diff --git a/detections/application/detect_distributed_password_spray_attempts.yml b/detections/application/detect_distributed_password_spray_attempts.yml
deleted file mode 100644
index be4c070da1..0000000000
--- a/detections/application/detect_distributed_password_spray_attempts.yml
+++ /dev/null
@@ -1,69 +0,0 @@
-name: Detect Distributed Password Spray Attempts
-id: b1a82fc8-8a9f-4344-9ec2-bde5c5331b57
-version: 1
-date: '2023-11-01'
-author: Dean Luxton
-status: production
-type: Hunting
-data_source:
-- Authentication Datamodel
-description: This analytic uses the 3-sigma approach to detect a distributed password spray attack. Utilising the authentication datamodel this detection is affective for all CIM mapped authication events.
-search: '| tstats `security_content_summariesonly` dc(Authentication.user) AS unique_accounts dc(Authentication.src) as unique_src count(Authentication.user) as total_failures from datamodel=Authentication.Authentication where Authentication.action="failure" by Authentication.action, Authentication.signature_id, sourcetype, _time  span=2m
-  | `drop_dm_object_name("Authentication")`
-  ```fill out time buckets for 0-count events during entire search length```
-  | appendpipe [| timechart limit=0 span=5m count | table _time]
-  | fillnull value=0 unique_accounts, unique_src
-  ``` remove duplicate & empty time buckets```
-  | sort - total_failures
-  | dedup _time
-  ``` Create aggregation field & apply to all null events```
-  | eval counter=sourcetype+"__"+signature_id
-  | eventstats values(counter) as fnscounter | eval counter=coalesce(counter,fnscounter)
-  ``` 3-sigma detection logic ```
-  | eventstats avg(unique_accounts) as comp_avg_user , stdev(unique_accounts) as comp_std_user avg(unique_src) as comp_avg_src , stdev(unique_src) as comp_std_src by counter
-  | eval upperBoundUser=(comp_avg_user+comp_std_user*3), upperBoundsrc=(comp_avg_src+comp_std_src*3)
-  | eval isOutlier=if((unique_accounts > 30 and unique_accounts >= upperBoundUser) and (unique_src > 30 and unique_accounts >= upperBoundsrc), 1, 0)
-  | replace "::ffff:*" with * in src
-  | where isOutlier=1
-  | foreach * 
-      [ eval <<FIELD>> = if(<<FIELD>>="null",null(),<<FIELD>>)] 
-  | table _time, action, unique_src, unique_accounts, total_failures, sourcetype, signature_id
-  | sort - total_failures | `detect_distributed_password_spray_attempts_filter`'
-how_to_implement: Ensure in-scope authentication data is CIM mapped and the src field is populated with the source device. Also ensure fill_nullvalue is set within the macro security_content_summariesonly. 
-known_false_positives: It is common to see a spike of legitimate failed authentication events on monday mornings.
-references:
-- https://attack.mitre.org/techniques/T1110/003/
-tags:
-  analytic_story:
-  - Compromised User Account
-  - Active Directory Password Spraying
-  asset_type: Endpoint
-  atomic_guid:
-  - 90bc2e54-6c84-47a5-9439-0a2a92b4b175
-  confidence: 70
-  impact: 70
-  message: Distributed Password Spray Attempt Detected
-  mitre_attack_id:
-  - T1110.003
-  - T1110
-  observable:
-  - name: src
-    type: Endpoint
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  required_fields:
-  - Authentication.action
-  - Authentication.user
-  - Authentication.src
-  security_domain: access
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techni[…]ure_ad_distributed_spray/azure_ad_distributed_spray.log
-    source: azure:monitor:aad
-    sourcetype: azure:monitor:aad
\ No newline at end of file
diff --git a/detections/application/detect_password_spray_attempts.yml b/detections/application/detect_password_spray_attempts.yml
deleted file mode 100644
index 9c0ea37da0..0000000000
--- a/detections/application/detect_password_spray_attempts.yml
+++ /dev/null
@@ -1,67 +0,0 @@
-name: Detect Password Spray Attempts
-id: 086ab581-8877-42b3-9aee-4a7ecb0923af
-version: 1
-date: '2023-11-01'
-author: Dean Luxton
-status: production
-type: TTP
-data_source:
-- Authentication Datamodel
-description: This analytic uses the 3-sigma approach to detect an unusual volume of failed authentication from a single source. Utilising the authentication datamodel this detection is affective for all CIM mapped authication events.
-search: '| tstats `security_content_summariesonly` dc(Authentication.user) AS unique_accounts values(Authentication.app) as app count(Authentication.user) as total_failures from datamodel=Authentication.Authentication where Authentication.action="failure" by Authentication.src, Authentication.action, Authentication.signature_id, sourcetype, _time  span=2m
-  | `drop_dm_object_name("Authentication")`
-  ```fill out time buckets for 0-count events during entire search length```
-  | appendpipe [| timechart limit=0 span=5m count | table _time]
-  | fillnull value=0 unique_accounts, unique_src
-  ``` remove duplicate & empty time buckets```
-  | sort - total_failures
-  | dedup _time
-  ``` Create aggregation field & apply to all null events```
-  | eval counter=src+"__"+sourcetype+"__"+signature_id
-  | eventstats values(counter) as fnscounter | eval counter=coalesce(counter,fnscounter)
-  | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by counter
-  | eval upperBound=(comp_avg+comp_std*3)
-  | eval isOutlier=if(unique_accounts > 30 and unique_accounts >= upperBound, 1, 0)
-  | replace "::ffff:*" with * in src
-  | where isOutlier=1
-  | foreach * [ eval <<FIELD>> = if(<<FIELD>>="null",null(),<<FIELD>>)] 
-  | table _time, src, action, app, unique_accounts, total_failures, sourcetype, signature_id
-  | `detect_password_spray_attempts_filter`'
-how_to_implement: Ensure in-scope authentication data is CIM mapped and the src field is populated with the source device. Also ensure fill_nullvalue is set within the macro security_content_summariesonly. 
-known_false_positives: Unknown
-references:
-- https://attack.mitre.org/techniques/T1110/003/
-tags:
-  analytic_story:
-  - Compromised User Account
-  - Active Directory Password Spraying
-  asset_type: Endpoint
-  atomic_guid:
-  - 90bc2e54-6c84-47a5-9439-0a2a92b4b175
-  confidence: 70
-  impact: 70
-  message: Potential Password Spraying attack from $src$ targeting $unique_accounts$ unique accounts. 
-  mitre_attack_id:
-  - T1110.003
-  - T1110
-  observable:
-  - name: src
-    type: Endpoint
-    role:
-    - Attacker
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 49
-  required_fields:
-  - Authentication.action
-  - Authentication.user
-  - Authentication.src
-  security_domain: access
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_invalid_users_kerberos_xml/windows-security.log
-    source: XmlWinEventLog:Security
-    sourcetype: XmlWinEventLog
\ No newline at end of file
diff --git a/detections/application/windows_ad_add_self_to_group.yml b/detections/application/windows_ad_add_self_to_group.yml
deleted file mode 100644
index b0caa2160d..0000000000
--- a/detections/application/windows_ad_add_self_to_group.yml
+++ /dev/null
@@ -1,51 +0,0 @@
-name: Windows AD add Self to Group
-id: 065f2701-b7ea-42f5-9ec4-fbc2261165f9
-version: 1
-date: '2023-12-18'
-author: Dean Luxton
-status: production
-type: TTP
-data_source:
-- Windows Event Log Security 4728
-description: Detect when a user adds themselfs to an AD Group. 
-search: '`wineventlog_security` EventCode IN (4728) 
-  | where user=src_user 
-  | stats min(_time) as _time dc(user) as usercount, values(user) as user values(user_category) as user_category values(src_user_category) as src_user_category values(dvc) as dvc by signature, Group_Name, src_user 
-  | `windows_ad_add_self_to_group_filter`'
-how_to_implement: This analytic requires eventCode 4728 to be ingested.
-known_false_positives: Unknown
-references: []
-tags:
-  analytic_story:
-  - Active Directory Privilege Escalation
-  - Sneaky Active Directory Persistence Tricks
-  asset_type: Endpoint
-  confidence: 100
-  impact: 50
-  message: $user$ added themselves to AD Group $Group_Name$
-  mitre_attack_id:
-  - T1098
-  observable:
-  - name: user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 50
-  required_fields:
-  - EventCode
-  - user
-  - src_user
-  - signature
-  - Group_Name
-  security_domain: audit
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log
-    source: XmlWinEventLog:Security
-    sourcetype: XmlWinEventLog
-    update_timestamp: true
\ No newline at end of file
diff --git a/detections/application/windows_increase_in_group_or_object_modification_activity.yml b/detections/application/windows_increase_in_group_or_object_modification_activity.yml
deleted file mode 100644
index 1fdbd7f382..0000000000
--- a/detections/application/windows_increase_in_group_or_object_modification_activity.yml
+++ /dev/null
@@ -1,52 +0,0 @@
-name: Windows Increase in Group or Object Modification Activity
-id: 4f9564dd-a204-4f22-b375-4dfca3a68731
-version: 1
-date: '2023-10-13'
-author: Dean Luxton
-status: production
-type: TTP
-data_source:
-- XmlWinEventLog:Security
-description: Increase in group or AD object modifications. 
-search: >-
-  `wineventlog_security` EventCode IN (4670,4727,4731,4734,4735,4764)
-  | bucket span=5m _time 
-  | stats values(object) as object, dc(object) as objectCount, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category by _time, src_user, signature, status
-  | eventstats avg(objectCount) as comp_avg, stdev(objectCount) as comp_std by src_user, signature
-  | eval upperBound=(comp_avg+comp_std)
-  | eval isOutlier=if(objectCount > 10 and (objectCount >= upperBound), 1, 0)
-  | search isOutlier=1 
-  | `windows_increase_in_group_or_object_modification_activity_filter`
-how_to_implement: Run over past 7 days for best results. 
-known_false_positives: Unknown
-references: []
-tags:
-  analytic_story:
-    - Sneaky Active Directory Persistence Tricks
-  asset_type: Endpoint
-  confidence: 40
-  impact: 20
-  message: Spike in Group or Object Modifications performed by $src_user$
-  mitre_attack_id:
-  - T1098
-  observable:
-  - name: src_user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 8
-  required_fields:
-  - EventCode
-  - src_user
-  - signature
-  security_domain: audit
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log
-    source: XmlWinEventLog:Security
-    sourcetype: XmlWinEventLog
\ No newline at end of file
diff --git a/detections/application/windows_increase_in_user_modification_activity.yml b/detections/application/windows_increase_in_user_modification_activity.yml
deleted file mode 100644
index cb8e263e59..0000000000
--- a/detections/application/windows_increase_in_user_modification_activity.yml
+++ /dev/null
@@ -1,53 +0,0 @@
-name: Windows Increase in User Modification Activity
-id: 0995fca1-f346-432f-b0bf-a66d14e6b428
-version: 1
-date: '2023-10-13'
-author: Dean Luxton
-status: production
-type: TTP
-data_source:
-- XmlWinEventLog:Security
-description: Increase in user account modifications. 
-search: >-
-  `wineventlog_security` EventCode IN (4720,4722,4723,4724,4725,4726,4728,4732,4733,4738,4743,4780)
-  | bucket span=5m _time 
-  | stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category by _time, src_user, signature, status
-  | eventstats avg(userCount) as comp_avg , stdev(userCount) as comp_std by src_user, signature
-  | eval upperBound=(comp_avg+comp_std*3)
-  | eval isOutlier=if(userCount > 10 and userCount >= upperBound, 1, 0) 
-  | search isOutlier=1
-  | stats values(TargetDomainName) as TargetDomainName, values(user) as user, dc(user) as userCount, values(user_category) as user_category, values(src_user_category) as src_user_category, values(dest) as dest, values(dest_category) as dest_category values(signature) as signature  by _time, src_user, status
-  | `windows_increase_in_user_modification_activity_filter`
-how_to_implement: Run over past 7 days for best results. 
-known_false_positives: Genuine activity
-references: []
-tags:
-  analytic_story:
-    - Sneaky Active Directory Persistence Tricks
-  asset_type: Endpoint
-  confidence: 40
-  impact: 20
-  message: Spike in User Modification actions performed by $src_user$
-  mitre_attack_id:
-  - T1098
-  observable:
-  - name: src_user
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 8
-  required_fields:
-  - EventCode
-  - src_user
-  - signature
-  security_domain: audit
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/xml-windows-security.log
-    source: XmlWinEventLog:Security
-    sourcetype: XmlWinEventLog
\ No newline at end of file
diff --git a/detections/endpoint/windows_network_share_discovery_with_net.yml b/detections/endpoint/windows_network_share_discovery_with_net.yml
deleted file mode 100644
index 950f1a390d..0000000000
--- a/detections/endpoint/windows_network_share_discovery_with_net.yml
+++ /dev/null
@@ -1,59 +0,0 @@
-name: Windows Network Share Discovery With Net
-id: 4dc3951f-b3f8-4f46-b412-76a483f72277
-version: 1
-date: '2023-04-21'
-author: Dean Luxton
-status: production
-type: TTP
-data_source:
-- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/net_share/windows-sysmon.log
-description: Network share discovery performed on Windows using the Net Command. 
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) as user_bunit  FROM datamodel=Endpoint.Processes WHERE ((Processes.process_name="net.exe" OR Processes.orig_process_name="net.exe") AND (Processes.process="*net*view*" OR Processes.process="*net*share*")) BY Processes.user Processes.dest Processes.process_exec Processes.parent_process_exec
-  Processes.process Processes.parent_process
-  | `drop_dm_object_name(Processes)`
-  | regex process="net\s+view|net\s+share"
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `windows_network_share_discovery_with_net_filter`'
-how_to_implement: Ensure you are populating the endpoint datamodel. 
-known_false_positives: Unknown
-references:
-- https://attack.mitre.org/techniques/T1135/
-tags:
-  analytic_story:
-  - Active Directory Discovery
-  - Active Directory Privilege Escalation
-  - Network Discovery
-  asset_type: Endpoint
-  atomic_guid:
-  - ab39a04f-0c93-4540-9ff2-83f862c385ae
-  confidence: 100
-  impact: 20
-  message: Network share enumeration performed on $dest$ by $user$, executed by parent process $parent_process$
-  mitre_attack_id:
-  - T1135
-  required_fields:
-  - Processes.process_name
-  - Processes.user
-  - Processes.dest
-  - Processes.process_exec
-  - Processes.parent_process_exec
-  - Processes.process
-  - Processes.parent_process
-  observable:
-  - name: dest
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 20
-  security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/net_share/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/detections/endpoint/windows_vulnerable_driver_installed.yml b/detections/endpoint/windows_vulnerable_driver_installed.yml
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/detections/network/internal_vertical_port_scan.yml b/detections/network/internal_vertical_port_scan.yml
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/detections/network/internal_vulnerability_scan.yml b/detections/network/internal_vulnerability_scan.yml
deleted file mode 100644
index 2f2dab7164..0000000000
--- a/detections/network/internal_vulnerability_scan.yml
+++ /dev/null
@@ -1,56 +0,0 @@
-name: Internal Vulnerability Scan
-id: 46f946ed-1c78-4e96-9906-c7a4be15e39b
-version: 1
-date: '2023-10-27'
-author: Dean Luxton
-status: experimental
-type: TTP
-data_source: []
-description: This analytic detects internal hosts triggering multiple IDS signatures (either more than 25 signatures against a single host, or a single signature across over 25 destinations), which can be indicative of active vulnerability scanning performed within the network.
-search: '| tstats `security_content_summariesonly` values(IDS_Attacks.action) as action
-  values(IDS_Attacks.src_category) as src_category values(IDS_Attacks.dest_category)
-  as dest_category count from datamodel=Intrusion_Detection.IDS_Attacks where IDS_Attacks.src
-  IN (10.0.0.0/8,192.168.0.0/16,172.16.0.0/12) IDS_Attacks.severity IN (critical,
-  high, medium) by IDS_Attacks.src IDS_Attacks.severity IDS_Attacks.signature IDS_Attacks.dest
-  IDS_Attacks.dest_port IDS_Attacks.transport span=1s _time | `drop_dm_object_name("IDS_Attacks")`
-  | eval gtime=_time | bin span=1h gtime | eventstats count as sevCount by severity
-  src | eventstats count as sigCount by signature src | eval severity=severity +"("+sevCount+")"
-  | eval signature=signature +"("+sigCount+")" | eval dest_port=transport + "/" +
-  dest_port | stats min(_time) as _time values(action) as action dc(dest) as destCount
-  dc(signature) as sigCount values(signature) values(src_category) as src_category
-  values(dest_category) as dest_category values(severity) as severity values(dest_port)
-  as dest_ports by src gtime | fields - gtime | where destCount>25 OR sigCount>25
-  | `internal_vulnerability_scan_filter`'
-how_to_implement: CIM mapped IDS/IPS logs are a required to drive this detection.
-known_false_positives: Vulnerability Scanners and informational / low severity signatures. 
-references: []
-tags:
-  analytic_story:
-  - Network Discovery
-  asset_type: Endpoint
-  confidence: 80
-  impact: 80
-  message: Large volume of IDS signatures triggered by $src$
-  mitre_attack_id:
-  - T1595.002
-  - T1046
-  observable:
-  - name: src
-    type: Hostname
-    role:
-    - Victim
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  risk_score: 64
-  required_fields:
-  - _time
-  - IDS_Attacks.action
-  - IDS_Attacks.src
-  - IDS_Attacks.dest
-  - IDS_Attacks.dest_port
-  - IDS_Attacks.severity
-  - IDS_Attacks.signature
-  - IDS_Attacks.transport
-  security_domain: network
\ No newline at end of file