@ -20,10 +20,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - https://
     - http://
-    process_name: hh.exe
+    process.file.name: hh.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -50,30 +50,10 @@ tags:
   mitre_attack_id:
   - T1218.001
   - T1218
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 90

dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml

@@ -23,10 +23,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - 'mk:@MSITStore:'
     - 'its:'
-    process_name: hh.exe
+    process.file.name: hh.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -53,30 +53,10 @@ tags:
   mitre_attack_id:
   - T1218.001
   - T1218
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 72

dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml

@@ -12,10 +12,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - '-y '
     - '/y '
-    process_name: msiexec.exe
+    process.file.name: msiexec.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -36,30 +36,10 @@ tags:
     by user $dest_user_id$ attempting to register a file.
   mitre_attack_id:
   - T1218.007
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml

@@ -12,10 +12,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - https://
     - http://
-    process_name: msiexec.exe
+    process.file.name: msiexec.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -36,30 +36,10 @@ tags:
     by user $dest_user_id$ attempting to download a file.
   mitre_attack_id:
   - T1218.007
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml

@@ -12,10 +12,10 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process|contains:
+    process.cmd_line|contains:
     - '-z '
     - '/z '
-    process_name: msiexec.exe
+    process.file.name: msiexec.exe
   condition: (selection1)
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -36,30 +36,10 @@ tags:
     by user $dest_user_id$ attempting to unregister a DLL.
   mitre_attack_id:
   - T1218.007
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 35

dev_ssa/endpoint/ssa___windows_wmiprvse_spawn_msbuild.yml

@@ -16,8 +16,8 @@ data_source:
 - Windows Security 4688
 search:
   selection1:
-    process_name: MSBuild.exe
-    parent_process_name|re: wmiprvse.exe
+    process.file.name: MSBuild.exe
+    actor.process.file.name|re: wmiprvse.exe
   condition: selection1
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -41,34 +41,10 @@ tags:
   mitre_attack_id:
   - T1127
   - T1127.001
-  observable:
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: parent_process_name
-    type: Process Name
-    role:
-    - Parent Process
-  - name: process_name
-    type: Process
-    role:
-    - Child Process
+  observable: []
   product:
   - Splunk Behavioral Analytics
-  required_fields:
-  - _time
-  - dest_device_id
-  - process_name
-  - parent_process_name
-  - process_path
-  - dest_user_id
-  - process
-  - process
+  required_fields: []
   kill_chain_phases:
   - Exploitation
   risk_score: 80

dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml

@@ -11,18 +11,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") OR like(process_file_name,
-  "winzip%")) AND (like(actor_process_file_name, "%powershell.exe") OR like(actor_process_file_name,
-  "%cmd.exe")) 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%")
+  OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, "%powershell.exe")
+  OR like(actor_process_file_name, "%cmd.exe")) 
   | eval body=create_map(
     "devices", [
         create_map(
@@ -30,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.process.file.name", actor_process_file_name),
-    "message", concat("Anomalous usage of Archive Tools has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Anomalous usage of Archive Tools has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -59,11 +59,15 @@ references:
 - https://attack.mitre.org/techniques/T1560/001/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
   - actor.process.file.name
+  - device.hostname
   risk_score: 42
   security_domain: endpoint
   risk_severity: low
@@ -78,7 +82,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___attempt_to_delete_services.yml

@@ -14,16 +14,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%delete%") AND process_file_name="sc.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where process_file_name="sc.exe" AND like(process_cmd_line, "%delete%")
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -31,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Attempt To Delete Services has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Attempt To Delete Services has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -62,10 +63,15 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 36
   security_domain: endpoint
   risk_severity: low
@@ -80,7 +86,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___attempt_to_disable_services.yml

@@ -14,17 +14,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%") AND
-  process_file_name="sc.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where like(process_cmd_line, "%config%") AND like(process_cmd_line, "%disabled%")
+  AND process_file_name="sc.exe" 
   | eval body=create_map(
     "devices", [
         create_map(
@@ -32,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Attempt To Disable Services has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Attempt To Disable Services has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -64,10 +64,15 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 36
   security_domain: endpoint
   risk_severity: low
@@ -82,7 +87,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -12,16 +12,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line,
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (process_file_name="reg.exe" OR process_file_name="cmd.exe") AND (match_regex(process_cmd_line,
   /(?i)HKEY_LOCAL_MACHINE\\System/)=true OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true
   OR match_regex(process_cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(process_cmd_line,
   /(?i)HKLM\\System/)=true OR match_regex(process_cmd_line, /(?i)HKLM\\SAM/)=true
@@ -34,11 +34,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Attempted Credential Dump From Registry via Reg exe has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Attempted Credential Dump From Registry via Reg exe has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -64,10 +64,15 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 63
   security_domain: endpoint
   risk_severity: medium
@@ -82,7 +87,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml

@@ -12,17 +12,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%") AND like(process_cmd_line,
-  "%recoveryenabled%")) 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where process_file_name="bcdedit.exe" AND (like(process_cmd_line, "%no%")
+  AND like(process_cmd_line, "%recoveryenabled%")) 
   | eval body=create_map(
     "devices", [
         create_map(
@@ -30,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("BCDEdit Failure Recovery Modification has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("BCDEdit Failure Recovery Modification has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -58,10 +58,15 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 80
   security_domain: endpoint
   risk_severity: high
@@ -76,7 +81,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml

@@ -12,16 +12,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%/W:%") AND process_file_name="cipher.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where process_file_name="cipher.exe" AND like(process_cmd_line, "%/W:%")
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -29,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Clear Unallocated Sector Using Cipher App has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Clear Unallocated Sector Using Cipher App has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -58,10 +59,15 @@ references:
 - https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 90
   security_domain: endpoint
   risk_severity: high
@@ -76,7 +82,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___delete_a_net_user.yml

@@ -15,17 +15,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%") AND (process_file_name="net.exe"
-  OR process_file_name="net1.exe") 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/delete%")
+  AND (process_file_name="net.exe" OR process_file_name="net1.exe") 
   | eval body=create_map(
     "devices", [
         create_map(
@@ -33,11 +33,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Delete A Net User has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Delete A Net User has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -63,10 +63,15 @@ references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 49
   security_domain: endpoint
   risk_severity: low
@@ -81,7 +86,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml

@@ -13,17 +13,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  match_regex(process_cmd_line, /(?i)deny/)=true AND (process_file_name="icacls.exe"
-  OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe"
+  OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)deny/)=true
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -31,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Deny Permission using Cacls Utility has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Deny Permission using Cacls Utility has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -61,10 +62,15 @@ references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 35
   security_domain: endpoint
   risk_severity: low
@@ -79,7 +85,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml

@@ -13,18 +13,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe" OR
-  actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe" OR
-  actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe"
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe"
+  OR actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe"
+  OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe"
   OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe"
   OR actor_process_file_name="powershell.exe") OR (actor_process_file_name="java.exe"
   AND (NOT match_regex(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe"
@@ -36,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.cmd_line", process_cmd_line, "actor.process.file.name", actor_process_file_name),
-    "message", concat("Detect Prohibited Applications Spawning cmd exe has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Detect Prohibited Applications Spawning cmd exe has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -65,10 +65,15 @@ references:
 - https://attack.mitre.org/techniques/T1059/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
+  - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
   - actor.process.file.name
+  - device.hostname
   risk_score: 35
   security_domain: endpoint
   risk_severity: low
@@ -83,7 +88,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml

@@ -16,21 +16,22 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (like(process_cmd_line, "%--multi-thread-streams%") OR like(process_cmd_line, "%--transfers%")
-  OR like(process_cmd_line, "%--auto-confirm%") OR like(process_cmd_line, "%--ignore-existing%")
-  OR like(process_cmd_line, "%--no-check-certificate%") OR like(process_cmd_line,
-  "%--progress%") OR like(process_cmd_line, "%--config%") OR like(process_cmd_line,
-  "%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line, "%mega%")
-  OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (like(process_cmd_line, "%--multi-thread-streams%") OR like(process_cmd_line,
+  "%--transfers%") OR like(process_cmd_line, "%--auto-confirm%") OR like(process_cmd_line,
+  "%--ignore-existing%") OR like(process_cmd_line, "%--no-check-certificate%") OR
+  like(process_cmd_line, "%--progress%") OR like(process_cmd_line, "%--config%") OR
+  like(process_cmd_line, "%ftp%") OR like(process_cmd_line, "%pcloud%") OR like(process_cmd_line,
+  "%mega%") OR like(process_cmd_line, "%copy%")) AND process_file_name="rclone.exe"
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -38,11 +39,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Detect RClone Command-Line Usage has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Detect RClone Command-Line Usage has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -70,10 +71,15 @@ references:
 - https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 35
   security_domain: endpoint
   risk_severity: low
@@ -88,7 +94,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___disable_net_user_account.yml

@@ -13,17 +13,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%") AND
-  (process_file_name="net.exe" OR process_file_name="net1.exe") 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where like(process_cmd_line, "%user%") AND like(process_cmd_line, "%/active:no%")
+  AND (process_file_name="net.exe" OR process_file_name="net1.exe") 
   | eval body=create_map(
     "devices", [
         create_map(
@@ -31,11 +31,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Disable Net User Account has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Disable Net User Account has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -62,10 +62,15 @@ references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 49
   security_domain: endpoint
   risk_severity: low
@@ -80,7 +85,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml

@@ -15,18 +15,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%") OR like(process_cmd_line,
-  "%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line, "%-querytype=%"))
-  AND process_file_name="nslookup.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (like(process_cmd_line, "%-retry=%") OR like(process_cmd_line, "%-type=%")
+  OR like(process_cmd_line, "%-q=%") OR like(process_cmd_line, "%-qt=%") OR like(process_cmd_line,
+  "%-querytype=%")) AND process_file_name="nslookup.exe" 
   | eval body=create_map(
     "devices", [
         create_map(
@@ -34,11 +34,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("DNS Exfiltration Using Nslookup App has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("DNS Exfiltration Using Nslookup App has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -65,10 +65,15 @@ references:
 - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 72
   security_domain: endpoint
   risk_severity: medium
@@ -83,7 +88,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___fsutil_zeroing_file.yml

@@ -12,16 +12,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where like(process_cmd_line, "%setzerodata%") AND process_file_name="fsutil.exe"
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -29,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Fsutil Zeroing File has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Fsutil Zeroing File has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -60,10 +61,15 @@ references:
 - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 54
   security_domain: endpoint
   risk_severity: medium
@@ -78,7 +84,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml

@@ -13,17 +13,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  match_regex(process_cmd_line, /(?i)grant/)=true AND (process_file_name="icacls.exe"
-  OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe") 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (process_file_name="icacls.exe" OR process_file_name="xcacls.exe"
+  OR process_file_name="cacls.exe") AND match_regex(process_cmd_line, /(?i)grant/)=true
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -31,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Grant Permission Using Cacls Utility has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Grant Permission Using Cacls Utility has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -61,10 +62,15 @@ references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 35
   security_domain: endpoint
   risk_severity: low
@@ -79,7 +85,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml

@@ -13,16 +13,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  match_regex(process_cmd_line, /(?i)/)=true AND process_file_name="attrib.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where process_file_name="attrib.exe" AND match_regex(process_cmd_line, /(?i)/)=true
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -30,11 +31,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Hiding Files And Directories With Attrib exe has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Hiding Files And Directories With Attrib exe has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -61,10 +62,15 @@ references:
 - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 72
   security_domain: endpoint
   risk_severity: medium
@@ -79,7 +85,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml

@@ -15,16 +15,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (match_regex(process_cmd_line, /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line,
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (match_regex(process_cmd_line, /(?i)S-1-1-0:/)=true OR match_regex(process_cmd_line,
   /(?i)SYSTEM:/)=true OR match_regex(process_cmd_line, /(?i)everyone:/)=true) AND
   (process_file_name="icacls.exe" OR process_file_name="xcacls.exe" OR process_file_name="cacls.exe")
   
@@ -35,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Modify ACLs Permission Of Files Or Folders has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Modify ACLs Permission Of Files Or Folders has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -65,10 +65,15 @@ references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 35
   security_domain: endpoint
   risk_severity: low
@@ -83,7 +88,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___office_product_spawning_windows_script_host.yml

@@ -12,20 +12,20 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name,
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (process_file_name="cscript.exe" OR process_file_name="wscript.exe")
+  AND (match_regex(actor_process_file_name, /(?i)visio.exe/)=true OR match_regex(actor_process_file_name,
   /(?i)mspub.exe/)=true OR match_regex(actor_process_file_name, /(?i)powerpnt.exe/)=true
   OR match_regex(actor_process_file_name, /(?i)excel.exe/)=true OR match_regex(actor_process_file_name,
-  /(?i)winword.exe/)=true) AND (process_file_name="cscript.exe" OR process_file_name="wscript.exe")
-  
+  /(?i)winword.exe/)=true) 
   | eval body=create_map(
     "devices", [
         create_map(
@@ -33,11 +33,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.process.file.name", actor_process_file_name),
-    "message", concat("Office Product Spawning Windows Script Host has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Office Product Spawning Windows Script Host has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -63,11 +63,15 @@ references:
 - https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
   - actor.process.file.name
+  - device.hostname
   risk_score: 63
   security_domain: endpoint
   risk_severity: medium
@@ -82,7 +86,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___resize_shadowstorage_volume.yml

@@ -13,17 +13,18 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line, "%resize%")
-  AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where like(process_cmd_line, "%shadowstorage%") AND like(process_cmd_line,
+  "%resize%") AND like(process_cmd_line, "%maxsize%") AND process_file_name="vssadmin.exe"
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -31,11 +32,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Resize Shadowstorage Volume has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Resize Shadowstorage Volume has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -62,10 +63,15 @@ references:
 - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 64
   security_domain: endpoint
   risk_severity: medium
@@ -80,7 +86,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___sdelete_application_execution.yml

@@ -14,27 +14,27 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (like(process_cmd_line, "%.xls%") OR like(process_cmd_line, "%.gz%") OR like(process_cmd_line,
-  "%.tar%") OR like(process_cmd_line, "%.rar%") OR like(process_cmd_line, "%.zip%")
-  OR like(process_cmd_line, "%.7z%") OR like(process_cmd_line, "%.bmp%") OR like(process_cmd_line,
-  "%.gif%") OR like(process_cmd_line, "%.png%") OR like(process_cmd_line, "%.jpg%")
-  OR like(process_cmd_line, "%.txt%") OR like(process_cmd_line, "%.log%") OR like(process_cmd_line,
-  "%.key%") OR like(process_cmd_line, "%.pdf%") OR like(process_cmd_line, "%.rtf%")
-  OR like(process_cmd_line, "%.ppt%") OR like(process_cmd_line, "%.xls%") OR like(process_cmd_line,
-  "%.doc%") OR like(process_cmd_line, "%-nobanner%") OR like(process_cmd_line, "%/accepteula%")
-  OR like(process_cmd_line, "%-z %") OR like(process_cmd_line, "%-s %") OR like(process_cmd_line,
-  "%-q %") OR like(process_cmd_line, "%-r %") OR like(process_cmd_line, "%-p %") OR
-  like(process_cmd_line, "%-f %") OR like(process_cmd_line, "%-c %")) AND like(process_file_name,
-  "%sdelete%") 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (like(process_cmd_line, "%.xls%") OR like(process_cmd_line, "%.gz%")
+  OR like(process_cmd_line, "%.tar%") OR like(process_cmd_line, "%.rar%") OR like(process_cmd_line,
+  "%.zip%") OR like(process_cmd_line, "%.7z%") OR like(process_cmd_line, "%.bmp%")
+  OR like(process_cmd_line, "%.gif%") OR like(process_cmd_line, "%.png%") OR like(process_cmd_line,
+  "%.jpg%") OR like(process_cmd_line, "%.txt%") OR like(process_cmd_line, "%.log%")
+  OR like(process_cmd_line, "%.key%") OR like(process_cmd_line, "%.pdf%") OR like(process_cmd_line,
+  "%.rtf%") OR like(process_cmd_line, "%.ppt%") OR like(process_cmd_line, "%.xls%")
+  OR like(process_cmd_line, "%.doc%") OR like(process_cmd_line, "%-nobanner%") OR
+  like(process_cmd_line, "%/accepteula%") OR like(process_cmd_line, "%-z %") OR like(process_cmd_line,
+  "%-s %") OR like(process_cmd_line, "%-q %") OR like(process_cmd_line, "%-r %") OR
+  like(process_cmd_line, "%-p %") OR like(process_cmd_line, "%-f %") OR like(process_cmd_line,
+  "%-c %")) AND like(process_file_name, "%sdelete%") 
   | eval body=create_map(
     "devices", [
         create_map(
@@ -42,11 +42,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Sdelete Application Execution has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Sdelete Application Execution has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -73,10 +73,15 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 42
   security_domain: endpoint
   risk_severity: low
@@ -91,7 +96,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml

@@ -1,11 +1,11 @@
 name: System Process Running from Unexpected Location
 id: 28179107-099a-464a-94d3-08301e6c055f
-version: 5
-description: An attacker might try to use a different version of a system command
-  without overriding the original, or they might try to avoid some detections by running
-  the process from a different folder. This detection checks that a list of system
-  processes are run inside C:\\Windows\System32 or C:\\Windows\SysWOW64. The list
-  of system processes has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv
+version: 4
+description: An attacker tries might try to use different version of a system command
+  without overriding original, or they might try to avoid some detection running the
+  process from a different folder. This detection checks that a list of system processes
+  run inside C:\\Windows\System32 or C:\\Windows\SysWOW64 The list of system processes
+  has been extracted from https://github.com/splunk/security_content/blob/develop/lookups/is_windows_system_file.csv
   and the original detection https://github.com/splunk/security_content/blob/develop/detections/system_processes_run_from_unexpected_locations.yml
 search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long",
   null) | eval metadata = ucast(map_get(input_event, "metadata"),"map<string, any>",
@@ -15,64 +15,64 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (process_file_name="xwizard.exe" OR process_file_name="xpsrchvw.exe" OR process_file_name="xcopy.exe"
-  OR process_file_name="wusa.exe" OR process_file_name="wuauclt.exe" OR process_file_name="wuapp.exe"
-  OR process_file_name="wuapihost.exe" OR process_file_name="wsqmcons.exe" OR process_file_name="wsmprovhost.exe"
-  OR process_file_name="wscript.exe" OR process_file_name="write.exe" OR process_file_name="wpr.exe"
-  OR process_file_name="wpnpinst.exe" OR process_file_name="wowreg32.exe" OR process_file_name="wlrmdr.exe"
-  OR process_file_name="wlanext.exe" OR process_file_name="wksprt.exe" OR process_file_name="wkspbroker.exe"
-  OR process_file_name="wisptis.exe" OR process_file_name="winver.exe" OR process_file_name="winrshost.exe"
-  OR process_file_name="winrs.exe" OR process_file_name="winresume.exe" OR process_file_name="winlogon.exe"
-  OR process_file_name="winload.exe" OR process_file_name="wininit.exe" OR process_file_name="wimserv.exe"
-  OR process_file_name="wifitask.exe" OR process_file_name="wiawow64.exe" OR process_file_name="wiaacmgr.exe"
-  OR process_file_name="whoami.exe" OR process_file_name="where.exe" OR process_file_name="wextract.exe"
-  OR process_file_name="wevtutil.exe" OR process_file_name="wermgr.exe" OR process_file_name="wecutil.exe"
-  OR process_file_name="wbengine.exe" OR process_file_name="wbadmin.exe" OR process_file_name="waitfor.exe"
-  OR process_file_name="w32tm.exe" OR process_file_name="vssadmin.exe" OR process_file_name="vmicsvc.exe"
-  OR process_file_name="verifiergui.exe" OR process_file_name="verifier.exe" OR process_file_name="verclsid.exe"
-  OR process_file_name="vdsldr.exe" OR process_file_name="vds.exe" OR process_file_name="userinit.exe"
-  OR process_file_name="upnpcont.exe" OR process_file_name="unregmp2.exe" OR process_file_name="unlodctr.exe"
-  OR process_file_name="ucsvc.exe" OR process_file_name="tzutil.exe" OR process_file_name="tzsync.exe"
-  OR process_file_name="typeperf.exe" OR process_file_name="tskill.exe" OR process_file_name="tsdiscon.exe"
-  OR process_file_name="tscon.exe" OR process_file_name="tracerpt.exe" OR process_file_name="tpmvscmgrsvr.exe"
-  OR process_file_name="tpmvscmgr.exe" OR process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe"
-  OR process_file_name="taskmgr.exe" OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe"
-  OR process_file_name="taskhostw.exe" OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe"
-  OR process_file_name="takeown.exe" OR process_file_name="tabcal.exe" OR process_file_name="systray.exe"
-  OR process_file_name="systemreset.exe" OR process_file_name="systeminfo.exe" OR
-  process_file_name="syskey.exe" OR process_file_name="sxstrace.exe" OR process_file_name="svchost.exe"
-  OR process_file_name="subst.exe" OR process_file_name="srdelayed.exe" OR process_file_name="spreview.exe"
-  OR process_file_name="sppsvc.exe" OR process_file_name="spoolsv.exe" OR process_file_name="spinstall.exe"
-  OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe" OR process_file_name="smss.exe"
-  OR process_file_name="slui.exe" OR process_file_name="sihost.exe" OR process_file_name="sigverif.exe"
-  OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe" OR process_file_name="shadow.exe"
-  OR process_file_name="setx.exe" OR process_file_name="setupugc.exe" OR process_file_name="setupcl.exe"
-  OR process_file_name="setspn.exe" OR process_file_name="sethc.exe" OR process_file_name="sessionmsg.exe"
-  OR process_file_name="services.exe" OR process_file_name="secinit.exe" OR process_file_name="sdiagnhost.exe"
-  OR process_file_name="sdclt.exe" OR process_file_name="sdchange.exe" OR process_file_name="sdbinst.exe"
-  OR process_file_name="schtasks.exe" OR process_file_name="sc.exe" OR process_file_name="sbunattend.exe"
-  OR process_file_name="rwinsta.exe" OR process_file_name="runonce.exe" OR process_file_name="rundll32.exe"
-  OR process_file_name="runas.exe" OR process_file_name="rstrui.exe" OR process_file_name="rrinstaller.exe"
-  OR process_file_name="rmttpmvscmgrsvr.exe" OR process_file_name="resmon.exe" OR
-  process_file_name="reset.exe" OR process_file_name="replace.exe" OR process_file_name="repair-bde.exe"
-  OR process_file_name="relog.exe" OR process_file_name="rekeywiz.exe" OR process_file_name="regsvr32.exe"
-  OR process_file_name="regini.exe" OR process_file_name="regedt32.exe" OR process_file_name="reg.exe"
-  OR process_file_name="recover.exe" OR process_file_name="recdisc.exe" OR process_file_name="rdrleakdiag.exe"
-  OR process_file_name="rdpinput.exe" OR process_file_name="rdpclip.exe" OR process_file_name="rasphone.exe"
-  OR process_file_name="raserver.exe" OR process_file_name="rasdial.exe" OR process_file_name="rasautou.exe"
-  OR process_file_name="qwinsta.exe" OR process_file_name="quser.exe" OR process_file_name="query.exe"
-  OR process_file_name="qprocess.exe" OR process_file_name="qappsrv.exe" OR process_file_name="pwlauncher.exe"
-  OR process_file_name="psr.exe" OR process_file_name="provtool.exe" OR process_file_name="proquota.exe"
-  OR process_file_name="printui.exe" OR process_file_name="printfilterpipelinesvc.exe"
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (process_file_name="xwizard.exe" OR process_file_name="xpsrchvw.exe"
+  OR process_file_name="xcopy.exe" OR process_file_name="wusa.exe" OR process_file_name="wuauclt.exe"
+  OR process_file_name="wuapp.exe" OR process_file_name="wuapihost.exe" OR process_file_name="wsqmcons.exe"
+  OR process_file_name="wsmprovhost.exe" OR process_file_name="wscript.exe" OR process_file_name="write.exe"
+  OR process_file_name="wpr.exe" OR process_file_name="wpnpinst.exe" OR process_file_name="wowreg32.exe"
+  OR process_file_name="wlrmdr.exe" OR process_file_name="wlanext.exe" OR process_file_name="wksprt.exe"
+  OR process_file_name="wkspbroker.exe" OR process_file_name="wisptis.exe" OR process_file_name="winver.exe"
+  OR process_file_name="winrshost.exe" OR process_file_name="winrs.exe" OR process_file_name="winresume.exe"
+  OR process_file_name="winlogon.exe" OR process_file_name="winload.exe" OR process_file_name="wininit.exe"
+  OR process_file_name="wimserv.exe" OR process_file_name="wifitask.exe" OR process_file_name="wiawow64.exe"
+  OR process_file_name="wiaacmgr.exe" OR process_file_name="whoami.exe" OR process_file_name="where.exe"
+  OR process_file_name="wextract.exe" OR process_file_name="wevtutil.exe" OR process_file_name="wermgr.exe"
+  OR process_file_name="wecutil.exe" OR process_file_name="wbengine.exe" OR process_file_name="wbadmin.exe"
+  OR process_file_name="waitfor.exe" OR process_file_name="w32tm.exe" OR process_file_name="vssadmin.exe"
+  OR process_file_name="vmicsvc.exe" OR process_file_name="verifiergui.exe" OR process_file_name="verifier.exe"
+  OR process_file_name="verclsid.exe" OR process_file_name="vdsldr.exe" OR process_file_name="vds.exe"
+  OR process_file_name="userinit.exe" OR process_file_name="upnpcont.exe" OR process_file_name="unregmp2.exe"
+  OR process_file_name="unlodctr.exe" OR process_file_name="ucsvc.exe" OR process_file_name="tzutil.exe"
+  OR process_file_name="tzsync.exe" OR process_file_name="typeperf.exe" OR process_file_name="tskill.exe"
+  OR process_file_name="tsdiscon.exe" OR process_file_name="tscon.exe" OR process_file_name="tracerpt.exe"
+  OR process_file_name="tpmvscmgrsvr.exe" OR process_file_name="tpmvscmgr.exe" OR
+  process_file_name="timeout.exe" OR process_file_name="tcmsetup.exe" OR process_file_name="taskmgr.exe"
+  OR process_file_name="tasklist.exe" OR process_file_name="taskkill.exe" OR process_file_name="taskhostw.exe"
+  OR process_file_name="taskhost.exe" OR process_file_name="taskeng.exe" OR process_file_name="takeown.exe"
+  OR process_file_name="tabcal.exe" OR process_file_name="systray.exe" OR process_file_name="systemreset.exe"
+  OR process_file_name="systeminfo.exe" OR process_file_name="syskey.exe" OR process_file_name="sxstrace.exe"
+  OR process_file_name="svchost.exe" OR process_file_name="subst.exe" OR process_file_name="srdelayed.exe"
+  OR process_file_name="spreview.exe" OR process_file_name="sppsvc.exe" OR process_file_name="spoolsv.exe"
+  OR process_file_name="spinstall.exe" OR process_file_name="sort.exe" OR process_file_name="snmptrap.exe"
+  OR process_file_name="smss.exe" OR process_file_name="slui.exe" OR process_file_name="sihost.exe"
+  OR process_file_name="sigverif.exe" OR process_file_name="shutdown.exe" OR process_file_name="shrpubw.exe"
+  OR process_file_name="shadow.exe" OR process_file_name="setx.exe" OR process_file_name="setupugc.exe"
+  OR process_file_name="setupcl.exe" OR process_file_name="setspn.exe" OR process_file_name="sethc.exe"
+  OR process_file_name="sessionmsg.exe" OR process_file_name="services.exe" OR process_file_name="secinit.exe"
+  OR process_file_name="sdiagnhost.exe" OR process_file_name="sdclt.exe" OR process_file_name="sdchange.exe"
+  OR process_file_name="sdbinst.exe" OR process_file_name="schtasks.exe" OR process_file_name="sc.exe"
+  OR process_file_name="sbunattend.exe" OR process_file_name="rwinsta.exe" OR process_file_name="runonce.exe"
+  OR process_file_name="rundll32.exe" OR process_file_name="runas.exe" OR process_file_name="rstrui.exe"
+  OR process_file_name="rrinstaller.exe" OR process_file_name="rmttpmvscmgrsvr.exe"
+  OR process_file_name="resmon.exe" OR process_file_name="reset.exe" OR process_file_name="replace.exe"
+  OR process_file_name="repair-bde.exe" OR process_file_name="relog.exe" OR process_file_name="rekeywiz.exe"
+  OR process_file_name="regsvr32.exe" OR process_file_name="regini.exe" OR process_file_name="regedt32.exe"
+  OR process_file_name="reg.exe" OR process_file_name="recover.exe" OR process_file_name="recdisc.exe"
+  OR process_file_name="rdrleakdiag.exe" OR process_file_name="rdpinput.exe" OR process_file_name="rdpclip.exe"
+  OR process_file_name="rasphone.exe" OR process_file_name="raserver.exe" OR process_file_name="rasdial.exe"
+  OR process_file_name="rasautou.exe" OR process_file_name="qwinsta.exe" OR process_file_name="quser.exe"
+  OR process_file_name="query.exe" OR process_file_name="qprocess.exe" OR process_file_name="qappsrv.exe"
+  OR process_file_name="pwlauncher.exe" OR process_file_name="psr.exe" OR process_file_name="provtool.exe"
+  OR process_file_name="proquota.exe" OR process_file_name="printui.exe" OR process_file_name="printfilterpipelinesvc.exe"
   OR process_file_name="print.exe" OR process_file_name="prevhost.exe" OR process_file_name="powercfg.exe"
   OR process_file_name="poqexec.exe" OR process_file_name="plasrv.exe" OR process_file_name="phoneactivate.exe"
   OR process_file_name="perfmon.exe" OR process_file_name="pcwrun.exe" OR process_file_name="pcawrk.exe"
@@ -243,11 +243,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("System Process Running from Unexpected Location has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("System Process Running from Unexpected Location has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -268,11 +268,15 @@ known_false_positives: None
 references: []
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
   - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 56
   security_domain: endpoint
   risk_severity: medium
@@ -287,7 +291,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml

@@ -12,16 +12,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%")
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where process_file_name="wbadmin.exe" AND (like(process_cmd_line, "%systemstatebackup%")
   OR like(process_cmd_line, "%catalog%") OR like(process_cmd_line, "%delete%")) 
   | eval body=create_map(
     "devices", [
@@ -30,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("WBAdmin Delete System Backups has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("WBAdmin Delete System Backups has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -61,10 +61,15 @@ references:
 - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 15
   security_domain: endpoint
   risk_severity: low
@@ -79,7 +84,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml

@@ -12,16 +12,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (match_regex(process_cmd_line, /(?i)powershell/)=true OR match_regex(process_cmd_line,
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (match_regex(process_cmd_line, /(?i)powershell/)=true OR match_regex(process_cmd_line,
   /(?i)setup/)=true OR match_regex(process_cmd_line, /(?i)application/)=true OR match_regex(process_cmd_line,
   /(?i)sysmon/)=true OR match_regex(process_cmd_line, /(?i)system/)=true OR match_regex(process_cmd_line,
   /(?i)security/)=true) AND like(process_cmd_line, "% cl %") AND process_file_name="wevtutil.exe"
@@ -33,11 +33,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("WevtUtil Usage To Clear Logs has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("WevtUtil Usage To Clear Logs has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -64,10 +64,15 @@ references:
 - https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 63
   security_domain: endpoint
   risk_severity: medium
@@ -82,7 +87,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml

@@ -12,17 +12,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "% sl %") AND process_file_name="wevtutil.exe"
-  
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where like(process_cmd_line, "%/e:false%") AND like(process_cmd_line, "%
+  sl %") AND process_file_name="wevtutil.exe" 
   | eval body=create_map(
     "devices", [
         create_map(
@@ -30,11 +30,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Wevtutil Usage To Disable Logs has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Wevtutil Usage To Disable Logs has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -61,10 +61,15 @@ references:
 - https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 63
   security_domain: endpoint
   risk_severity: medium
@@ -79,7 +84,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___windows_bits_job_persistence.yml

@@ -16,16 +16,16 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  (like(process_cmd_line, "%resume%") OR like(process_cmd_line, "%setcustomheaders%")
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where (like(process_cmd_line, "%resume%") OR like(process_cmd_line, "%setcustomheaders%")
   OR like(process_cmd_line, "%setminretrydelay%") OR like(process_cmd_line, "%setnotifycmdline%")
   OR like(process_cmd_line, "%setnotifyflags%") OR like(process_cmd_line, "%addfile%")
   OR like(process_cmd_line, "%create%")) AND process_file_name="bitsadmin.exe" 
@@ -36,11 +36,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Windows Bits Job Persistence has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Windows Bits Job Persistence has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -71,10 +71,15 @@ references:
 - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 56
   security_domain: endpoint
   risk_severity: medium
@@ -89,7 +94,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml

@@ -21,16 +21,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where like(process_cmd_line, "%transfer%") AND process_file_name="bitsadmin.exe"
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -38,11 +39,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Windows Bitsadmin Download File has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Windows Bitsadmin Download File has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -72,10 +73,15 @@ references:
 - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 49
   security_domain: endpoint
   risk_severity: low
@@ -90,7 +96,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id

dist/ssa/srs/ssa___windows_certutil_decode_file.yml

@@ -17,16 +17,17 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   any>", null) | eval process_file_path=ucast(map_get(process_file,"path"), "string",
   null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", null)
   | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) | eval
-  process_user=ucast(map_get(process,"user"), "map<string, any>", null) | eval process_user_name=ucast(map_get(process_user,"name"),
-  "string", null) | eval actor=ucast(map_get(input_event,"actor"), "map<string, any>",
-  null) | eval actor_process=ucast(map_get(actor,"process"), "map<string, any>", null)
-  | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", null) | eval
-  actor_process_file=ucast(map_get(actor_process,"file"), "map<string, any>", null)
-  | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"), "string",
-  null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), "string",
-  null) | eval device=ucast(map_get(input_event,"device"), "map<string, any>", null)
-  | eval device_hostname=ucast(map_get(device,"hostname"), "string", null) | where
-  like(process_cmd_line, "%decode%") AND process_file_name="certutil.exe" 
+  actor=ucast(map_get(input_event,"actor"), "map<string, any>", null) | eval actor_user=ucast(map_get(actor,"user"),
+  "map<string, any>", null) | eval actor_user_name=ucast(map_get(actor_user,"name"),
+  "string", null) | eval actor_process=ucast(map_get(actor,"process"), "map<string,
+  any>", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string",
+  null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map<string,
+  any>", null) | eval actor_process_file_path=ucast(map_get(actor_process_file,"path"),
+  "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
+  "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
+  any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
+  null) | where like(process_cmd_line, "%decode%") AND process_file_name="certutil.exe"
+  
   | eval body=create_map(
     "devices", [
         create_map(
@@ -34,11 +35,11 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
         )
     ],
     "time", timestamp,
-    "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line),
-    "message", concat("Windows CertUtil Decode File has been triggered on ", device_hostname, " by ", process_user_name, "."),
+    "evidence", create_map("process.pid", process_pid, "process.file.path", process_file_path, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.user.name", actor_user_name, "actor.process.pid", actor_process_pid, "actor.process.file.path", actor_process_file_path, "actor.process.file.name", actor_process_file_name, "device.hostname", device_hostname),
+    "message", concat("Windows CertUtil Decode File has been triggered on ", device_hostname, " by ", actor_user_name, "."),
     "users", [
         create_map(
-            "name", process_user_name, "uuid", ucast(map_get(process_user,"uuid"), "string", null)
+            "name", actor_user_name, "uid", ucast(map_get(actor_user,"uid"), "string", null)
         )
     ],
     "activity_id", 1,
@@ -69,10 +70,15 @@ references:
 - https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/
 tags:
   required_fields:
-  - process.user.name
-  - device.hostname
+  - process.pid
+  - process.file.path
   - process.file.name
   - process.cmd_line
+  - actor.user.name
+  - actor.process.pid
+  - actor.process.file.path
+  - actor.process.file.name
+  - device.hostname
   risk_score: 40
   security_domain: endpoint
   risk_severity: low
@@ -87,7 +93,7 @@ tags:
     cim: process_name
   - ocsf: process.cmd_line
     cim: process
-  - ocsf: process.user.name
+  - ocsf: actor.user.name
     cim: user
   - ocsf: actor.process.pid
     cim: parent_process_id