From 84e65bb3fb099072cb5073f0ae90021a66a82bfa Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Thu, 17 Mar 2022 13:10:22 -0700
Subject: [PATCH] Updated all required fields and datamodels again.

---
 ...mber_of_cloud_infrastructure_api_calls.yml | 28 ++++----
 ...mber_of_cloud_security_group_api_calls.yml | 46 ++++++------
 ..._policy_version_to_allow_all_resources.yml | 33 +++++----
 detections/cloud/aws_createaccesskey.yml      | 35 ++++------
 detections/cloud/aws_createloginprofile.yml   | 33 +++++----
 ...ctivity_from_previously_unseen_account.yml | 48 ++++++-------
 ...g_keys_with_encrypt_policy_without_mfa.yml | 32 ++++-----
 ...with_kms_keys_performing_encryption_s3.yml | 34 ++++-----
 ...s_ecr_container_scanning_findings_high.yml | 35 +++++-----
 ...ing_findings_low_informational_unknown.yml | 31 ++++----
 ...ecr_container_scanning_findings_medium.yml | 31 ++++----
 ...ontainer_upload_outside_business_hours.yml | 37 +++++-----
 .../aws_ecr_container_upload_unknown_user.yml | 35 +++++-----
 .../cloud/aws_excessive_security_scanning.yml | 29 ++++----
 .../aws_iam_accessdenied_discovery_events.yml | 33 +++++----
 ...aws_iam_assume_role_policy_brute_force.yml | 37 +++++-----
 detections/cloud/aws_iam_delete_policy.yml    | 27 ++++---
 .../cloud/aws_iam_failure_group_deletion.yml  | 37 +++++-----
 .../aws_iam_successful_group_deletion.yml     | 37 +++++-----
 .../cloud/aws_lambda_updatefunctioncode.yml   | 33 +++++----
 ...ntrol_list_created_with_all_open_ports.yml | 45 +++++-------
 ...ws_network_access_control_list_deleted.yml | 30 ++++----
 ..._access_by_provider_user_and_principal.yml | 28 ++++----
 .../aws_saml_update_identity_provider.yml     | 28 ++++----
 .../cloud/aws_setdefaultpolicyversion.yml     | 37 +++++-----
 detections/cloud/aws_updateloginprofile.yml   | 33 ++++-----
 .../cloud/circle_ci_disable_security_job.yml  | 21 +++---
 .../cloud/circle_ci_disable_security_step.yml | 21 +++---
 ...alls_from_previously_unseen_user_roles.yml | 44 ++++++------
 ...ance_created_by_previously_unseen_user.yml | 38 +++++-----
 ...ce_created_in_previously_unused_region.yml | 40 +++++------
 ...e_created_with_previously_unseen_image.yml | 43 +++++-------
 ...d_with_previously_unseen_instance_type.yml | 43 +++++-------
 ...e_modified_with_previously_unseen_user.yml | 44 ++++++------
 ...ovisioning_from_previously_unseen_city.yml | 52 +++++++-------
 ...sioning_from_previously_unseen_country.yml | 52 +++++++-------
 ...ning_from_previously_unseen_ip_address.yml | 50 ++++++-------
 ...isioning_from_previously_unseen_region.yml | 52 +++++++-------
 .../detect_aws_console_login_by_new_user.yml  | 32 ++++-----
 ...ws_console_login_by_user_from_new_city.yml | 46 ++++++------
 ...console_login_by_user_from_new_country.yml | 46 ++++++------
 ..._console_login_by_user_from_new_region.yml | 46 ++++++------
 .../cloud/detect_new_open_s3_buckets.yml      | 36 +++++-----
 ...etect_new_open_s3_buckets_over_aws_cli.yml | 39 +++++------
 .../cloud/detect_shared_ec2_snapshot.yml      | 37 +++++-----
 ...s_security_hub_alerts_for_ec2_instance.yml | 31 ++++----
 detections/cloud/github_dependabot_alert.yml  | 32 +++------
 .../github_pull_request_from_unknown_user.yml | 36 ++++------
 .../gsuite_drive_share_in_external_email.yml  | 38 +++++-----
 .../gsuite_email_suspicious_attachment.yml    | 35 ++++------
 .../gsuite_suspicious_shared_file_name.yml    | 39 +++++------
 .../kubernetes_scanner_image_pulling.yml      | 27 +++----
 ...365_add_app_role_assignment_grant_user.yml | 44 ++++++------
 .../cloud/o365_added_service_principal.yml    | 43 +++++-------
 .../cloud/o365_bypass_mfa_via_trusted_ip.yml  | 42 +++++------
 detections/cloud/o365_disable_mfa.yml         | 34 ++++-----
 .../cloud/o365_new_federated_domain_added.yml | 33 +++++----
 .../7zip_commandline_to_smb_share_path.yml    | 47 +++++++------
 .../account_discovery_with_net_app.yml        | 58 +++++++--------
 .../active_setup_registry_autostart.yml       | 57 ++++++++-------
 ...d_defaultuser_and_password_in_registry.yml | 47 ++++++++-----
 .../add_or_set_windows_defender_exclusion.yml | 58 ++++++++-------
 ..._file_and_printing_sharing_in_firewall.yml | 52 +++++++-------
 ...ound_traffic_by_firewall_rule_registry.yml | 54 ++++++++------
 ...allow_inbound_traffic_in_firewall_rule.yml | 33 +++++----
 .../allow_network_discovery_in_firewall.yml   | 52 +++++++-------
 .../allow_operation_with_consent_admin.yml    | 57 +++++++++------
 .../endpoint/anomalous_usage_of_7zip.yml      | 57 ++++++++-------
 .../endpoint/any_powershell_downloadfile.yml  | 65 ++++++++---------
 .../any_powershell_downloadstring.yml         | 51 +++++++-------
 .../endpoint/attacker_tools_on_endpoint.yml   | 49 ++++++-------
 ..._to_add_certificate_to_untrusted_store.yml | 57 ++++++++-------
 .../attempt_to_stop_security_service.yml      | 61 ++++++++--------
 ...dential_dump_from_registry_via_reg_exe.yml | 57 +++++++--------
 .../auto_admin_logon_registry_entry.yml       | 47 ++++++++-----
 .../endpoint/batch_file_write_to_system32.yml | 63 +++++++++--------
 ...dedit_command_back_to_normal_mode_boot.yml | 43 ++++++------
 .../bcdedit_failure_recovery_modification.yml | 44 ++++++------
 detections/endpoint/bits_job_persistence.yml  | 67 +++++++++---------
 .../endpoint/bitsadmin_download_file.yml      | 65 ++++++++---------
 ...load_with_urlcache_and_split_arguments.yml | 63 ++++++++---------
 ...oad_with_verifyctl_and_split_arguments.yml | 65 ++++++++---------
 .../certutil_exe_certificate_extraction.yml   | 54 +++++++-------
 .../certutil_with_decode_argument.yml         | 50 ++++++-------
 .../change_default_file_association.yml       | 40 +++++------
 ...hange_to_safe_mode_with_network_config.yml | 43 ++++++------
 .../endpoint/chcp_command_execution.yml       | 56 ++++++++-------
 .../check_elevated_cmd_using_whoami.yml       | 44 ++++++------
 ...ar_unallocated_sector_using_cipher_app.yml | 55 +++++++--------
 .../endpoint/clop_common_exec_parameter.yml   | 55 +++++++--------
 .../clop_ransomware_known_service_name.yml    | 42 +++++------
 ...cmd_carry_out_string_command_parameter.yml | 55 +++++++--------
 .../endpoint/cmd_echo_pipe___escalation.yml   | 61 ++++++++--------
 ...cmdline_tool_not_executed_in_cmd_shell.yml | 63 ++++++++---------
 .../endpoint/cmlua_or_cmstplua_uac_bypass.yml | 35 +++++-----
 .../endpoint/common_ransomware_extensions.yml | 40 +++++------
 .../endpoint/common_ransomware_notes.yml      | 40 +++++------
 .../endpoint/conti_common_exec_parameter.yml  | 57 +++++++--------
 ..._loading_from_world_writable_directory.yml | 69 +++++++++---------
 ...ate_local_admin_accounts_using_net_exe.yml | 52 ++++++--------
 ...or_delete_windows_shares_using_net_exe.yml | 57 +++++++--------
 ...ate_remote_thread_in_shell_application.yml | 25 ++++---
 .../endpoint/creation_of_shadow_copy.yml      | 56 +++++++--------
 ...f_shadow_copy_with_wmic_and_powershell.yml | 48 ++++++-------
 ...ping_via_copy_command_from_shadow_copy.yml | 57 +++++++--------
 ...ial_dumping_via_symlink_to_shadow_copy.yml | 57 +++++++--------
 .../csc_net_on_the_fly_compilation.yml        | 52 +++++++-------
 .../curl_download_and_bash_execution.yml      | 49 ++++++-------
 .../delete_shadowcopy_with_powershell.yml     | 33 +++++----
 detections/endpoint/deleting_of_net_users.yml | 59 ++++++++--------
 .../endpoint/deleting_shadow_copies.yml       | 55 +++++++--------
 ...tect_azurehound_command_line_arguments.yml | 50 ++++++-------
 .../detect_azurehound_file_modifications.yml  | 51 ++++++++------
 ...detect_excessive_user_account_lockouts.yml | 36 +++++-----
 .../endpoint/detect_exchange_web_shell.yml    | 59 ++++++++--------
 .../endpoint/detect_html_help_renamed.yml     | 51 +++++++-------
 .../detect_html_help_spawn_child_process.yml  | 51 +++++++-------
 .../detect_html_help_url_in_command_line.yml  | 53 +++++++-------
 ...l_help_using_infotech_storage_handlers.yml | 50 ++++++-------
 .../detect_mimikatz_using_loaded_images.yml   | 35 +++++-----
 .../detect_mshta_inline_hta_execution.yml     | 62 ++++++++--------
 detections/endpoint/detect_mshta_renamed.yml  | 61 ++++++++--------
 .../detect_mshta_url_in_command_line.yml      | 62 ++++++++--------
 ...nterception_by_creation_of_program_exe.yml | 54 +++++++-------
 ...system_network_configuration_discovery.yml | 58 +++++++--------
 ...ohibited_applications_spawning_cmd_exe.yml | 49 ++++++-------
 .../detect_psexec_with_accepteula_flag.yml    | 60 ++++++++--------
 .../detect_rclone_command_line_usage.yml      | 61 ++++++++--------
 .../detect_regasm_spawning_a_process.yml      | 47 +++++++------
 .../detect_regasm_with_network_connection.yml | 34 +++++----
 ..._regasm_with_no_command_line_arguments.yml | 49 ++++++-------
 .../detect_regsvcs_spawning_a_process.yml     | 58 +++++++--------
 ...detect_regsvcs_with_network_connection.yml | 33 +++++----
 ...regsvcs_with_no_command_line_arguments.yml | 49 ++++++-------
 ...ct_regsvr32_application_control_bypass.yml | 65 ++++++++---------
 detections/endpoint/detect_renamed_7_zip.yml  | 55 +++++++--------
 detections/endpoint/detect_renamed_psexec.yml | 61 ++++++++--------
 detections/endpoint/detect_renamed_rclone.yml | 66 +++++++++--------
 detections/endpoint/detect_renamed_winrar.yml | 59 ++++++++--------
 ...2_application_control_bypass___advpack.yml | 53 +++++++-------
 ..._application_control_bypass___setupapi.yml | 53 +++++++-------
 ..._application_control_bypass___syssetup.yml | 53 +++++++-------
 .../detect_rundll32_inline_hta_execution.yml  | 54 +++++++-------
 ...tect_sharphound_command_line_arguments.yml | 38 +++++-----
 .../detect_sharphound_file_modifications.yml  | 41 ++++++-----
 .../endpoint/detect_sharphound_usage.yml      | 45 ++++++------
 ..._cmd_exe_to_launch_script_interpreters.yml | 38 +++++-----
 .../disable_amsi_through_registry.yml         | 49 +++++++------
 .../disable_defender_antivirus_registry.yml   | 52 ++++++++------
 ...able_defender_blockatfirstseen_feature.yml | 52 ++++++++------
 ...disable_defender_enhanced_notification.yml | 52 ++++++++------
 .../disable_defender_mpengine_registry.yml    | 52 ++++++++------
 .../disable_defender_spynet_reporting.yml     | 52 ++++++++------
 ...efender_submit_samples_consent_feature.yml | 52 ++++++++------
 .../endpoint/disable_etw_through_registry.yml | 47 ++++++++-----
 .../endpoint/disable_logs_using_wevtutil.yml  | 46 ++++++------
 detections/endpoint/disable_registry_tool.yml | 47 ++++++++-----
 detections/endpoint/disable_schedule_task.yml | 38 +++++-----
 ...le_security_logs_using_minint_registry.yml | 56 ++++++++-------
 .../endpoint/disable_show_hidden_files.yml    | 47 ++++++++-----
 .../disable_uac_remote_restriction.yml        | 56 ++++++++-------
 .../endpoint/disable_windows_app_hotkeys.yml  | 51 ++++++++------
 .../disable_windows_behavior_monitoring.yml   | 47 ++++++++-----
 ...disable_windows_smartscreen_protection.yml | 51 ++++++++------
 .../endpoint/disabling_cmd_application.yml    | 52 ++++++++------
 .../endpoint/disabling_controlpanel.yml       | 52 ++++++++------
 .../endpoint/disabling_defender_services.yml  | 52 ++++++++------
 .../disabling_firewall_with_netsh.yml         | 55 +++++++--------
 ...isabling_folderoptions_windows_feature.yml | 52 ++++++++------
 .../endpoint/disabling_net_user_account.yml   | 57 +++++++--------
 .../endpoint/disabling_norun_windows_app.yml  | 54 ++++++++------
 .../disabling_remote_user_account_control.yml | 41 +++++------
 .../disabling_systemrestore_in_registry.yml   | 52 ++++++++------
 .../endpoint/disabling_task_manager.yml       | 54 ++++++++------
 ...no_command_line_arguments_with_network.yml | 54 ++++++++------
 .../dns_exfiltration_using_nslookup_app.yml   | 57 +++++++--------
 .../domain_account_discovery_with_dsquery.yml | 52 +++++++-------
 .../domain_account_discovery_with_net_app.yml | 52 +++++++-------
 .../domain_account_discovery_with_wmic.yml    | 50 ++++++-------
 ...omain_controller_discovery_with_nltest.yml | 44 ++++++------
 .../domain_controller_discovery_with_wmic.yml | 44 ++++++------
 .../domain_group_discovery_with_dsquery.yml   | 44 ++++++------
 .../domain_group_discovery_with_net.yml       | 44 ++++++------
 .../domain_group_discovery_with_wmic.yml      | 44 ++++++------
 .../download_files_using_telegram.yml         | 27 ++++---
 .../endpoint/drop_icedid_license_dat.yml      | 25 ++++---
 .../endpoint/dsquery_domain_discovery.yml     | 56 +++++++--------
 .../endpoint/dump_lsass_via_comsvcs_dll.yml   | 48 ++++++-------
 .../endpoint/dump_lsass_via_procdump.yml      | 44 ++++++------
 .../elevated_group_discovery_with_net.yml     | 48 ++++++-------
 .../elevated_group_discovery_with_wmic.yml    | 48 ++++++-------
 .../enable_rdp_in_other_port_number.yml       | 50 +++++++------
 ...le_wdigest_uselogoncredential_registry.yml | 57 ++++++++-------
 ...erate_users_local_group_using_telegram.yml | 33 +++++----
 detections/endpoint/esentutl_sam_copy.yml     | 59 ++++++++--------
 detections/endpoint/etw_registry_disabled.yml | 57 ++++++++-------
 detections/endpoint/eventvwr_uac_bypass.yml   | 56 +++++++++------
 .../endpoint/excel_spawning_powershell.yml    | 60 ++++++++--------
 .../excel_spawning_windows_script_host.yml    | 52 +++++++-------
 .../excessive_attempt_to_disable_services.yml | 42 +++++------
 ...ve_file_deletion_in_windefender_folder.yml | 35 +++++-----
 ...ocesses_created_in_windows_temp_folder.yml | 37 +++++-----
 ...r_of_service_control_start_as_disabled.yml | 54 +++++++-------
 ...excessive_number_of_taskhost_processes.yml | 37 +++++-----
 .../excessive_service_stop_attempt.yml        | 50 ++++++-------
 .../endpoint/excessive_usage_of_cacls_app.yml | 43 ++++++------
 .../endpoint/excessive_usage_of_net_app.yml   | 54 +++++++-------
 .../excessive_usage_of_nslookup_app.yml       | 33 +++++----
 .../excessive_usage_of_sc_service_utility.yml | 29 ++++----
 .../endpoint/excessive_usage_of_taskkill.yml  | 44 ++++++------
 ..._or_script_creation_in_suspicious_path.yml | 44 ++++++------
 ...cute_javascript_with_jscript_com_clsid.yml | 48 ++++++-------
 ...ution_of_file_with_multiple_extensions.yml | 38 +++++-----
 .../endpoint/extraction_of_registry_hives.yml | 54 +++++++-------
 .../endpoint/file_with_samsam_extension.yml   | 42 +++++------
 .../firewall_allowed_program_enable.yml       | 50 ++++++-------
 detections/endpoint/fodhelper_uac_bypass.yml  | 46 ++++++------
 detections/endpoint/fsutil_zeroing_file.yml   | 40 +++++------
 ...ltdomainpasswordpolicy_with_powershell.yml | 54 +++++++-------
 .../endpoint/get_aduser_with_powershell.yml   | 54 +++++++-------
 ...esultantpasswordpolicy_with_powershell.yml | 54 +++++++-------
 .../get_domainpolicy_with_powershell.yml      | 54 +++++++-------
 .../get_domaintrust_with_powershell.yml       | 46 ++++++------
 ...maintrust_with_powershell_script_block.yml | 30 ++++----
 .../get_domainuser_with_powershell.yml        | 50 ++++++-------
 .../get_foresttrust_with_powershell.yml       | 54 +++++++-------
 ...resttrust_with_powershell_script_block.yml | 27 ++++---
 .../get_wmiobject_group_discovery.yml         | 51 +++++++-------
 .../getadcomputer_with_powershell.yml         | 44 ++++++------
 .../endpoint/getadgroup_with_powershell.yml   | 46 ++++++------
 .../getcurrent_user_with_powershell.yml       | 44 ++++++------
 ...rent_user_with_powershell_script_block.yml | 36 +++++-----
 .../getdomaincomputer_with_powershell.yml     | 44 ++++++------
 .../getdomaincontroller_with_powershell.yml   | 46 ++++++------
 .../getdomaingroup_with_powershell.yml        | 46 ++++++------
 .../endpoint/getlocaluser_with_powershell.yml | 35 ++++++----
 .../getnettcpconnection_with_powershell.yml   | 46 ++++++------
 ...twmiobject_ds_computer_with_powershell.yml | 44 ++++++------
 .../getwmiobject_ds_group_with_powershell.yml | 46 ++++++------
 .../getwmiobject_ds_user_with_powershell.yml  | 50 ++++++-------
 ...wmiobject_user_account_with_powershell.yml | 35 ++++++----
 ...no_command_line_arguments_with_network.yml | 54 ++++++++------
 .../hide_user_account_from_sign_in_screen.yml | 57 +++++++++------
 ..._files_and_directories_with_attrib_exe.yml | 40 +++++------
 ...equency_copy_of_files_in_network_share.yml | 29 ++++----
 .../high_process_termination_frequency.yml    | 31 ++++----
 detections/endpoint/hunting_for_log4shell.yml | 53 ++++++--------
 detections/endpoint/icacls_deny_command.yml   | 46 ++++++------
 detections/endpoint/icacls_grant_command.yml  | 44 ++++++------
 ...did_exfiltrated_archived_file_creation.yml | 25 ++++---
 ...ateral_movement_commandline_parameters.yml | 44 ++++++------
 ...class_file_download_by_java_user_agent.yml | 39 +++++------
 .../jscript_execution_using_cscript_app.yml   | 48 ++++++-------
 ...on_flag_disabled_in_useraccountcontrol.yml | 23 +++---
 .../known_services_killed_by_ransomware.yml   | 31 ++++----
 ...add_files_in_known_crontab_directories.yml | 42 +++++------
 .../endpoint/linux_add_user_account.yml       | 46 ++++++------
 .../linux_at_allow_config_file_creation.yml   | 38 +++++-----
 .../linux_at_application_execution.yml        | 48 ++++++-------
 .../linux_change_file_owner_to_root.yml       | 47 +++++++------
 ...x_common_process_for_elevation_control.yml | 51 +++++++-------
 .../endpoint/linux_dd_file_overwrite.yml      | 47 +++++++------
 .../linux_doas_conf_file_creation.yml         | 42 +++++------
 .../endpoint/linux_doas_tool_execution.yml    | 47 +++++++------
 .../linux_edit_cron_table_parameter.yml       | 44 ++++++------
 ...ile_created_in_kernel_driver_directory.yml | 41 ++++++-----
 ...x_file_creation_in_init_boot_directory.yml | 37 +++++-----
 ...nux_file_creation_in_profile_directory.yml | 42 +++++------
 ...ert_kernel_module_using_insmod_utility.yml | 49 ++++++-------
 ...l_kernel_module_using_modprobe_utility.yml | 49 ++++++-------
 .../endpoint/linux_java_spawning_shell.yml    | 56 +++++++--------
 .../linux_nopasswd_entry_in_sudoers_file.yml  | 47 +++++++------
 .../linux_pkexec_privilege_escalation.yml     | 49 ++++++-------
 ...ss_or_modification_of_sshd_config_file.yml | 46 ++++++------
 ...ux_possible_access_to_credential_files.yml | 46 ++++++------
 .../linux_possible_access_to_sudoers_file.yml | 46 ++++++------
 ...append_command_to_at_allow_config_file.yml | 48 ++++++-------
 ..._append_command_to_profile_config_file.yml | 47 +++++++------
 ...cronjob_entry_on_existing_cronjob_file.yml | 50 ++++++-------
 ...sible_cronjob_modification_with_editor.yml | 44 ++++++------
 .../linux_possible_ssh_key_file_creation.yml  | 41 ++++++-----
 .../linux_preload_hijack_library_calls.yml    | 45 ++++++------
 ...vice_file_created_in_systemd_directory.yml | 46 ++++++------
 .../endpoint/linux_service_restarted.yml      | 45 ++++++------
 .../linux_service_started_or_enabled.yml      | 45 ++++++------
 .../linux_setuid_using_chmod_utility.yml      | 45 ++++++------
 .../linux_setuid_using_setcap_utility.yml     | 45 ++++++------
 .../endpoint/linux_sudo_or_su_execution.yml   | 45 ++++++------
 .../linux_sudoers_tmp_file_creation.yml       | 39 +++++------
 .../linux_system_network_discovery.yml        | 44 ++++++------
 .../linux_visudo_utility_execution.yml        | 45 ++++++------
 .../endpoint/loading_of_dynwrapx_module.yml   | 25 ++++---
 .../local_account_discovery_with_net.yml      | 33 +++++----
 .../local_account_discovery_with_wmic.yml     | 33 +++++----
 .../logon_script_event_trigger_execution.yml  | 38 +++++-----
 .../endpoint/mailsniper_invoke_functions.yml  | 31 ++++----
 .../malicious_inprocserver32_modification.yml | 56 +++++++++------
 ...cious_powershell_executed_as_a_service.yml | 37 +++++-----
 ...s_powershell_process___encoded_command.yml | 39 ++++++-----
 ...hell_process___execution_policy_bypass.yml | 48 ++++++-------
 ...ll_process_with_obfuscation_techniques.yml | 48 ++++++-------
 ...z_passtheticket_commandline_parameters.yml | 54 +++++++-------
 ...mmc_exe_lolbas_execution_process_spawn.yml | 51 +++++++-------
 .../endpoint/modification_of_wallpaper.yml    | 29 ++++----
 ...dify_acl_permission_to_files_or_folder.yml | 40 +++++------
 ...nitor_registry_keys_for_print_monitors.yml | 56 +++++++++------
 ..._scripting_process_loading_ldap_module.yml | 33 +++++----
 ...s_scripting_process_loading_wmi_module.yml | 33 +++++----
 ...d_suspicious_spawned_by_script_process.yml | 49 ++++++-------
 ..._spawning_rundll32_or_regsvr32_process.yml | 55 +++++++--------
 .../mshtml_module_load_in_office_product.yml  | 35 +++++-----
 .../msmpeng_application_dll_side_loading.yml  | 34 ++++-----
 ...uthenticate_using_explicit_credentials.yml | 43 ++++++------
 ..._authenticate_from_host_using_kerberos.yml | 39 +++++------
 ...s_failing_to_authenticate_from_process.yml | 45 ++++++------
 ...tely_failing_to_authenticate_from_host.yml | 45 ++++++------
 .../endpoint/net_localgroup_discovery.yml     | 55 +++++++--------
 .../endpoint/net_profiler_uac_bypass.yml      | 38 +++++-----
 .../network_connection_discovery_arp.yml      | 44 ++++++------
 .../network_connection_discovery_net.yml      | 44 ++++++------
 .../network_connection_discovery_netstat.yml  | 44 ++++++------
 ...work_discovery_using_route_windows_app.yml | 40 +++++------
 .../endpoint/nishang_powershelltcponeline.yml | 57 +++++++--------
 .../nltest_domain_trust_discovery.yml         | 40 +++++------
 ...e_process_accessing_chrome_default_dir.yml | 31 ++++----
 ...fox_process_access_firefox_profile_dir.yml | 31 ++++----
 detections/endpoint/ntdsutil_export_ntds.yml  | 50 ++++++-------
 .../office_application_drop_executable.yml    | 47 +++++++------
 ...ice_application_spawn_regsvr32_process.yml | 50 +++++++------
 ...ice_application_spawn_rundll32_process.yml | 51 +++++++-------
 ...office_document_creating_schedule_task.yml | 31 ++++----
 .../office_document_executing_macro_code.yml  | 29 ++++----
 ...ment_spawned_child_process_to_download.yml | 49 ++++++-------
 .../office_product_spawn_cmd_process.yml      | 56 +++++++--------
 .../office_product_spawning_bitsadmin.yml     | 52 +++++++-------
 .../office_product_spawning_certutil.yml      | 54 +++++++-------
 .../office_product_spawning_mshta.yml         | 52 +++++++-------
 ..._product_spawning_rundll32_with_no_dll.yml | 57 +++++++--------
 .../endpoint/office_product_spawning_wmic.yml | 56 +++++++--------
 .../office_product_writing_cab_or_inf.yml     | 53 ++++++++------
 .../endpoint/office_spawning_control.yml      | 51 +++++++-------
 ...nnection_from_java_using_default_ports.yml | 50 ++++++-------
 .../overwriting_accessibility_binaries.yml    | 38 +++++-----
 .../password_policy_discovery_with_net.yml    | 50 ++++++-------
 ...mission_modification_using_takeown_app.yml | 48 ++++++-------
 .../endpoint/ping_sleep_batch_command.yml     | 54 +++++++-------
 .../possible_browser_pass_view_parameter.yml  | 54 +++++++-------
 ...ible_lateral_movement_powershell_spawn.yml | 55 +++++++--------
 ...entially_malicious_code_on_commandline.yml | 45 ++++++------
 .../endpoint/powershell_4104_hunting.yml      | 47 ++++++-------
 ...connect_to_internet_with_hidden_window.yml | 44 ++++++------
 ...powershell_disable_security_monitoring.yml | 49 ++++++-------
 ...powershell_enable_smb1protocol_feature.yml | 25 ++++---
 .../powershell_execute_com_object.yml         | 27 ++++---
 .../powershell_get_localgroup_discovery.yml   | 54 +++++++-------
 .../powershell_processing_stream_of_data.yml  | 29 ++++----
 ...remote_thread_to_known_windows_process.yml | 31 ++++----
 ...hell_remove_windows_defender_directory.yml | 31 ++++----
 .../powershell_start_bitstransfer.yml         | 59 ++++++++--------
 ...ll_windows_defender_exclusion_commands.yml | 27 ++++---
 ...nt_automatic_repair_mode_using_bcdedit.yml | 50 ++++++-------
 .../print_spooler_adding_a_printer_driver.yml | 25 ++++---
 ...print_spooler_failed_to_load_a_plug_in.yml | 29 ++++----
 ...eating_lnk_file_in_suspicious_location.yml | 55 ++++++++-------
 ...process_deleting_its_process_file_path.yml | 50 +++++++------
 .../endpoint/process_execution_via_wmi.yml    | 45 ++++++------
 .../process_kill_base_on_file_path.yml        | 52 +++++++-------
 .../process_writing_dynamicwrapperx.yml       | 68 ++++++++++--------
 .../endpoint/processes_launching_netsh.yml    | 49 ++++++-------
 .../ransomware_notes_bulk_creation.yml        | 44 ++++++------
 ...rsive_delete_of_directory_in_batch_cmd.yml | 48 ++++++-------
 ...ulating_windows_services_registry_keys.yml | 50 ++++++-------
 ...istry_keys_for_creating_shim_databases.yml | 53 ++++++++------
 .../registry_keys_used_for_persistence.yml    | 56 +++++++++------
 ...try_keys_used_for_privilege_escalation.yml | 58 +++++++++------
 ...2_silent_and_install_param_dll_loading.yml | 60 ++++++++--------
 ...svr32_with_known_silent_switch_cmdline.yml | 60 ++++++++--------
 .../remcos_client_registry_install_entry.yml  | 48 ++++++++-----
 ...cos_rat_file_creation_in_remcos_folder.yml | 34 +++++----
 ..._instantiation_via_dcom_and_powershell.yml | 48 ++++++-------
 ...instantiation_via_winrm_and_powershell.yml | 50 ++++++-------
 ...cess_instantiation_via_winrm_and_winrs.yml | 51 +++++++-------
 .../remote_process_instantiation_via_wmi.yml  | 58 +++++++--------
 ...s_instantiation_via_wmi_and_powershell.yml | 50 ++++++-------
 .../remote_system_discovery_with_dsquery.yml  | 46 ++++++------
 .../remote_system_discovery_with_net.yml      | 44 ++++++------
 .../remote_system_discovery_with_wmic.yml     | 46 ++++++------
 .../endpoint/remote_wmi_command_attempt.yml   | 42 +++++------
 .../endpoint/resize_shadowstorage_volume.yml  | 54 +++++++-------
 .../endpoint/revil_common_exec_parameter.yml  | 52 +++++++-------
 detections/endpoint/revil_registry_entry.yml  | 51 ++++++++------
 .../rubeus_command_line_parameters.yml        | 56 +++++++--------
 ...ticket_exports_through_winlogon_access.yml | 45 ++++++------
 .../runas_execution_in_commandline.yml        | 50 ++++++-------
 .../endpoint/rundll32_control_rundll_hunt.yml | 53 +++++++-------
 ...ontrol_rundll_world_writable_directory.yml | 55 +++++++--------
 ...ll32_create_remote_thread_to_a_process.yml | 25 ++++---
 ...rundll32_createremotethread_in_browser.yml | 31 ++++----
 detections/endpoint/rundll32_dnsquery.yml     | 23 +++---
 ...undll32_process_creating_exe_dll_files.yml | 25 ++++---
 .../endpoint/rundll32_shimcache_flush.yml     | 53 +++++++-------
 ...no_command_line_arguments_with_network.yml | 66 ++++++++---------
 .../rundll_loading_dll_by_ordinal.yml         | 57 +++++++--------
 .../endpoint/ryuk_test_files_detected.yml     | 33 ++++-----
 .../endpoint/ryuk_wake_on_lan_command.yml     | 49 +++++++------
 .../sam_database_file_access_attempt.yml      | 32 ++++-----
 .../endpoint/samsam_test_file_write.yml       | 38 +++++-----
 .../sc_exe_manipulating_windows_services.yml  | 42 +++++------
 ..._by_app_connect_and_create_adsi_object.yml | 33 +++++----
 ...edule_task_with_http_command_arguments.yml | 29 ++++----
 ...ule_task_with_rundll32_command_trigger.yml | 31 ++++----
 ...k_creation_on_remote_endpoint_using_at.yml | 49 ++++++-------
 ...eduled_task_deleted_or_created_via_cmd.yml | 48 ++++++-------
 ...led_task_initiation_on_remote_endpoint.yml | 49 ++++++-------
 .../endpoint/schtasks_run_task_on_demand.yml  | 46 ++++++------
 ...htasks_scheduling_job_on_remote_system.yml | 47 +++++++------
 .../schtasks_used_for_forcing_a_reboot.yml    | 44 ++++++------
 .../screensaver_event_trigger_execution.yml   | 38 +++++-----
 .../endpoint/script_execution_via_wmi.yml     | 44 ++++++------
 detections/endpoint/sdclt_uac_bypass.yml      | 49 ++++++++-----
 .../sdelete_application_execution.yml         | 53 +++++++-------
 ...host_with_no_command_line_with_network.yml | 45 +++++++-----
 .../secretdumps_offline_ntds_dumping_tool.yml | 48 ++++++-------
 ...incipalnames_discovery_with_powershell.yml | 39 ++++-------
 ...ceprincipalnames_discovery_with_setspn.yml | 55 +++++++--------
 detections/endpoint/services_escalate_exe.yml | 50 ++++++-------
 ...ces_exe_lolbas_execution_process_spawn.yml | 51 +++++++-------
 ...ution_policy_to_unrestricted_or_bypass.yml | 42 +++++------
 .../endpoint/shim_database_file_creation.yml  | 42 +++++------
 ...nstallation_with_suspicious_parameters.yml | 37 +++++-----
 .../endpoint/short_lived_scheduled_task.yml   | 38 +++++-----
 .../endpoint/short_lived_windows_accounts.yml | 36 +++++-----
 .../endpoint/silentcleanup_uac_bypass.yml     | 49 ++++++++-----
 .../single_letter_process_on_endpoint.yml     | 42 +++++------
 detections/endpoint/slui_runas_elevated.yml   | 42 +++++------
 .../endpoint/slui_spawning_a_process.yml      | 51 +++++++-------
 .../endpoint/spoolsv_spawning_rundll32.yml    | 60 ++++++++--------
 .../spoolsv_suspicious_loaded_modules.yml     | 31 ++++----
 .../spoolsv_suspicious_process_access.yml     | 29 ++++----
 detections/endpoint/spoolsv_writing_a_dll.yml | 52 +++++++-------
 .../spoolsv_writing_a_dll___sysmon.yml        | 27 ++++---
 .../endpoint/sqlite_module_in_temp_folder.yml | 31 ++++----
 .../start_up_during_safe_mode_boot.yml        | 52 ++++++++------
 ...uspicious_computer_account_name_change.yml | 21 +++---
 .../endpoint/suspicious_copy_on_system32.yml  | 52 +++++++-------
 ...ious_dllhost_no_command_line_arguments.yml | 45 ++++++------
 .../suspicious_driver_loaded_path.yml         | 33 +++++----
 ...ous_gpupdate_no_command_line_arguments.yml | 53 +++++++-------
 .../suspicious_icedid_rundll32_cmdline.yml    | 53 +++++++-------
 ...cious_image_creation_in_appdata_folder.yml | 44 +++++++-----
 ...icious_kerberos_service_ticket_request.yml | 23 +++---
 .../suspicious_linux_discovery_commands.yml   | 45 ++++++------
 ...ous_microsoft_workflow_compiler_rename.yml | 57 +++++++--------
 ...ious_microsoft_workflow_compiler_usage.yml | 45 ++++++------
 .../endpoint/suspicious_msbuild_path.yml      | 60 ++++++++--------
 .../endpoint/suspicious_msbuild_rename.yml    | 59 ++++++++--------
 .../endpoint/suspicious_msbuild_spawn.yml     | 56 +++++++--------
 .../suspicious_mshta_child_process.yml        | 50 ++++++-------
 .../endpoint/suspicious_mshta_spawn.yml       | 54 +++++++-------
 ...ess_dns_query_known_abuse_web_services.yml | 33 +++++----
 .../endpoint/suspicious_process_file_path.yml | 46 ++++++------
 ...picious_process_with_discord_dns_query.yml | 33 +++++----
 .../endpoint/suspicious_reg_exe_process.yml   | 50 ++++++-------
 ...ious_regsvr32_register_suspicious_path.yml | 49 ++++++-------
 .../suspicious_rundll32_dllregisterserver.yml | 47 ++++++-------
 .../suspicious_rundll32_plugininit.yml        | 54 +++++++-------
 .../endpoint/suspicious_rundll32_startw.yml   | 49 ++++++-------
 ...undll32_with_no_command_line_arguments.yml | 45 ++++++------
 ...s_scheduled_task_from_public_directory.yml | 47 ++++++-------
 ...protocolhost_no_command_line_arguments.yml | 45 ++++++------
 ...picious_ticket_granting_ticket_request.yml | 35 +++++-----
 .../suspicious_wav_file_in_appdata_folder.yml | 44 +++++++-----
 .../endpoint/suspicious_wevtutil_usage.yml    | 46 ++++++------
 ...spicious_writes_to_windows_recycle_bin.yml | 50 ++++++-------
 ...ost_exe_lolbas_execution_process_spawn.yml | 51 +++++++-------
 ...nfo_gathering_using_dxdiag_application.yml | 55 +++++++--------
 ...system_information_discovery_detection.yml | 37 +++++-----
 ...rocesses_run_from_unexpected_locations.yml | 48 +++++++------
 .../system_user_discovery_with_query.yml      | 44 ++++++------
 .../system_user_discovery_with_whoami.yml     | 44 ++++++------
 .../time_provider_persistence_registry.yml    | 57 ++++++++-------
 detections/endpoint/trickbot_named_pipe.yml   | 31 ++++----
 .../uac_bypass_mmc_load_unsigned_dll.yml      | 29 ++++----
 .../uac_bypass_with_colorui_com_object.yml    | 35 +++++-----
 ...d_messaging_service_spawning_a_process.yml | 49 ++++++-------
 .../endpoint/uninstall_app_using_msiexec.yml  | 45 ++++++------
 .../endpoint/unload_sysmon_filter_driver.yml  | 42 +++++------
 ..._of_kerberos_service_tickets_requested.yml | 43 ++++++------
 ...er_discocvery_with_env_vars_powershell.yml | 44 ++++++------
 ..._with_env_vars_powershell_script_block.yml | 26 ++++---
 detections/endpoint/usn_journal_deletion.yml  | 40 +++++------
 .../vbscript_execution_using_wscript_app.yml  | 52 +++++++-------
 .../endpoint/verclsid_clsid_execution.yml     | 57 +++++++--------
 detections/endpoint/w3wp_spawning_shell.yml   | 58 +++++++--------
 .../wbadmin_delete_system_backups.yml         | 42 +++++------
 .../wbemprox_com_object_execution.yml         | 31 ++++----
 ...ss_connecting_to_ip_check_web_services.yml | 31 ++++----
 .../wermgr_process_create_executable_file.yml | 23 +++---
 ...cess_spawned_cmd_or_powershell_process.yml | 52 +++++++-------
 .../wget_download_and_bash_execution.yml      | 61 ++++++++--------
 detections/endpoint/windows_adfind_exe.yml    | 42 +++++------
 ...ndows_curl_download_to_suspicious_path.yml | 63 ++++++++---------
 ...dows_curl_upload_to_remote_destination.yml | 63 ++++++++---------
 ...dows_defender_exclusion_registry_entry.yml | 56 ++++++++-------
 .../windows_disable_memory_crash_dump.yml     | 66 ++++++++---------
 .../windows_disableantispyware_reg.yml        | 42 +++++------
 .../endpoint/windows_diskcryptor_usage.yml    | 63 ++++++++---------
 .../windows_diskshadow_proxy_execution.yml    | 49 +++++++------
 .../endpoint/windows_dism_remove_defender.yml | 59 ++++++++--------
 ...ows_dotnet_binary_in_non_standard_path.yml | 68 +++++++++---------
 .../windows_event_for_service_disabled.yml    | 29 ++++----
 ...dows_excessive_disabled_services_event.yml | 27 ++++---
 ...e_without_extension_in_critical_folder.yml | 47 +++++++------
 .../windows_high_file_deletion_frequency.yml  | 37 +++++-----
 .../windows_installutil_credential_theft.yml  | 48 +++++--------
 ...ndows_installutil_in_non_standard_path.yml | 69 +++++++++---------
 ..._installutil_remote_network_connection.yml | 67 +++++++++---------
 .../windows_installutil_uninstall_option.yml  | 63 ++++++++---------
 ...tallutil_uninstall_option_with_network.yml | 70 +++++++++----------
 ...indows_installutil_url_in_command_line.yml | 63 ++++++++---------
 ...w_compress_color_and_info_tip_registry.yml | 44 +++++++-----
 .../endpoint/windows_nirsoft_advancedrun.yml  | 61 ++++++++--------
 .../endpoint/windows_nirsoft_utilities.yml    | 64 ++++++++---------
 ...ows_process_with_namedpipe_commandline.yml | 54 +++++++-------
 ...indows_raccine_scheduled_task_deletion.yml | 59 ++++++++--------
 .../windows_rasautou_dll_execution.yml        | 61 ++++++++--------
 ...ws_raw_access_to_disk_volume_partition.yml | 23 +++---
 ...raw_access_to_master_boot_record_drive.yml | 23 +++---
 ...ows_remote_assistance_spawning_process.yml | 55 +++++++--------
 .../windows_schtasks_create_run_as_system.yml | 59 ++++++++--------
 ...ndows_security_account_manager_stopped.yml | 45 ++++++------
 ...ws_service_creation_on_remote_endpoint.yml | 51 +++++++-------
 ..._service_creation_using_registry_entry.yml | 56 ++++++++-------
 ..._service_initiation_on_remote_endpoint.yml | 49 ++++++-------
 .../windows_wmi_process_call_create.yml       | 58 +++++++--------
 ..._scheduled_task_created_to_spawn_shell.yml | 41 ++++++-----
 ...eduled_task_created_within_public_path.yml | 29 ++++----
 ...ws_task_scheduler_event_action_started.yml | 27 +++----
 .../endpoint/winhlp32_spawning_a_process.yml  | 63 ++++++++---------
 detections/endpoint/winword_spawning_cmd.yml  | 58 ++++++++-------
 .../endpoint/winword_spawning_powershell.yml  | 64 ++++++++---------
 .../winword_spawning_windows_script_host.yml  | 50 +++++++------
 detections/endpoint/wmic_group_discovery.yml  | 55 +++++++--------
 ...wmic_noninteractive_app_uninstallation.yml | 55 +++++++--------
 .../endpoint/wmic_xsl_execution_via_url.yml   | 63 ++++++++---------
 ...sve_exe_lolbas_execution_process_spawn.yml | 51 +++++++-------
 ...pt_or_cscript_suspicious_child_process.yml | 55 +++++++--------
 ...ost_exe_lolbas_execution_process_spawn.yml | 51 +++++++-------
 detections/endpoint/wsreset_uac_bypass.yml    | 49 ++++++++-----
 detections/endpoint/xmrig_driver_loaded.yml   | 29 ++++----
 .../xsl_script_execution_with_wmic.yml        | 56 +++++++--------
 ...connecting_to_dynamic_domain_providers.yml | 27 +++----
 .../network/detect_outbound_ldap_traffic.yml  | 38 +++++-----
 ...ry_length_with_high_standard_deviation.yml | 28 ++++----
 ...ltiple_archive_files_http_post_traffic.yml | 37 +++++-----
 .../plain_http_post_exfiltrated_data.yml      | 31 ++++----
 ...g4shell_jndi_payload_injection_attempt.yml | 30 ++++----
 ...oad_injection_with_outbound_connection.yml | 33 ++++-----
 558 files changed, 12668 insertions(+), 12948 deletions(-)

diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml
index 6025bbdde9..052e978f3b 100644
--- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml
+++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml
@@ -1,13 +1,16 @@
-name: Abnormally High Number Of Cloud Infrastructure API Calls
-id: 0840ddf1-8c89-46ff-b730-c8d6722478c0
-version: 1
-date: '2020-09-07'
 author: David Dorsey, Splunk
-type: Anomaly
 datamodel:
 - Change.All_Changes
+date: '2020-09-07'
 description: This search will detect a spike in the number of API calls made to your
   cloud infrastructure environment by a user.
+how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
+  run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to
+  create the probability density function.
+id: 0840ddf1-8c89-46ff-b730-c8d6722478c0
+known_false_positives: ''
+name: Abnormally High Number Of Cloud Infrastructure API Calls
+references: []
 search: '| tstats count as api_calls values(All_Changes.command) as command from datamodel=Change.All_Changes
   where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time
   span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time,
@@ -19,11 +22,6 @@ search: '| tstats count as api_calls values(All_Changes.command) as command from
   -1), ":"), 0) | where api_calls > expected_upper_threshold | eval distance_from_threshold
   = api_calls - expected_upper_threshold | table _time, user, command, api_calls,
   expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_infrastructure_api_calls_filter`'
-how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
-  run the baseline search `Baseline Of Cloud Infrastructure API Calls Per User` to
-  create the probability density function.
-known_false_positives: ''
-references: []
 tags:
   analytic_story:
   - Suspicious Cloud User Activities
@@ -51,20 +49,22 @@ tags:
   - PR.AC
   observable:
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Change.All_Changes.command
+  - Change.All_Changes.status
+  - Change.All_Changes.user
   - _time
-  - All_Changes.command
-  - All_Changes.user
-  - All_Changes.status
   risk_score: 15
   security_domain: network
   supported_tas:
   - Splunk_TA_aws-kinesis-firehose
+type: Anomaly
+version: 1
diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
index 30100483c7..44f229cdd6 100644
--- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
+++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml
@@ -1,30 +1,28 @@
-name: Abnormally High Number Of Cloud Security Group API Calls
-id: d4dfb7f3-7a37-498a-b5df-f19334e871af
-version: 1
-date: '2020-09-07'
 author: David Dorsey, Splunk
-type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
+date: '2020-09-07'
 description: This search will detect a spike in the number of API calls made to your
   cloud infrastructure environment about security groups by a user.
-search: '| tstats count as security_group_api_calls values(All_Changes.command) as
-  command from datamodel=Change.All_Changes where All_Changes.object_category=firewall AND All_Changes.status=success
-  by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval
-  HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time,
-  "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay
-  isWeekend [ summary cloud_excessive_security_group_api_calls_v1] | where cardinality
-  >=16 | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 | rename
-  "IsOutlier(security_group_api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold
-  = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where security_group_api_calls
-  > expected_upper_threshold | eval distance_from_threshold = security_group_api_calls
-  - expected_upper_threshold | table _time, user, command, security_group_api_calls,
-  expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`'
 how_to_implement: You must be ingesting your cloud infrastructure logs. You also must
   run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to
   create the probability density function model.
+id: d4dfb7f3-7a37-498a-b5df-f19334e871af
 known_false_positives: ''
+name: Abnormally High Number Of Cloud Security Group API Calls
 references: []
+search: '| tstats count as security_group_api_calls values(All_Changes.command) as
+  command from datamodel=Change.All_Changes where All_Changes.object_category=firewall
+  AND All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")`
+  | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval
+  DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
+  <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_security_group_api_calls_v1]
+  | where cardinality >=16 | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005
+  | rename "IsOutlier(security_group_api_calls)" as isOutlier | where isOutlier=1
+  | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"),
+  0) | where security_group_api_calls > expected_upper_threshold | eval distance_from_threshold
+  = security_group_api_calls - expected_upper_threshold | table _time, user, command,
+  security_group_api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`'
 tags:
   analytic_story:
   - Suspicious Cloud User Activities
@@ -56,21 +54,23 @@ tags:
   - PR.AC
   observable:
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Change.All_Changes.command
+  - Change.All_Changes.object_category
+  - Change.All_Changes.status
+  - Change.All_Changes.user
   - _time
-  - All_Changes.command
-  - All_Changes.object_category
-  - All_Changes.status
-  - All_Changes.user
   risk_score: 15
   security_domain: network
   supported_tas:
   - Splunk_TA_aws-kinesis-firehose
+type: Anomaly
+version: 1
diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
index 931bf81982..949232aca8 100644
--- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
+++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
@@ -1,12 +1,19 @@
-name: AWS Create Policy Version to allow all resources
-id: 2a9b80d3-6340-4345-b5ad-212bf3d0dac4
-version: 2
-date: '2021-02-22'
 author: Bhavin Patel, Splunk
-type: TTP
 datamodel: []
+date: '2021-02-22'
 description: This search looks for AWS CloudTrail events where a user created a policy
   version that allows them to access any resource in their account
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+id: 2a9b80d3-6340-4345-b5ad-212bf3d0dac4
+known_false_positives: While this search has no known false positives, it is possible
+  that an AWS admin has legitimately created a policy to allow a user to access all
+  resources. That said, AWS strongly advises against granting full control to all
+  AWS resources
+name: AWS Create Policy Version to allow all resources
+references:
+- https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
+- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
 search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com
   errorCode = success | spath input=requestParameters.policyDocument output=key_policy_statements
   path=Statement{} | mvexpand key_policy_statements | spath input=key_policy_statements
@@ -15,15 +22,6 @@ search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.
   as policy_added by eventName eventSource aws_account_id errorCode userAgent eventID
   awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`|`aws_create_policy_version_to_allow_all_resources_filter`'
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with AWS CloudTrail logs.
-known_false_positives: While this search has no known false positives, it is possible
-  that an AWS admin has legitimately created a policy to allow a user to access all
-  resources. That said, AWS strongly advises against granting full control to all
-  AWS resources
-references:
-- https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
-- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
 tags:
   analytic_story:
   - AWS IAM Privilege Escalation
@@ -53,9 +51,9 @@ tags:
   - DE.CM
   observable:
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -63,9 +61,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - errorCode
   - eventName
   - userAgent
-  - errorCode
-  - requestParameters.userName
   risk_score: 49
   security_domain: network
+type: TTP
+version: 2
diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml
index b0a79677d4..634dd5f9cf 100644
--- a/detections/cloud/aws_createaccesskey.yml
+++ b/detections/cloud/aws_createaccesskey.yml
@@ -1,31 +1,25 @@
-name: AWS CreateAccessKey
-id: 2a9b80d3-6340-4345-11ad-212bf3d0d111
-version: 3
-date: '2022-03-03'
 author: Bhavin Patel, Splunk
-type: Hunting
 datamodel: []
+date: '2022-03-03'
 description: This search looks for AWS CloudTrail events where a user A who has already
   permission to create access keys, makes an API call to create access keys for another
   user B. Attackers have been know to use this technique for Privilege Escalation
   in case new victim(user B) has more permissions than old victim(user B)
-search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success 
-  | eval match=if(match(userIdentity.userName,requestParameters.userName),1,0)
-  | search match=0
-  | stats
-    count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName
-    src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId
-    user_arn 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  |`aws_createaccesskey_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
+id: 2a9b80d3-6340-4345-11ad-212bf3d0d111
 known_false_positives: While this search has no known false positives, it is possible
   that an AWS admin has legitimately created keys for another user.
+name: AWS CreateAccessKey
 references:
 - https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
 - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
+search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com
+  errorCode = success | eval match=if(match(userIdentity.userName,requestParameters.userName),1,0)
+  | search match=0 | stats count min(_time) as firstTime max(_time) as lastTime by
+  requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent
+  eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` |`aws_createaccesskey_filter`'
 tags:
   analytic_story:
   - AWS IAM Privilege Escalation
@@ -55,13 +49,13 @@ tags:
   - DE.CM
   observable:
   - name: src
+    role:
+    - Attacker
     type: IP Address
-    role:
-    - Attacker
   - name: user_arn
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -69,9 +63,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - errorCode
   - eventName
   - userAgent
-  - errorCode
-  - requestParameters.userName
   risk_score: 63
   security_domain: network
+type: Hunting
+version: 3
diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml
index 5a203a77d8..90df0ad1e5 100644
--- a/detections/cloud/aws_createloginprofile.yml
+++ b/detections/cloud/aws_createloginprofile.yml
@@ -1,14 +1,19 @@
-name: AWS CreateLoginProfile
-id: 2a9b80d3-6340-4345-11ad-212bf444d111
-version: 2
-date: '2021-07-19'
 author: Bhavin Patel, Splunk
-type: TTP
 datamodel: []
+date: '2021-07-19'
 description: This search looks for AWS CloudTrail events where a user A(victim A)
   creates a login profile for user B, followed by a AWS Console login event from user
   B from the same src_ip as user B. This correlated event can be indicative of privilege
   escalation since both events happened from the same src_ip
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+id: 2a9b80d3-6340-4345-11ad-212bf444d111
+known_false_positives: While this search has no known false positives, it is possible
+  that an AWS admin has legitimately created a login profile for another user.
+name: AWS CreateLoginProfile
+references:
+- https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
+- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
 search: '`cloudtrail` eventName = CreateLoginProfile | rename requestParameters.userName
   as new_login_profile | table src_ip eventName new_login_profile userIdentity.userName  |
   join new_login_profile src_ip [| search `cloudtrail` eventName = ConsoleLogin |
@@ -17,13 +22,6 @@ search: '`cloudtrail` eventName = CreateLoginProfile | rename requestParameters.
   userAgent eventID awsRegion userIdentity.principalId user_arn new_login_profile
   src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`]
   | `aws_createloginprofile_filter`'
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with AWS CloudTrail logs.
-known_false_positives: While this search has no known false positives, it is possible
-  that an AWS admin has legitimately created a login profile for another user.
-references:
-- https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
-- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
 tags:
   analytic_story:
   - AWS IAM Privilege Escalation
@@ -53,13 +51,13 @@ tags:
   - DE.CM
   observable:
   - name: src_ip
+    role:
+    - Attacker
     type: IP Address
-    role:
-    - Attacker
   - name: user_arn
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -67,9 +65,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - errorCode
   - eventName
   - userAgent
-  - errorCode
-  - requestParameters.userName
   risk_score: 72
   security_domain: network
+type: TTP
+version: 2
diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml
index 677fc3cbd7..e418504406 100644
--- a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml
+++ b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml
@@ -1,13 +1,22 @@
-name: AWS Cross Account Activity From Previously Unseen Account
-id: 21193641-cb96-4a2c-a707-d9b9a7f7792b
-version: 1
-date: '2020-05-28'
 author: Rico Valdez, Splunk
-type: Anomaly
 datamodel:
-- Authentication
+- Authentication.Authentication
+date: '2020-05-28'
 description: This search looks for AssumeRole events where an IAM role in a different
   account is requested for the first time.
+how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
+  provider. You should run the baseline search `Previously Seen AWS Cross Account
+  Activity - Initial` to build the initial table of source IP address, geographic
+  locations, and times. You must also enable the second baseline search `Previously
+  Seen AWS Cross Account Activity - Update` to keep this table up to date and to age
+  out old data. You can also provide additional filtering for this search by customizing
+  the `aws_cross_account_activity_from_previously_unseen_account_filter` macro.
+id: 21193641-cb96-4a2c-a707-d9b9a7f7792b
+known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior.
+  It's suspicious when an account requests privileges of an account it hasn't before.
+  You should validate with the account owner that this is a legitimate request.
+name: AWS Cross Account Activity From Previously Unseen Account
+references: []
 search: '| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication.Authentication
   where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user
   Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)`
@@ -18,17 +27,6 @@ search: '| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=
   Cross Account Activity","Previously Seen") |  where status = "New Cross Account
   Activity" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
   `aws_cross_account_activity_from_previously_unseen_account_filter`'
-how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
-  provider. You should run the baseline search `Previously Seen AWS Cross Account
-  Activity - Initial` to build the initial table of source IP address, geographic
-  locations, and times. You must also enable the second baseline search `Previously
-  Seen AWS Cross Account Activity - Update` to keep this table up to date and to age
-  out old data. You can also provide additional filtering for this search by customizing
-  the `aws_cross_account_activity_from_previously_unseen_account_filter` macro.
-known_false_positives: Using multiple AWS accounts and roles is perfectly valid behavior.
-  It's suspicious when an account requests privileges of an account it hasn't before.
-  You should validate with the account owner that this is a legitimate request.
-references: []
 tags:
   analytic_story:
   - Suspicious Cloud Authentication Activities
@@ -55,24 +53,26 @@ tags:
   - DE.AE
   observable:
   - name: requestingAccountId
-    type: Other
     role:
     - Attacker
-  - name: requestedAccountId
     type: Other
+  - name: requestedAccountId
     role:
     - Victim
+    type: Other
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Authentication.Authentication.signature
+  - Authentication.Authentication.src
+  - Authentication.Authentication.user
+  - Authentication.Authentication.user_role
+  - Authentication.Authentication.vendor_account
   - _time
-  - Authentication.signature
-  - Authentication.vendor_account
-  - Authentication.user
-  - Authentication.user_role
-  - Authentication.src
   risk_score: 15
   security_domain: network
+type: Anomaly
+version: 1
diff --git a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
index 170a48597e..013682a76b 100644
--- a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
+++ b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
@@ -1,14 +1,19 @@
-name: AWS Detect Users creating keys with encrypt policy without MFA
-id: c79c164f-4b21-4847-98f9-cf6a9f49179e
-version: 1
-date: '2021-01-11'
 author: Rod Soto, Patrick Bareiss Splunk
-type: TTP
 datamodel: []
+date: '2021-01-11'
 description: This search provides detection of KMS keys where action kms:Encrypt is
   accessible for everyone (also outside of your organization). This is an indicator
   that your account is compromised and the attacker uses the encryption key to compromise
   another company.
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs
+id: c79c164f-4b21-4847-98f9-cf6a9f49179e
+known_false_positives: unknown
+name: AWS Detect Users creating keys with encrypt policy without MFA
+references:
+- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
+- https://github.com/d1vious/git-wild-hunt
+- https://www.youtube.com/watch?v=PgzNib37g0M
 search: '`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy | spath input=requestParameters.policy
   output=key_policy_statements path=Statement{} | mvexpand key_policy_statements |
   spath input=key_policy_statements output=key_policy_action_1 path=Action | spath
@@ -18,13 +23,6 @@ search: '`cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy | spath inpu
   | stats count min(_time) as firstTime max(_time) as lastTime by eventName eventSource
   eventID awsRegion userIdentity.principalId | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` |`aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`'
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with AWS CloudTrail logs
-known_false_positives: unknown
-references:
-- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
-- https://github.com/d1vious/git-wild-hunt
-- https://www.youtube.com/watch?v=PgzNib37g0M
 tags:
   analytic_story:
   - Ransomware Cloud
@@ -45,9 +43,9 @@ tags:
   - T1486
   observable:
   - name: userIdentity.principalId
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -55,11 +53,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - awsRegion
+  - eventID
   - eventName
   - eventSource
-  - eventID
-  - awsRegion
-  - requestParameters.policy
-  - userIdentity.principalId
   risk_score: 25
   security_domain: threat
+type: TTP
+version: 1
diff --git a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml
index c77f2d28d6..6a71bdd854 100644
--- a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml
+++ b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml
@@ -1,25 +1,23 @@
-name: AWS Detect Users with KMS keys performing encryption S3
-id: 884a5f59-eec7-4f4a-948b-dbde18225fdc
-version: 1
-date: '2021-01-11'
 author: Rod Soto, Patrick Bareiss Splunk
-type: Anomaly
 datamodel: []
+date: '2021-01-11'
 description: This search provides detection of users with KMS keys performing encryption
   specifically against S3 buckets.
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs
+id: 884a5f59-eec7-4f4a-948b-dbde18225fdc
+known_false_positives: bucket with S3 encryption
+name: AWS Detect Users with KMS keys performing encryption S3
+references:
+- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
+- https://github.com/d1vious/git-wild-hunt
+- https://www.youtube.com/watch?v=PgzNib37g0M
 search: '`cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption="aws:kms"
   | rename requestParameters.bucketName AS bucket_name, requestParameters.x-amz-copy-source
   AS src_file, requestParameters.key AS dest_file | stats count min(_time) as firstTime
   max(_time) as lastTime values(src_file) AS src_file values(dest_file) AS dest_file
   values(userAgent) AS userAgent values(region) AS region values(src) AS src by user
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_with_kms_keys_performing_encryption_s3_filter`'
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with AWS CloudTrail logs
-known_false_positives: bucket with S3 encryption
-references:
-- https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/
-- https://github.com/d1vious/git-wild-hunt
-- https://www.youtube.com/watch?v=PgzNib37g0M
 tags:
   analytic_story:
   - Ransomware Cloud
@@ -40,13 +38,13 @@ tags:
   - T1486
   observable:
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   - name: dest_file
-    type: File
     role:
     - Target
+    type: File
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -55,11 +53,9 @@ tags:
   required_fields:
   - _time
   - eventName
-  - requestParameters.x-amz-server-side-encryption
-  - requestParameters.bucketName
-  - requestParameters.x-amz-copy-source
-  - requestParameters.key
-  - userAgent
   - region
+  - userAgent
   risk_score: 15
   security_domain: threat
+type: Anomaly
+version: 1
diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml
index 87d84d5761..2d87801d6c 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml
@@ -1,13 +1,16 @@
-name: AWS ECR Container Scanning Findings High
-id: 62721bd2-1d82-4623-b6e6-aac170014423
-version: 1
-date: '2021-08-17'
 author: Patrick Bareiss, Splunk
-type: TTP
 datamodel: []
+date: '2021-08-17'
 description: This search looks for AWS CloudTrail events from AWS Elastic Container
   Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings
   with the results.
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+id: 62721bd2-1d82-4623-b6e6-aac170014423
+known_false_positives: unknown
+name: AWS ECR Container Scanning Findings High
+references:
+- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
 search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
   | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand
   findings | spath input=findings| search severity=HIGH | rename name as finding_name,
@@ -17,11 +20,6 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF
   as lastTime by awsRegion, eventName, eventSource, imageDigest, image, user, userName,
   src_ip, finding, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `aws_ecr_container_scanning_findings_high_filter`'
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with AWS CloudTrail logs.
-known_false_positives: unknown
-references:
-- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
 tags:
   analytic_story:
   - Dev Sec Ops
@@ -29,10 +27,10 @@ tags:
   cis20:
   - CIS 13
   confidence: 100
-  deployments:
-  - Slack Alert
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.003/aws_ecr_image_scanning/aws_ecr_scanning_findings_events.json
+  deployments:
+  - Slack Alert
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
@@ -46,23 +44,22 @@ tags:
   - DE.CM
   observable:
   - name: image
-    type: System
     role:
     - Victim
+    type: System
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   - Dev Sec Ops Analytics
   required_fields:
-  - eventSource
-  - eventName
-  - responseElements.imageScanFindings.findings{}
   - awsRegion
-  - requestParameters.imageId.imageDigest
-  - requestParameters.repositoryName
+  - eventName
+  - eventSource
+  - src_ip
   - user
   - userName
-  - src_ip
   risk_score: 70
   security_domain: network
+type: TTP
+version: 1
diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
index 323d73cd38..c0938fded5 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml
@@ -1,13 +1,16 @@
-name: AWS ECR Container Scanning Findings Low Informational Unknown
-id: cbc95e44-7c22-443f-88fd-0424478f5589
-version: 1
-date: '2021-08-17'
 author: Patrick Bareiss, Splunk
-type: Hunting
 datamodel: []
+date: '2021-08-17'
 description: This search looks for AWS CloudTrail events from AWS Elastic Container
   Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings
   with the results.
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+id: cbc95e44-7c22-443f-88fd-0424478f5589
+known_false_positives: unknown
+name: AWS ECR Container Scanning Findings Low Informational Unknown
+references:
+- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
 search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
   | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand
   findings | spath input=findings| search severity IN (LOW, INFORMATIONAL, UNKNWON)
@@ -18,11 +21,6 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF
   eventSource, imageDigest, repositoryName, user, userName, src_ip, finding, phase,
   severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `aws_ecr_container_scanning_findings_low_informational_unknown_filter`'
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with AWS CloudTrail logs.
-known_false_positives: unknown
-references:
-- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
 tags:
   analytic_story:
   - Dev Sec Ops
@@ -45,23 +43,22 @@ tags:
   - DE.CM
   observable:
   - name: repositoryName
-    type: System
     role:
     - Victim
+    type: System
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   - Dev Sec Ops Analytics
   required_fields:
-  - eventSource
-  - eventName
-  - responseElements.imageScanFindings.findings{}
   - awsRegion
-  - requestParameters.imageId.imageDigest
-  - requestParameters.repositoryName
+  - eventName
+  - eventSource
+  - src_ip
   - user
   - userName
-  - src_ip
   risk_score: 7
   security_domain: network
+type: Hunting
+version: 1
diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
index caa5ed111f..5c287ca011 100644
--- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
+++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml
@@ -1,13 +1,16 @@
-name: AWS ECR Container Scanning Findings Medium
-id: 0b80e2c8-c746-4ddb-89eb-9efd892220cf
-version: 1
-date: '2021-08-17'
 author: Patrick Bareiss, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-08-17'
 description: This search looks for AWS CloudTrail events from AWS Elastic Container
   Service (ECR). You need to activate image scanning in order to get the event DescribeImageScanFindings
   with the results.
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+id: 0b80e2c8-c746-4ddb-89eb-9efd892220cf
+known_false_positives: unknown
+name: AWS ECR Container Scanning Findings Medium
+references:
+- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
 search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanFindings
   | spath path=responseElements.imageScanFindings.findings{} output=findings | mvexpand
   findings | spath input=findings| search severity=MEDIUM | rename name as finding_name,
@@ -17,11 +20,6 @@ search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=DescribeImageScanF
   max(_time) as lastTime by awsRegion, eventName, eventSource, imageDigest, image,
   user, userName, src_ip, finding, phase, severity | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `aws_ecr_container_scanning_findings_medium_filter`'
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with AWS CloudTrail logs.
-known_false_positives: unknown
-references:
-- https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html
 tags:
   analytic_story:
   - Dev Sec Ops
@@ -44,23 +42,22 @@ tags:
   - DE.CM
   observable:
   - name: image
-    type: System
     role:
     - Victim
+    type: System
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   - Dev Sec Ops Analytics
   required_fields:
-  - eventSource
-  - eventName
-  - responseElements.imageScanFindings.findings{}
   - awsRegion
-  - requestParameters.imageId.imageDigest
-  - requestParameters.repositoryName
+  - eventName
+  - eventSource
+  - src_ip
   - user
   - userName
-  - src_ip
   risk_score: 21
   security_domain: network
+type: Anomaly
+version: 1
diff --git a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml
index 16e9d78c38..96a7896766 100644
--- a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml
+++ b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml
@@ -1,25 +1,23 @@
-name: AWS ECR Container Upload Outside Business Hours
-id: d4c4d4eb-3994-41ca-a25e-a82d64e125bb
-version: 1
-date: '2021-08-19'
 author: Patrick Bareiss, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-08-19'
 description: This search looks for AWS CloudTrail events from AWS Elastic Container
   Service (ECR). A upload of a new container is normally done during business hours.
   When done outside business hours, we want to take a look into it.
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+id: d4c4d4eb-3994-41ca-a25e-a82d64e125bb
+known_false_positives: When your development is spreaded in different time zones,
+  applying this rule can be difficult.
+name: AWS ECR Container Upload Outside Business Hours
+references:
+- https://attack.mitre.org/techniques/T1204/003/
 search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage date_hour>=20
   OR date_hour<8 NOT (date_wday=saturday OR date_wday=sunday) | rename requestParameters.*
   as * | rename repositoryName AS image | eval phase="release" | eval severity="medium"
   | stats min(_time) as firstTime max(_time) as lastTime by awsRegion, eventName,
   eventSource, user, userName, src_ip, imageTag, registryId, image, phase, severity
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_ecr_container_upload_outside_business_hours_filter`'
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with AWS CloudTrail logs.
-known_false_positives: When your development is spreaded in different time zones,
-  applying this rule can be difficult.
-references:
-- https://attack.mitre.org/techniques/T1204/003/
 tags:
   analytic_story:
   - Dev Sec Ops
@@ -42,27 +40,26 @@ tags:
   - DE.CM
   observable:
   - name: src_ip
+    role:
+    - Attacker
     type: IP Address
-    role:
-    - Attacker
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   - Dev Sec Ops Analytics
   required_fields:
-  - eventSource
-  - eventName
   - awsRegion
-  - requestParameters.imageTag
-  - requestParameters.registryId
-  - requestParameters.repositoryName
+  - eventName
+  - eventSource
+  - src_ip
   - user
   - userName
-  - src_ip
   risk_score: 49
   security_domain: network
+type: Anomaly
+version: 1
diff --git a/detections/cloud/aws_ecr_container_upload_unknown_user.yml b/detections/cloud/aws_ecr_container_upload_unknown_user.yml
index 11a89ff300..f69701d986 100644
--- a/detections/cloud/aws_ecr_container_upload_unknown_user.yml
+++ b/detections/cloud/aws_ecr_container_upload_unknown_user.yml
@@ -1,25 +1,23 @@
-name: AWS ECR Container Upload Unknown User
-id: 300688e4-365c-4486-a065-7c884462b31d
-version: 1
-date: '2021-08-19'
 author: Patrick Bareiss, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-08-19'
 description: This search looks for AWS CloudTrail events from AWS Elastic Container
   Service (ECR). A upload of a new container is normally done from only a few known
   users. When the user was never seen before, we should have a closer look into the
   event.
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+id: 300688e4-365c-4486-a065-7c884462b31d
+known_false_positives: unknown
+name: AWS ECR Container Upload Unknown User
+references:
+- https://attack.mitre.org/techniques/T1204/003/
 search: '`cloudtrail` eventSource=ecr.amazonaws.com eventName=PutImage NOT `aws_ecr_users`
   | rename requestParameters.* as * | rename repositoryName AS image | eval phase="release"
   | eval severity="high" | stats min(_time) as firstTime max(_time) as lastTime by
   awsRegion, eventName, eventSource, user, userName, src_ip, imageTag, registryId,
   image, phase, severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `aws_ecr_container_upload_unknown_user_filter`'
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with AWS CloudTrail logs.
-known_false_positives: unknown
-references:
-- https://attack.mitre.org/techniques/T1204/003/
 tags:
   analytic_story:
   - Dev Sec Ops
@@ -42,27 +40,26 @@ tags:
   - DE.CM
   observable:
   - name: src_ip
+    role:
+    - Attacker
     type: IP Address
-    role:
-    - Attacker
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   - Dev Sec Ops Analytics
   required_fields:
-  - eventSource
-  - eventName
   - awsRegion
-  - requestParameters.imageTag
-  - requestParameters.registryId
-  - requestParameters.repositoryName
+  - eventName
+  - eventSource
+  - src_ip
   - user
   - userName
-  - src_ip
   risk_score: 49
   security_domain: network
+type: Anomaly
+version: 1
diff --git a/detections/cloud/aws_excessive_security_scanning.yml b/detections/cloud/aws_excessive_security_scanning.yml
index 690360f6f2..06513b56b2 100644
--- a/detections/cloud/aws_excessive_security_scanning.yml
+++ b/detections/cloud/aws_excessive_security_scanning.yml
@@ -1,23 +1,21 @@
-name: AWS Excessive Security Scanning
-id: 1fdd164a-def8-4762-83a9-9ffe24e74d5a
-version: 1
-date: '2021-04-13'
 author: Patrick Bareiss, Splunk
-type: TTP
 datamodel: []
+date: '2021-04-13'
 description: This search looks for AWS CloudTrail events and analyse the amount of
   eventNames which starts with Describe by a single user. This indicates that this
   user scans the configuration of your AWS cloud environment.
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+id: 1fdd164a-def8-4762-83a9-9ffe24e74d5a
+known_false_positives: While this search has no known false positives.
+name: AWS Excessive Security Scanning
+references:
+- https://github.com/aquasecurity/cloudsploit
 search: '`cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get*  |
   stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime
   values(eventName) as eventName values(src) as src values(userAgent) as userAgent
   by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter`'
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with AWS CloudTrail logs.
-known_false_positives: While this search has no known false positives.
-references:
-- https://github.com/aquasecurity/cloudsploit
 tags:
   analytic_story:
   - AWS User Monitoring
@@ -46,13 +44,13 @@ tags:
   - DE.CM
   observable:
   - name: src
+    role:
+    - Attacker
     type: IP Address
-    role:
-    - Attacker
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -62,10 +60,11 @@ tags:
   - _time
   - eventName
   - src
-  - userAgent
   - user
-  - userIdentity.arn
+  - userAgent
   risk_object: src
   risk_object_type: system
   risk_score: 18
   security_domain: network
+type: TTP
+version: 1
diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml
index fce7e3c4ed..21803db498 100644
--- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml
+++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml
@@ -1,26 +1,24 @@
-name: AWS IAM AccessDenied Discovery Events
-id: 3e1f1568-9633-11eb-a69c-acde48001122
-version: 2
-date: '2021-11-12'
 author: Michael Haag, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-11-12'
 description: The following detection identifies excessive AccessDenied events within
   an hour timeframe. It is possible that an access key to AWS may have been stolen
   and is being misused to perform discovery events. In these instances, the access
   is not available with the key stolen therefore these events will be generated.
+how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
+  this data. The search requires AWS Cloudtrail logs.
+id: 3e1f1568-9633-11eb-a69c-acde48001122
+known_false_positives: It is possible to start this detection will need to be tuned
+  by source IP or user. In addition, change the count values to an upper threshold
+  to restrict false positives.
+name: AWS IAM AccessDenied Discovery Events
+references:
+- https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/
 search: '`cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com)
   | bucket _time span=1h | stats count as failures min(_time) as firstTime max(_time)
   as lastTime, dc(eventName) as methods, dc(eventSource) as sources by src_ip, userIdentity.arn,
   _time | where failures >= 5 and methods >= 1 and sources >= 1 | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `aws_iam_accessdenied_discovery_events_filter`'
-how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
-  this data. The search requires AWS Cloudtrail logs.
-known_false_positives: It is possible to start this detection will need to be tuned
-  by source IP or user. In addition, change the count values to an upper threshold
-  to restrict false positives.
-references:
-- https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/
 tags:
   analytic_story:
   - Suspicious Cloud User Activities
@@ -42,13 +40,13 @@ tags:
   - T1580
   observable:
   - name: src_ip
+    role:
+    - Attacker
     type: IP Address
-    role:
-    - Attacker
   - name: userIdentity.arn
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -56,12 +54,13 @@ tags:
   - Splunk Security Analytics for AWS
   required_fields:
   - _time
+  - errorCode
   - eventName
   - eventSource
   - userAgent
-  - errorCode
-  - userIdentity.type
   risk_object: src_ip
   risk_object_type: system
   risk_score: 10
   security_domain: access
+type: Anomaly
+version: 2
diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml
index 10c379a951..69d5f6ed49 100644
--- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml
+++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml
@@ -1,32 +1,30 @@
-name: AWS IAM Assume Role Policy Brute Force
-id: f19e09b0-9308-11eb-b7ec-acde48001122
-version: 1
-date: '2021-04-01'
 author: Michael Haag, Splunk
-type: TTP
 datamodel: []
+date: '2021-04-01'
 description: The following detection identifies any malformed policy document exceptions
   with a status of `failure`. A malformed policy document exception occurs in instances
   where roles are attempted to be assumed, or brute forced. In a brute force attempt,
   using a tool like CloudSploit or Pacu, an attempt will look like `arn:aws:iam::111111111111:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS`.  Meaning,
   when an adversary is attempting to identify a role name, multiple failures will
   occur. This detection focuses on the errors of a remote attempt that is failing.
+how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
+  this data. The search requires AWS Cloudtrail logs. Set the `where count` greater
+  than a value to identify suspicious activity in your environment.
+id: f19e09b0-9308-11eb-b7ec-acde48001122
+known_false_positives: This detection will require tuning to provide high fidelity
+  detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
+  or by groups of users.
+name: AWS IAM Assume Role Policy Brute Force
+references:
+- https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities
+- https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/
+- https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html
 search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure
   (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as
   lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource
   aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion
   userIdentity.principalId user_arn | where count >= 2 | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `aws_iam_assume_role_policy_brute_force_filter`'
-how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
-  this data. The search requires AWS Cloudtrail logs. Set the `where count` greater
-  than a value to identify suspicious activity in your environment.
-known_false_positives: This detection will require tuning to provide high fidelity
-  detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
-  or by groups of users.
-references:
-- https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities
-- https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/
-- https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html
 tags:
   analytic_story:
   - AWS IAM Privilege Escalation
@@ -49,13 +47,13 @@ tags:
   - T1110
   observable:
   - name: src
-    type: IP Address
     role:
     - Attacker
+    type: IP Address
   - name: user_arn
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -63,9 +61,10 @@ tags:
   - Splunk Security Analytics for AWS
   required_fields:
   - _time
+  - errorCode
   - eventName
   - userAgent
-  - errorCode
-  - requestParameters.policyName
   risk_score: 28
   security_domain: access
+type: TTP
+version: 1
diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml
index 88f7e99926..29a170718a 100644
--- a/detections/cloud/aws_iam_delete_policy.yml
+++ b/detections/cloud/aws_iam_delete_policy.yml
@@ -1,30 +1,28 @@
-name: AWS IAM Delete Policy
-id: ec3a9362-92fe-11eb-99d0-acde48001122
-version: 1
-date: '2021-04-01'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel: []
+date: '2021-04-01'
 description: The following detection identifes when a policy is deleted on AWS. This
   does not identify whether successful or failed, but the error messages tell a story
   of suspicious attempts. There is a specific process to follow when deleting a policy.
   First, detach the policy from all users, groups, and roles that the policy is attached
   to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy.
-search: '`cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) | stats
-  count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn)
-  as policyArn by src eventName eventSource aws_account_id errorCode errorMessage
-  userAgent eventID awsRegion userIdentity.principalId userIdentity.arn | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `aws_iam_delete_policy_filter`'
 how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
   this data. The search requires AWS Cloudtrail logs.
+id: ec3a9362-92fe-11eb-99d0-acde48001122
 known_false_positives: This detection will require tuning to provide high fidelity
   detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
   or by groups of users. Not every user with AWS access should have permission to
   delete policies (least privilege). In addition, this may be saved seperately and
   tuned for failed or success attempts only.
+name: AWS IAM Delete Policy
 references:
 - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html
 - https://docs.aws.amazon.com/cli/latest/reference/iam/delete-policy.html
+search: '`cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) | stats
+  count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn)
+  as policyArn by src eventName eventSource aws_account_id errorCode errorMessage
+  userAgent eventID awsRegion userIdentity.principalId userIdentity.arn | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `aws_iam_delete_policy_filter`'
 tags:
   analytic_story:
   - AWS IAM Privilege Escalation
@@ -46,13 +44,13 @@ tags:
   - T1098
   observable:
   - name: src
-    type: IP Address
     role:
     - Attacker
+    type: IP Address
   - name: user_arn
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -60,9 +58,10 @@ tags:
   - Splunk Security Analytics for AWS
   required_fields:
   - _time
+  - errorCode
   - eventName
   - userAgent
-  - errorCode
-  - requestParameters.policyArn
   risk_score: 10
   security_domain: access
+type: Hunting
+version: 1
diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml
index efbceee4a2..b2ecef992b 100644
--- a/detections/cloud/aws_iam_failure_group_deletion.yml
+++ b/detections/cloud/aws_iam_failure_group_deletion.yml
@@ -1,30 +1,28 @@
-name: AWS IAM Failure Group Deletion
-id: 723b861a-92eb-11eb-93b8-acde48001122
-version: 1
-date: '2021-04-01'
 author: Michael Haag, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-04-01'
 description: This detection identifies failure attempts to delete groups. We want
   to identify when a group is attempting to be deleted, but either access is denied,
   there is a conflict or there is no group. This is indicative of administrators performing
   an action, but also could be suspicious behavior occurring. Review parallel IAM
   events - recently added users, new groups and so forth.
+how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
+  this data. The search requires AWS Cloudtrail logs.
+id: 723b861a-92eb-11eb-93b8-acde48001122
+known_false_positives: This detection will require tuning to provide high fidelity
+  detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
+  or by groups of users. Not every user with AWS access should have permission to
+  delete groups (least privilege).
+name: AWS IAM Failure Group Deletion
+references:
+- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
+- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
 search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode
   IN (NoSuchEntityException,DeleteConflictException, AccessDenied) (userAgent!=*.amazonaws.com)
   | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.groupName)
   as group_name by src eventName eventSource aws_account_id errorCode errorMessage
   userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `aws_iam_failure_group_deletion_filter`'
-how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
-  this data. The search requires AWS Cloudtrail logs.
-known_false_positives: This detection will require tuning to provide high fidelity
-  detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
-  or by groups of users. Not every user with AWS access should have permission to
-  delete groups (least privilege).
-references:
-- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
-- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
 tags:
   analytic_story:
   - AWS IAM Privilege Escalation
@@ -45,17 +43,17 @@ tags:
   - T1098
   observable:
   - name: src
-    type: IP Address
     role:
     - Attacker
+    type: IP Address
   - name: user_arn
-    type: User
     role:
     - Victim
+    type: User
   - name: group_name
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -63,9 +61,10 @@ tags:
   - Splunk Security Analytics for AWS
   required_fields:
   - _time
+  - errorCode
   - eventName
   - userAgent
-  - errorCode
-  - requestParameters.groupName
   risk_score: 5
   security_domain: cloud
+type: Anomaly
+version: 1
diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml
index c39a47fc4d..7316610ce9 100644
--- a/detections/cloud/aws_iam_successful_group_deletion.yml
+++ b/detections/cloud/aws_iam_successful_group_deletion.yml
@@ -1,28 +1,26 @@
-name: AWS IAM Successful Group Deletion
-id: e776d06c-9267-11eb-819b-acde48001122
-version: 1
-date: '2021-03-31'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel: []
+date: '2021-03-31'
 description: The following query uses IAM events to track the success of a group being
   deleted on AWS. This is typically not indicative of malicious behavior, but a precurser
   to additional events thay may unfold. Review parallel IAM events - recently added
   users, new groups and so forth. Inversely, review failed attempts in a similar manner.
+how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
+  this data. The search requires AWS Cloudtrail logs.
+id: e776d06c-9267-11eb-819b-acde48001122
+known_false_positives: This detection will require tuning to provide high fidelity
+  detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
+  or by groups of users. Not every user with AWS access should have permission to
+  delete groups (least privilege).
+name: AWS IAM Successful Group Deletion
+references:
+- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
+- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
 search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode=success
   (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as
   lastTime values(requestParameters.groupName) as group_deleted by src eventName eventSource
   errorCode user_agent awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `aws_iam_successful_group_deletion_filter`'
-how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
-  this data. The search requires AWS Cloudtrail logs.
-known_false_positives: This detection will require tuning to provide high fidelity
-  detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
-  or by groups of users. Not every user with AWS access should have permission to
-  delete groups (least privilege).
-references:
-- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
-- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
 tags:
   analytic_story:
   - AWS IAM Privilege Escalation
@@ -45,17 +43,17 @@ tags:
   - T1069
   observable:
   - name: src
-    type: IP Address
     role:
     - Attacker
+    type: IP Address
   - name: user_arn
-    type: User
     role:
     - Victim
+    type: User
   - name: group_deleted
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -63,9 +61,10 @@ tags:
   - Splunk Security Analytics for AWS
   required_fields:
   - _time
+  - errorCode
   - eventName
   - userAgent
-  - errorCode
-  - requestParameters.groupName
   risk_score: 5
   security_domain: cloud
+type: Hunting
+version: 1
diff --git a/detections/cloud/aws_lambda_updatefunctioncode.yml b/detections/cloud/aws_lambda_updatefunctioncode.yml
index af5ab9bcdd..44e4d5a10c 100644
--- a/detections/cloud/aws_lambda_updatefunctioncode.yml
+++ b/detections/cloud/aws_lambda_updatefunctioncode.yml
@@ -1,26 +1,24 @@
-name: AWS Lambda UpdateFunctionCode
-id: 211b80d3-6340-4345-11ad-212bf3d0d111
-version: 1
-date: '2022-02-24'
 author: Bhavin Patel, Splunk
-type: Hunting
 datamodel: []
+date: '2022-02-24'
 description: This analytic is designed to detect IAM users attempting to update/modify
   AWS lambda code via the AWS CLI to gain persistence, futher access into your AWS
   environment and to facilitate planting backdoors. In this instance, an attacker
   may upload malicious code/binary to a lambda function which will be executed automatically
   when the funnction is triggered.
+how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in
+  your AWS Environment.
+id: 211b80d3-6340-4345-11ad-212bf3d0d111
+known_false_positives: While this search has no known false positives, it is possible
+  that an AWS admin or an autorized IAM user has updated the lambda fuction code legitimately.
+name: AWS Lambda UpdateFunctionCode
+references:
+- http://detectioninthe.cloud/execution/modify_lambda_function_code/
+- https://sysdig.com/blog/exploit-mitigate-aws-lambdas-mitre/
 search: '`cloudtrail` eventSource=lambda.amazonaws.com eventName=UpdateFunctionCode*  errorCode
   = success  user_type=IAMUser | stats  count min(_time) as firstTime max(_time) as
   lastTime  values(requestParameters.functionName) as function_updated by src_ip user_arn
   user_agent user_type eventName aws_account_id |`aws_lambda_updatefunctioncode_filter`'
-how_to_implement: You must install Splunk AWS Add on and enable Cloudtrail logs in
-  your AWS Environment.
-known_false_positives: While this search has no known false positives, it is possible
-  that an AWS admin or an autorized IAM user has updated the lambda fuction code legitimately.
-references:
-- http://detectioninthe.cloud/execution/modify_lambda_function_code/
-- https://sysdig.com/blog/exploit-mitigate-aws-lambdas-mitre/
 tags:
   analytic_story:
   - Suspicious Cloud User Activities
@@ -48,21 +46,22 @@ tags:
   - DE.CM
   observable:
   - name: src_ip
+    role:
+    - Attacker
     type: IP Address
-    role:
-    - Attacker
   - name: user_arn
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
   - _time
-  - eventName
-  - userAgent
   - errorCode
+  - eventName
   risk_score: 63
   security_domain: cloud
+type: Hunting
+version: 1
diff --git a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml
index 028c55621a..e0572a02a2 100644
--- a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml
+++ b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml
@@ -1,12 +1,17 @@
-name: AWS Network Access Control List Created with All Open Ports
-id: ada0f478-84a8-4641-a3f1-d82362d6bd75
-version: 2
-date: '2021-01-11'
 author: Bhavin Patel, Patrick Bareiss, Splunk
-type: TTP
 datamodel: []
+date: '2021-01-11'
 description: The search looks for AWS CloudTrail events to detect if any network ACLs
   were created with all the ports open to a specified CIDR.
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail
+  inputs.
+id: ada0f478-84a8-4641-a3f1-d82362d6bd75
+known_false_positives: It's possible that an admin has created this ACL with all ports
+  open for some legitimate purpose however, this should be scoped and not allowed
+  in production environment.
+name: AWS Network Access Control List Created with All Open Ports
+references: []
 search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry
   requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1
   | append [search `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry
@@ -17,13 +22,6 @@ search: '`cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetwor
   requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to
   requestParameters.portRange.from src userAgent requestParameters.cidrBlock | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `aws_network_access_control_list_created_with_all_open_ports_filter`'
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail
-  inputs.
-known_false_positives: It's possible that an admin has created this ACL with all ports
-  open for some legitimate purpose however, this should be scoped and not allowed
-  in production environment.
-references: []
 tags:
   analytic_story:
   - AWS Network ACL Activity
@@ -52,17 +50,17 @@ tags:
   - DE.AE
   observable:
   - name: src
-    type: IP Address
     role:
     - Attacker
-  - name: userName
-    type: User
-    role:
-    - Victim
-  - name: requestParameters.cidrBlock
     type: IP Address
+  - name: userName
     role:
     - Victim
+    type: User
+  - name: requestParameters.cidrBlock
+    role:
+    - Victim
+    type: IP Address
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -71,14 +69,9 @@ tags:
   required_fields:
   - _time
   - eventName
-  - requestParameters.ruleAction
-  - requestParameters.egress
-  - requestParameters.aclProtocol
-  - requestParameters.portRange.to
-  - requestParameters.portRange.from
-  - requestParameters.cidrBlock
-  - userName
-  - userIdentity.principalId
   - userAgent
+  - userName
   risk_score: 48
   security_domain: network
+type: TTP
+version: 2
diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml
index 5a09c419bf..9eee751050 100644
--- a/detections/cloud/aws_network_access_control_list_deleted.yml
+++ b/detections/cloud/aws_network_access_control_list_deleted.yml
@@ -1,25 +1,23 @@
-name: AWS Network Access Control List Deleted
-id: ada0f478-84a8-4641-a3f1-d82362d6fd75
-version: 2
-date: '2021-01-12'
 author: Bhavin Patel, Patrick Bareiss, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-01-12'
 description: Enforcing network-access controls is one of the defensive mechanisms
   used by cloud administrators to restrict access to a cloud instance. After the attacker
   has gained control of the AWS console by compromising an admin account, they can
   delete a network ACL and gain access to the instance from anywhere. This search
   will query the AWS CloudTrail logs to detect users deleting network ACLs.
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
+  inputs.
+id: ada0f478-84a8-4641-a3f1-d82362d6fd75
+known_false_positives: It's possible that a user has legitimately deleted a network
+  ACL.
+name: AWS Network Access Control List Deleted
+references: []
 search: '`cloudtrail` eventName=DeleteNetworkAclEntry requestParameters.egress=false
   | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName
   userIdentity.principalId eventName requestParameters.egress src userAgent | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `aws_network_access_control_list_deleted_filter`'
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail
-  inputs.
-known_false_positives: It's possible that a user has legitimately deleted a network
-  ACL.
-references: []
 tags:
   analytic_story:
   - AWS Network ACL Activity
@@ -47,13 +45,13 @@ tags:
   - DE.AE
   observable:
   - name: src
-    type: IP Address
     role:
     - Attacker
+    type: IP Address
   - name: user_arn
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -62,10 +60,10 @@ tags:
   required_fields:
   - _time
   - eventName
-  - requestParameters.egress
-  - userName
-  - userIdentity.principalId
   - src
   - userAgent
+  - userName
   risk_score: 5
   security_domain: network
+type: Anomaly
+version: 2
diff --git a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml
index 0610fb3962..0ea4f43f2d 100644
--- a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml
+++ b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml
@@ -1,32 +1,30 @@
-name: AWS SAML Access by Provider User and Principal
-id: bbe23980-6019-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-26'
 author: Rod Soto, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-01-26'
 description: This search provides specific SAML access from specific Service Provider,
   user and targeted principal at AWS. This search provides specific information to
   detect abnormal access or potential credential hijack or forgery, specially in federated
   environments using SAML protocol inside the perimeter or cloud provider.
-search: '`cloudtrail` eventName=Assumerolewithsaml | stats count min(_time) as firstTime
-  max(_time) as lastTime by requestParameters.principalArn requestParameters.roleArn
-  requestParameters.roleSessionName recipientAccountId responseElements.issuer sourceIPAddress
-  userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  |`aws_saml_access_by_provider_user_and_principal_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs
+id: bbe23980-6019-11eb-ae93-0242ac130002
 known_false_positives: Attacks using a Golden SAML or SAML assertion hijacks or forgeries
   are very difficult to detect as accessing cloud providers with these assertions
   looks exactly like normal access, however things such as source IP sourceIPAddress
   user, and principal targeted at receiving cloud provider along with endpoint credential
   access and abuse detection searches can provide the necessary context to detect
   these attacks.
+name: AWS SAML Access by Provider User and Principal
 references:
 - https://us-cert.cisa.gov/ncas/alerts/aa21-008a
 - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
 - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
 - https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
+search: '`cloudtrail` eventName=Assumerolewithsaml | stats count min(_time) as firstTime
+  max(_time) as lastTime by requestParameters.principalArn requestParameters.roleArn
+  requestParameters.roleSessionName recipientAccountId responseElements.issuer sourceIPAddress
+  userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  |`aws_saml_access_by_provider_user_and_principal_filter`'
 tags:
   analytic_story:
   - Cloud Federated Credential Abuse
@@ -47,14 +45,14 @@ tags:
   - T1078
   observable:
   - name: sourceIPAddress
-    type: IP Address
     role:
     - Attacker
+    type: IP Address
   - name: recipientAccountId
-    type: Other
     role:
     - Victim
     - Target
+    type: Other
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -63,12 +61,10 @@ tags:
   required_fields:
   - _time
   - eventName
-  - requestParameters.principalArn
-  - requestParameters.roleArn
-  - requestParameters.roleSessionName
   - recipientAccountId
-  - responseElements.issuer
   - sourceIPAddress
   - userAgent
   risk_score: 64
   security_domain: threat
+type: Anomaly
+version: 1
diff --git a/detections/cloud/aws_saml_update_identity_provider.yml b/detections/cloud/aws_saml_update_identity_provider.yml
index b9f00c6653..858cceedfe 100644
--- a/detections/cloud/aws_saml_update_identity_provider.yml
+++ b/detections/cloud/aws_saml_update_identity_provider.yml
@@ -1,28 +1,26 @@
-name: AWS SAML Update identity provider
-id: 2f0604c6-6030-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-26'
 author: Rod Soto, Splunk
-type: TTP
 datamodel: []
+date: '2021-01-26'
 description: This search provides detection of updates to SAML provider in AWS. Updates
   to SAML provider need to be monitored closely as they may indicate possible perimeter
   compromise of federated credentials, or backdoor access from another cloud provider
   set by attacker.
-search: '`cloudtrail` eventName=UpdateSAMLProvider | stats count min(_time) as firstTime
-  max(_time) as lastTime by eventType eventName requestParameters.sAMLProviderArn
-  userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId
-  userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  |`aws_saml_update_identity_provider_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
+id: 2f0604c6-6030-11eb-ae93-0242ac130002
 known_false_positives: Updating a SAML provider or creating a new one may not necessarily
   be malicious however it needs to be closely monitored.
+name: AWS SAML Update identity provider
 references:
 - https://us-cert.cisa.gov/ncas/alerts/aa21-008a
 - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
 - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
 - https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
+search: '`cloudtrail` eventName=UpdateSAMLProvider | stats count min(_time) as firstTime
+  max(_time) as lastTime by eventType eventName requestParameters.sAMLProviderArn
+  userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId
+  userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  |`aws_saml_update_identity_provider_filter`'
 tags:
   analytic_story:
   - Cloud Federated Credential Abuse
@@ -42,14 +40,14 @@ tags:
   - T1078
   observable:
   - name: sourceIPAddress
-    type: IP Address
     role:
     - Attacker
+    type: IP Address
   - name: userIdentity.principalId
-    type: User
     role:
     - Victim
     - Target
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -59,10 +57,8 @@ tags:
   - _time
   - eventName
   - eventType
-  - requestParameters.sAMLProviderArn
-  - userIdentity.sessionContext.sessionIssuer.arn
   - sourceIPAddress
-  - userIdentity.accessKeyId
-  - userIdentity.principalId
   risk_score: 64
   security_domain: threat
+type: TTP
+version: 1
diff --git a/detections/cloud/aws_setdefaultpolicyversion.yml b/detections/cloud/aws_setdefaultpolicyversion.yml
index 6f90e57391..da636d6b05 100644
--- a/detections/cloud/aws_setdefaultpolicyversion.yml
+++ b/detections/cloud/aws_setdefaultpolicyversion.yml
@@ -1,28 +1,26 @@
-name: AWS SetDefaultPolicyVersion
-id: 2a9b80d3-6340-4345-11ad-212bf3d0dac4
-version: 1
-date: '2021-03-02'
 author: Bhavin Patel, Splunk
-type: TTP
 datamodel: []
+date: '2021-03-02'
 description: This search looks for AWS CloudTrail events where a user has set a default
   policy versions. Attackers have been know to use this technique for Privilege Escalation
   in case the previous versions of the policy had permissions to access more resources
   than the current version of the policy
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+id: 2a9b80d3-6340-4345-11ad-212bf3d0dac4
+known_false_positives: While this search has no known false positives, it is possible
+  that an AWS admin has legitimately set a default policy to allow a user to access
+  all resources. That said, AWS strongly advises against granting full control to
+  all AWS resources
+name: AWS SetDefaultPolicyVersion
+references:
+- https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
+- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
 search: '`cloudtrail` eventName=SetDefaultPolicyVersion eventSource = iam.amazonaws.com
   | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn)
   as policy_arn by src requestParameters.versionId eventName eventSource aws_account_id
   errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `aws_setdefaultpolicyversion_filter`'
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with AWS CloudTrail logs.
-known_false_positives: While this search has no known false positives, it is possible
-  that an AWS admin has legitimately set a default policy to allow a user to access
-  all resources. That said, AWS strongly advises against granting full control to
-  all AWS resources
-references:
-- https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
-- https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
 tags:
   analytic_story:
   - AWS IAM Privilege Escalation
@@ -52,13 +50,13 @@ tags:
   - DE.CM
   observable:
   - name: src
-    type: IP Address
     role:
     - Attacker
+    type: IP Address
   - name: user_arn
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -66,10 +64,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - eventName
-  - userAgent
   - errorCode
-  - requestParameters.userName
+  - eventName
   - eventSource
+  - userAgent
   risk_score: 30
   security_domain: threat
+type: TTP
+version: 1
diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml
index bb8525ded2..00059a2bc8 100644
--- a/detections/cloud/aws_updateloginprofile.yml
+++ b/detections/cloud/aws_updateloginprofile.yml
@@ -1,31 +1,25 @@
-name: AWS UpdateLoginProfile
-id: 2a9b80d3-6a40-4115-11ad-212bf3d0d111
-version: 3
-date: '2022-03-03'
 author: Bhavin Patel, Splunk
-type: TTP
 datamodel: []
+date: '2022-03-03'
 description: This search looks for AWS CloudTrail events where a user A who has already
   permission to update login profile, makes an API call to update login profile for
   another user B . Attackers have been know to use this technique for Privilege Escalation
   in case new victim(user B) has more permissions than old victim(user B)
-search: ' `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success 
-  | eval match=if(match(userIdentity.userName,requestParameters.userName), 1,0) 
-  | search match=0 
-  | stats
-  count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName
-  src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName
-  user_arn 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `aws_updateloginprofile_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
+id: 2a9b80d3-6a40-4115-11ad-212bf3d0d111
 known_false_positives: While this search has no known false positives, it is possible
   that an AWS admin has legitimately created keys for another user.
+name: AWS UpdateLoginProfile
 references:
 - https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
 - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
+search: ' `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com
+  errorCode = success | eval match=if(match(userIdentity.userName,requestParameters.userName),
+  1,0) | search match=0 | stats count min(_time) as firstTime max(_time) as lastTime
+  by requestParameters.userName src eventName eventSource aws_account_id errorCode
+  userAgent eventID awsRegion userIdentity.userName user_arn | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `aws_updateloginprofile_filter`'
 tags:
   analytic_story:
   - AWS IAM Privilege Escalation
@@ -51,13 +45,13 @@ tags:
   - DE.CM
   observable:
   - name: src
-    type: IP Address
     role:
     - Attacker
+    type: IP Address
   - name: user_arn
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -65,9 +59,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - errorCode
   - eventName
   - userAgent
-  - errorCode
-  - requestParameters.userName
   risk_score: 30
   security_domain: threat
+type: TTP
+version: 3
diff --git a/detections/cloud/circle_ci_disable_security_job.yml b/detections/cloud/circle_ci_disable_security_job.yml
index 53814e0f32..6834065f97 100644
--- a/detections/cloud/circle_ci_disable_security_job.yml
+++ b/detections/cloud/circle_ci_disable_security_job.yml
@@ -1,11 +1,12 @@
-name: Circle CI Disable Security Job
-id: 4a2fdd41-c578-4cd4-9ef7-980e352517f2
-version: 1
-date: '2021-09-02'
 author: Patrick Bareiss, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-09-02'
 description: This search looks for disable security job in CircleCI pipeline.
+how_to_implement: You must index CircleCI logs.
+id: 4a2fdd41-c578-4cd4-9ef7-980e352517f2
+known_false_positives: unknown
+name: Circle CI Disable Security Job
+references: []
 search: '`circleci` | rename vcs.committer_name as user vcs.subject as commit_message
   vcs.url as url workflows.* as *  | stats values(job_name) as job_names by workflow_id
   workflow_name user commit_message url branch | lookup mandatory_job_for_workflow
@@ -13,9 +14,6 @@ search: '`circleci` | rename vcs.committer_name as user vcs.subject as commit_me
   mandatory_job_executed=if(like(job_names, "%".mandatory_job."%"), 1, 0) | where
   mandatory_job_executed=0 | eval phase="build" | rex field=url "(?<repository>[^\/]*\/[^\/]*)$"
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `circle_ci_disable_security_job_filter`'
-how_to_implement: You must index CircleCI logs.
-known_false_positives: unknown
-references: []
 tags:
   analytic_story:
   - Dev Sec Ops
@@ -39,15 +37,16 @@ tags:
   - DE.CM
   observable:
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   - Dev Sec Ops Analytics
-  required_fields:
-  - _times
+  required_fields: []
   risk_score: 72
   security_domain: network
+type: Anomaly
+version: 1
diff --git a/detections/cloud/circle_ci_disable_security_step.yml b/detections/cloud/circle_ci_disable_security_step.yml
index 38af4b677a..39935b2d0b 100644
--- a/detections/cloud/circle_ci_disable_security_step.yml
+++ b/detections/cloud/circle_ci_disable_security_step.yml
@@ -1,11 +1,12 @@
-name: Circle CI Disable Security Step
-id: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97
-version: 1
-date: '2021-09-01'
 author: Patrick Bareiss, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-09-01'
 description: This search looks for disable security step in CircleCI pipeline.
+how_to_implement: You must index CircleCI logs.
+id: 72cb9de9-e98b-4ac9-80b2-5331bba6ea97
+known_false_positives: unknown
+name: Circle CI Disable Security Step
+references: []
 search: '`circleci` | rename workflows.job_id AS job_id | join job_id [ | search `circleci`
   | stats values(name) as step_names count by job_id job_name ] | stats count by step_names
   job_id job_name vcs.committer_name vcs.subject vcs.url owners{} | rename vcs.* as
@@ -14,9 +15,6 @@ search: '`circleci` | rename workflows.job_id AS job_id | join job_id [ | search
   "%".mandatory_step."%"), 1, 0) | where mandatory_step_executed=0 | rex field=url
   "(?<repository>[^\/]*\/[^\/]*)$" | eval phase="build"  | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `circle_ci_disable_security_step_filter`'
-how_to_implement: You must index CircleCI logs.
-known_false_positives: unknown
-references: []
 tags:
   analytic_story:
   - Dev Sec Ops
@@ -39,15 +37,16 @@ tags:
   - DE.CM
   observable:
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   - Dev Sec Ops Analytics
-  required_fields:
-  - _times
+  required_fields: []
   risk_score: 72
   security_domain: network
+type: Anomaly
+version: 1
diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
index b8ec68216c..584f644be3 100644
--- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
+++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml
@@ -1,12 +1,20 @@
-name: Cloud API Calls From Previously Unseen User Roles
-id: 2181ad1f-1e73-4d0c-9780-e8880482a08f
-version: 1
-date: '2020-09-04'
 author: David Dorsey, Splunk
-type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
+date: '2020-09-04'
 description: This search looks for new commands from each user role.
+how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
+  provider.  You should run the baseline search `Previously Seen Cloud API Calls Per
+  User Role - Initial` to build the initial table of user roles, commands, and times.
+  You must also enable the second baseline search `Previously Seen Cloud API Calls
+  Per User Role - Update` to keep this table up to date and to age out old data. You
+  can adjust the time window for this search by updating the `cloud_api_calls_from_previously_unseen_user_roles_activity_window`
+  macro. You can also provide additional filtering for this search by customizing
+  the `cloud_api_calls_from_previously_unseen_user_roles_filter`
+id: 2181ad1f-1e73-4d0c-9780-e8880482a08f
+known_false_positives: .
+name: Cloud API Calls From Previously Unseen User Roles
+references: []
 search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
   where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user,
   All_Changes.command All_Changes.object | `drop_dm_object_name("All_Changes")` |
@@ -16,16 +24,6 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from d
   OR firstTimeSeenUserApiCall > relative_time(now(),"-24h@h") | table firstTime, user,
   object, command |`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
   `cloud_api_calls_from_previously_unseen_user_roles_filter`'
-how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
-  provider.  You should run the baseline search `Previously Seen Cloud API Calls Per
-  User Role - Initial` to build the initial table of user roles, commands, and times.
-  You must also enable the second baseline search `Previously Seen Cloud API Calls
-  Per User Role - Update` to keep this table up to date and to age out old data. You
-  can adjust the time window for this search by updating the `cloud_api_calls_from_previously_unseen_user_roles_activity_window`
-  macro. You can also provide additional filtering for this search by customizing
-  the `cloud_api_calls_from_previously_unseen_user_roles_filter`
-known_false_positives: .
-references: []
 tags:
   analytic_story:
   - Suspicious Cloud User Activities
@@ -51,22 +49,24 @@ tags:
   - ID.AM
   observable:
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Change.All_Changes.command
+  - Change.All_Changes.object
+  - Change.All_Changes.status
+  - Change.All_Changes.user
+  - Change.All_Changes.user_type
   - _time
-  - All_Changes.user
-  - All_Changes.user_type
-  - All_Changes.status
-  - All_Changes.command
-  - All_Changes.object
   risk_score: 36
   security_domain: threat
   supported_tas:
   - Splunk_TA_aws-kinesis-firehose
+type: Anomaly
+version: 1
diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
index 6caa388503..1572b5f68c 100644
--- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
+++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
@@ -1,13 +1,18 @@
-name: Cloud Compute Instance Created By Previously Unseen User
-id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149
-version: 2
-date: '2021-07-13'
 author: Rico Valdez, Splunk
-type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
+date: '2021-07-13'
 description: This search looks for cloud compute instances created by users who have
   not created them before.
+how_to_implement: You must be ingesting the appropriate cloud-infrastructure logs
+  Run the "Previously Seen Cloud Compute Creations By User" support search to create
+  of baseline of previously seen users.
+id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149
+known_false_positives: It's possible that a user will start to create compute instances
+  for the first time, for any number of reasons. Verify with the user launching instances
+  that this is the intended behavior.
+name: Cloud Compute Instance Created By Previously Unseen User
+references: []
 search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,
   latest(_time) as lastTime values(All_Changes.object) as dest from datamodel=Change.All_Changes
   where All_Changes.action=created by All_Changes.user All_Changes.vendor_region |
@@ -17,13 +22,6 @@ search: '| tstats `security_content_summariesonly` count earliest(_time) as firs
   | where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h")
   | table firstTime, user, dest, count vendor_region | `security_content_ctime(firstTime)`
   | `cloud_compute_instance_created_by_previously_unseen_user_filter`'
-how_to_implement: You must be ingesting the appropriate cloud-infrastructure logs
-  Run the "Previously Seen Cloud Compute Creations By User" support search to create
-  of baseline of previously seen users.
-known_false_positives: It's possible that a user will start to create compute instances
-  for the first time, for any number of reasons. Verify with the user launching instances
-  that this is the intended behavior.
-references: []
 tags:
   analytic_story:
   - Cloud Cryptomining
@@ -49,25 +47,27 @@ tags:
   - ID.AM
   observable:
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Change.All_Changes.action
+  - Change.All_Changes.object
+  - Change.All_Changes.user
+  - Change.All_Changes.vendor_region
   - _time
-  - All_Changes.object
-  - All_Changes.action
-  - All_Changes.user
-  - All_Changes.vendor_region
   risk_score: 18
   security_domain: threat
   supported_tas:
   - Splunk_TA_aws-kinesis-firehose
+type: Anomaly
+version: 2
diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml
index c963597bcb..e7a34e9f79 100644
--- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml
+++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml
@@ -1,22 +1,10 @@
-name: Cloud Compute Instance Created In Previously Unused Region
-id: fa4089e2-50e3-40f7-8469-d2cc1564ca59
-version: 1
-date: '2020-09-02'
 author: David Dorsey, Splunk
-type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
+date: '2020-09-02'
 description: This search looks at cloud-infrastructure events where an instance is
   created in any region within the last hour and then compares it to a lookup file
   of previously seen regions where instances have been created.
-search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id)
-  as dest, count from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.vendor_region,
-  All_Changes.user | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_regions
-  vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data | eventstats
-  max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen)
-  | where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(),
-  "-24h@h") | table firstTime, user, dest, count , vendor_region | `security_content_ctime(firstTime)`
-  | `cloud_compute_instance_created_in_previously_unused_region_filter`'
 how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
   provider. You should run the baseline search `Previously Seen Cloud Regions - Initial`
   to build the initial table of images observed and times. You must also enable the
@@ -24,9 +12,19 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your
   up to date and to age out old data. You can also provide additional filtering for
   this search by customizing the `cloud_compute_instance_created_in_previously_unused_region_filter`
   macro.
+id: fa4089e2-50e3-40f7-8469-d2cc1564ca59
 known_false_positives: It's possible that a user has unknowingly started an instance
   in a new region. Please verify that this activity is legitimate.
+name: Cloud Compute Instance Created In Previously Unused Region
 references: []
+search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id)
+  as dest, count from datamodel=Change.All_Changes where All_Changes.action=created
+  by All_Changes.vendor_region, All_Changes.user | `drop_dm_object_name("All_Changes")`
+  | lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW
+  firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where
+  enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion)
+  OR firstTimeSeenRegion > relative_time(now(), "-24h@h") | table firstTime, user,
+  dest, count , vendor_region | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_in_previously_unused_region_filter`'
 tags:
   analytic_story:
   - Cloud Cryptomining
@@ -54,25 +52,27 @@ tags:
   - DE.AE
   observable:
   - name: user
-    type: user
     role:
     - Attacker
+    type: user
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Change.All_Changes.action
+  - Change.All_Changes.object_id
+  - Change.All_Changes.user
+  - Change.All_Changes.vendor_region
   - _time
-  - All_Changes.object_id
-  - All_Changes.action
-  - All_Changes.vendor_region
-  - All_Changes.user
   risk_score: 42
   security_domain: threat
   supported_tas:
   - Splunk_TA_aws-kinesis-firehose
+type: Anomaly
+version: 1
diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
index 5b4851a0ae..3d0d158cb2 100644
--- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
+++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml
@@ -1,13 +1,21 @@
-name: Cloud Compute Instance Created With Previously Unseen Image
-id: bc24922d-987c-4645-b288-f8c73ec194c4
-version: 1
-date: '2018-10-12'
 author: David Dorsey, Splunk
-type: Anomaly
-datamodel:
-- Change
+datamodel: []
+date: '2018-10-12'
 description: This search looks for cloud compute instances being created with previously
   unseen image IDs.
+how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
+  provider. You should run the baseline search `Previously Seen Cloud Compute Images
+  - Initial` to build the initial table of images observed and times. You must also
+  enable the second baseline search `Previously Seen Cloud Compute Images - Update`
+  to keep this table up to date and to age out old data. You can also provide additional
+  filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_image_filter`
+  macro.
+id: bc24922d-987c-4645-b288-f8c73ec194c4
+known_false_positives: After a new image is created, the first systems created with
+  that image will cause this alert to fire.  Verify that the image being used was
+  created by a legitimate user.
+name: Cloud Compute Instance Created With Previously Unseen Image
+references: []
 search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
   as dest from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id,
   All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
@@ -16,17 +24,6 @@ search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime
   | where enough_data=1 | eval firstTimeSeenImage=min(firstTimeSeen) | where isnull(firstTimeSeenImage)
   OR firstTimeSeenImage > relative_time(now(), "-24h@h") | table firstTime, user,
   image_id, count, dest | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_with_previously_unseen_image_filter`'
-how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
-  provider. You should run the baseline search `Previously Seen Cloud Compute Images
-  - Initial` to build the initial table of images observed and times. You must also
-  enable the second baseline search `Previously Seen Cloud Compute Images - Update`
-  to keep this table up to date and to age out old data. You can also provide additional
-  filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_image_filter`
-  macro.
-known_false_positives: After a new image is created, the first systems created with
-  that image will cause this alert to fire.  Verify that the image being used was
-  created by a legitimate user.
-references: []
 tags:
   analytic_story:
   - Cloud Cryptomining
@@ -49,13 +46,13 @@ tags:
   - ID.AM
   observable:
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -63,11 +60,9 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - All_Changes.object_id
-  - All_Changes.action
-  - All_Changes.Instance_Changes.image_id
-  - All_Changes.user
   risk_score: 36
   security_domain: threat
   supported_tas:
   - Splunk_TA_aws-kinesis-firehose
+type: Anomaly
+version: 1
diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
index 1498019242..0290800b35 100644
--- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
+++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml
@@ -1,12 +1,20 @@
-name: Cloud Compute Instance Created With Previously Unseen Instance Type
-id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda
-version: 1
-date: '2020-09-12'
 author: David Dorsey, Splunk
-type: Anomaly
-datamodel:
-- Change
+datamodel: []
+date: '2020-09-12'
 description: Find EC2 instances being created with previously unseen instance types.
+how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
+  provider. You should run the baseline search `Previously Seen Cloud Compute Instance
+  Types - Initial` to build the initial table of instance types observed and times.
+  You must also enable the second baseline search `Previously Seen Cloud Compute Instance
+  Types - Update` to keep this table up to date and to age out old data. You can also
+  provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`
+  macro.
+id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda
+known_false_positives: It is possible that an admin will create a new system using
+  a new instance type that has never been used before. Verify with the creator that
+  they intended to create the system with the new instance type.
+name: Cloud Compute Instance Created With Previously Unseen Instance Type
+references: []
 search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id)
   as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type,
   All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")`
@@ -16,17 +24,6 @@ search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values
   | where isnull(firstTimeSeenInstanceType) OR firstTimeSeenInstanceType > relative_time(now(),
   "-24h@h") | table firstTime, user, dest, count, instance_type | `security_content_ctime(firstTime)`
   | `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`'
-how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
-  provider. You should run the baseline search `Previously Seen Cloud Compute Instance
-  Types - Initial` to build the initial table of instance types observed and times.
-  You must also enable the second baseline search `Previously Seen Cloud Compute Instance
-  Types - Update` to keep this table up to date and to age out old data. You can also
-  provide additional filtering for this search by customizing the `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`
-  macro.
-known_false_positives: It is possible that an admin will create a new system using
-  a new instance type that has never been used before. Verify with the creator that
-  they intended to create the system with the new instance type.
-references: []
 tags:
   analytic_story:
   - Cloud Cryptomining
@@ -49,13 +46,13 @@ tags:
   - ID.AM
   observable:
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -63,11 +60,9 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - All_Changes.object_id
-  - All_Changes.action
-  - All_Changes.Instance_Changes.instance_type
-  - All_Changes.user
   risk_score: 30
   security_domain: threat
   supported_tas:
   - Splunk_TA_aws-kinesis-firehose
+type: Anomaly
+version: 1
diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
index 5bf2246bf0..978646efaf 100644
--- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
+++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml
@@ -1,13 +1,19 @@
-name: Cloud Instance Modified By Previously Unseen User
-id: 7fb15084-b14e-405a-bd61-a6de15a40722
-version: 1
-date: '2020-07-29'
 author: Rico Valdez, Splunk
-type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
+date: '2020-07-29'
 description: This search looks for cloud instances being modified by users who have
   not previously modified them.
+how_to_implement: This search has a dependency on other searches to create and update
+  a baseline of users observed to be associated with this activity. The search "Previously
+  Seen Cloud Instance Modifications By User - Update" should be enabled for this detection
+  to properly work.
+id: 7fb15084-b14e-405a-bd61-a6de15a40722
+known_false_positives: It's possible that a new user will start to modify EC2 instances
+  when they haven't before for any number of reasons. Verify with the user that is
+  modifying instances that this is the intended behavior.
+name: Cloud Instance Modified By Previously Unseen User
+references: []
 search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime,
   latest(_time) as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command)
   as command from datamodel=Change.All_Changes where All_Changes.action=modified All_Changes.change_type=EC2
@@ -17,14 +23,6 @@ search: '| tstats `security_content_summariesonly` count earliest(_time) as firs
   enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) | where isnull(firstTimeSeenUser)
   OR firstTimeSeenUser > relative_time(now(), "-24h@h") | table firstTime user command
   object_id count | `security_content_ctime(firstTime)` | `cloud_instance_modified_by_previously_unseen_user_filter`'
-how_to_implement: This search has a dependency on other searches to create and update
-  a baseline of users observed to be associated with this activity. The search "Previously
-  Seen Cloud Instance Modifications By User - Update" should be enabled for this detection
-  to properly work.
-known_false_positives: It's possible that a new user will start to modify EC2 instances
-  when they haven't before for any number of reasons. Verify with the user that is
-  modifying instances that this is the intended behavior.
-references: []
 tags:
   analytic_story:
   - Suspicious Cloud Instance Activities
@@ -49,27 +47,29 @@ tags:
   - ID.AM
   observable:
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Change.All_Changes.action
+  - Change.All_Changes.change_type
+  - Change.All_Changes.command
+  - Change.All_Changes.object_id
+  - Change.All_Changes.status
+  - Change.All_Changes.user
   - _time
-  - All_Changes.object_id
-  - All_Changes.command
-  - All_Changes.action
-  - All_Changes.change_type
-  - All_Changes.status
-  - All_Changes.user
   risk_score: 42
   security_domain: threat
   supported_tas:
   - Splunk_TA_aws-kinesis-firehose
+type: Anomaly
+version: 1
diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml
index 0cf7d9894d..6139a83ddf 100644
--- a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml
+++ b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml
@@ -1,24 +1,10 @@
-name: Cloud Provisioning Activity From Previously Unseen City
-id: e7ecc5e0-88df-48b9-91af-51104c68f02f
-version: 1
-date: '2020-10-09'
 author: Rico Valdez, Bhavin Patel, Splunk
-type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
+date: '2020-10-09'
 description: This search looks for cloud provisioning activities from previously unseen
   cities. Provisioning activities are defined broadly as any event that runs or creates
   something.
-search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
-  where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
-  by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
-  `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(City) |
-  lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen,
-  enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 |
-  eval firstTimeSeenCity=min(firstTimeSeen) | where isnull(firstTimeSeenCity) OR firstTimeSeenCity
-  > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) |
-  table firstTime, src, City, user, object, command | `cloud_provisioning_activity_from_previously_unseen_city_filter`
-  | `security_content_ctime(firstTime)`'
 how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
   provider.  You should run the baseline search `Previously Seen Cloud Provisioning
   Activity Sources - Initial` to build the initial table of source IP address, geographic
@@ -28,6 +14,7 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your
   the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide
   additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_city_filter`
   macro.
+id: e7ecc5e0-88df-48b9-91af-51104c68f02f
 known_false_positives: "This is a strictly behavioral search, so we define \"false\
   \ positive\" slightly differently. Every time this fires, it will accurately reflect\
   \ the first occurrence in the time period you're searching within, plus what is\
@@ -39,7 +26,18 @@ known_false_positives: "This is a strictly behavioral search, so we define \"fal
   \ where the free version of **MaxMind GeoIP** that ships by default with Splunk\
   \ has weak resolution (particularly small countries in less economically powerful\
   \ regions), this may be much less valuable to you."
+name: Cloud Provisioning Activity From Previously Unseen City
 references: []
+search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
+  where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
+  by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
+  `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(City) |
+  lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen,
+  enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 |
+  eval firstTimeSeenCity=min(firstTimeSeen) | where isnull(firstTimeSeenCity) OR firstTimeSeenCity
+  > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) |
+  table firstTime, src, City, user, object, command | `cloud_provisioning_activity_from_previously_unseen_city_filter`
+  | `security_content_ctime(firstTime)`'
 tags:
   analytic_story:
   - Suspicious Cloud Provisioning Activities
@@ -64,31 +62,33 @@ tags:
   - ID.AM
   observable:
   - name: user
+    role:
+    - Attacker
     type: User
-    role:
-    - Attacker
   - name: src
-    type: IP Address
     role:
     - Attacker
+    type: IP Address
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Change.All_Changes.action
+  - Change.All_Changes.command
+  - Change.All_Changes.object
+  - Change.All_Changes.src
+  - Change.All_Changes.status
+  - Change.All_Changes.user
   - _time
-  - All_Changes.action
-  - All_Changes.status
-  - All_Changes.src
-  - All_Changes.user
-  - All_Changes.object
-  - All_Changes.command
   risk_score: 18
   security_domain: threat
   supported_tas:
   - Splunk_TA_aws-kinesis-firehose
+type: Anomaly
+version: 1
diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml
index dbb77c2335..c739ae2d38 100644
--- a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml
+++ b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml
@@ -1,24 +1,10 @@
-name: Cloud Provisioning Activity From Previously Unseen Country
-id: 94994255-3acf-4213-9b3f-0494df03bb31
-version: 1
-date: '2020-10-09'
 author: Rico Valdez, Bhavin Patel, Splunk
-type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
+date: '2020-10-09'
 description: This search looks for cloud provisioning activities from previously unseen
   countries. Provisioning activities are defined broadly as any event that runs or
   creates something.
-search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
-  where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
-  by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
-  `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country)
-  | lookup previously_seen_cloud_provisioning_activity_sources Country as Country
-  OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data |
-  where enough_data=1 | eval firstTimeSeenCountry=min(firstTimeSeen) | where isnull(firstTimeSeenCountry)
-  OR firstTimeSeenCountry > relative_time(now(), "-24h@h") | table firstTime, src,
-  Country, user, object, command | `cloud_provisioning_activity_from_previously_unseen_country_filter`
-  | `security_content_ctime(firstTime)`'
 how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
   provider.  You should run the baseline search `Previously Seen Cloud Provisioning
   Activity Sources - Initial` to build the initial table of source IP address, geographic
@@ -28,6 +14,7 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your
   the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide
   additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_country_filter`
   macro.
+id: 94994255-3acf-4213-9b3f-0494df03bb31
 known_false_positives: "This is a strictly behavioral search, so we define \"false\
   \ positive\" slightly differently. Every time this fires, it will accurately reflect\
   \ the first occurrence in the time period you're searching within, plus what is\
@@ -39,7 +26,18 @@ known_false_positives: "This is a strictly behavioral search, so we define \"fal
   \ where the free version of **MaxMind GeoIP** that ships by default with Splunk\
   \ has weak resolution (particularly small countries in less economically powerful\
   \ regions), this may be much less valuable to you."
+name: Cloud Provisioning Activity From Previously Unseen Country
 references: []
+search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
+  where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
+  by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
+  `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country)
+  | lookup previously_seen_cloud_provisioning_activity_sources Country as Country
+  OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data |
+  where enough_data=1 | eval firstTimeSeenCountry=min(firstTimeSeen) | where isnull(firstTimeSeenCountry)
+  OR firstTimeSeenCountry > relative_time(now(), "-24h@h") | table firstTime, src,
+  Country, user, object, command | `cloud_provisioning_activity_from_previously_unseen_country_filter`
+  | `security_content_ctime(firstTime)`'
 tags:
   analytic_story:
   - Suspicious Cloud Provisioning Activities
@@ -64,31 +62,33 @@ tags:
   - ID.AM
   observable:
   - name: user
+    role:
+    - Attacker
     type: User
-    role:
-    - Attacker
   - name: src
-    type: IP Address
     role:
     - Attacker
+    type: IP Address
   - name: object
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Change.All_Changes.action
+  - Change.All_Changes.command
+  - Change.All_Changes.object
+  - Change.All_Changes.src
+  - Change.All_Changes.status
+  - Change.All_Changes.user
   - _time
-  - All_Changes.action
-  - All_Changes.status
-  - All_Changes.src
-  - All_Changes.user
-  - All_Changes.object
-  - All_Changes.command
   risk_score: 42
   security_domain: threat
   supported_tas:
   - Splunk_TA_aws-kinesis-firehose
+type: Anomaly
+version: 1
diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml
index 5c86c14cb0..ac6ebfe27b 100644
--- a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml
+++ b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml
@@ -1,23 +1,10 @@
-name: Cloud Provisioning Activity From Previously Unseen IP Address
-id: f86a8ec9-b042-45eb-92f4-e9ed1d781078
-version: 1
-date: '2020-08-16'
 author: Rico Valdez, Splunk
-type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
+date: '2020-08-16'
 description: This search looks for cloud provisioning activities from previously unseen
   IP addresses. Provisioning activities are defined broadly as any event that runs
   or creates something.
-search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id)
-  as object_id from datamodel=Change.All_Changes where (All_Changes.action=started OR All_Changes.action=created)
-  All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.command
-  | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources
-  src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data
-  | where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) | where isnull(firstTimeSeenSrc)
-  OR firstTimeSeenSrc > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`)
-  | table firstTime, src, user, object_id, command | `cloud_provisioning_activity_from_previously_unseen_ip_address_filter`
-  | `security_content_ctime(firstTime)`'
 how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
   provider.  You should run the baseline search `Previously Seen Cloud Provisioning
   Activity Sources - Initial` to build the initial table of source IP address, geographic
@@ -27,6 +14,7 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your
   the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide
   additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_ip_address_filter`
   macro.
+id: f86a8ec9-b042-45eb-92f4-e9ed1d781078
 known_false_positives: "This is a strictly behavioral search, so we define \"false\
   \ positive\" slightly differently. Every time this fires, it will accurately reflect\
   \ the first occurrence in the time period you're searching within, plus what is\
@@ -38,7 +26,17 @@ known_false_positives: "This is a strictly behavioral search, so we define \"fal
   \ where the free version of **MaxMind GeoIP** that ships by default with Splunk\
   \ has weak resolution (particularly small countries in less economically powerful\
   \ regions), this may be much less valuable to you."
+name: Cloud Provisioning Activity From Previously Unseen IP Address
 references: []
+search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id)
+  as object_id from datamodel=Change.All_Changes where (All_Changes.action=started
+  OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user,
+  All_Changes.command | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources
+  src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data
+  | where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) | where isnull(firstTimeSeenSrc)
+  OR firstTimeSeenSrc > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`)
+  | table firstTime, src, user, object_id, command | `cloud_provisioning_activity_from_previously_unseen_ip_address_filter`
+  | `security_content_ctime(firstTime)`'
 tags:
   analytic_story:
   - Suspicious Cloud Provisioning Activities
@@ -63,31 +61,33 @@ tags:
   - ID.AM
   observable:
   - name: user
+    role:
+    - Attacker
     type: User
-    role:
-    - Attacker
   - name: src
-    type: IP Address
     role:
     - Attacker
+    type: IP Address
   - name: object_id
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Change.All_Changes.action
+  - Change.All_Changes.command
+  - Change.All_Changes.object_id
+  - Change.All_Changes.src
+  - Change.All_Changes.status
+  - Change.All_Changes.user
   - _time
-  - All_Changes.object_id
-  - All_Changes.action
-  - All_Changes.status
-  - All_Changes.src
-  - All_Changes.user
-  - All_Changes.command
   risk_score: 42
   security_domain: threat
   supported_tas:
   - Splunk_TA_aws-kinesis-firehose
+type: Anomaly
+version: 1
diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml
index 48456c0769..175e8747fb 100644
--- a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml
+++ b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml
@@ -1,24 +1,10 @@
-name: Cloud Provisioning Activity From Previously Unseen Region
-id: 5aba1860-9617-4af9-b19d-aecac16fe4f2
-version: 1
-date: '2020-08-16'
 author: Rico Valdez, Bhavin Patel, Splunk
-type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
+date: '2020-08-16'
 description: This search looks for cloud provisioning activities from previously unseen
   regions. Provisioning activities are defined broadly as any event that runs or creates
   something.
-search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
-  where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
-  by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
-  `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Region)
-  | lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT
-  firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where
-  enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion)
-  OR firstTimeSeenRegion > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`)
-  | table firstTime, src, Region, user, object, command | `cloud_provisioning_activity_from_previously_unseen_region_filter`
-  | `security_content_ctime(firstTime)`'
 how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud
   provider.  You should run the baseline search `Previously Seen Cloud Provisioning
   Activity Sources - Initial` to build the initial table of source IP address, geographic
@@ -28,6 +14,7 @@ how_to_implement: You must be ingesting your cloud infrastructure logs from your
   the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide
   additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_region_filter`
   macro.
+id: 5aba1860-9617-4af9-b19d-aecac16fe4f2
 known_false_positives: "This is a strictly behavioral search, so we define \"false\
   \ positive\" slightly differently. Every time this fires, it will accurately reflect\
   \ the first occurrence in the time period you're searching within, plus what is\
@@ -39,7 +26,18 @@ known_false_positives: "This is a strictly behavioral search, so we define \"fal
   \ where the free version of **MaxMind GeoIP** that ships by default with Splunk\
   \ has weak resolution (particularly small countries in less economically powerful\
   \ regions), this may be much less valuable to you."
+name: Cloud Provisioning Activity From Previously Unseen Region
 references: []
+search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes
+  where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success
+  by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command |
+  `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Region)
+  | lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT
+  firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where
+  enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion)
+  OR firstTimeSeenRegion > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`)
+  | table firstTime, src, Region, user, object, command | `cloud_provisioning_activity_from_previously_unseen_region_filter`
+  | `security_content_ctime(firstTime)`'
 tags:
   analytic_story:
   - Suspicious Cloud Provisioning Activities
@@ -64,31 +62,33 @@ tags:
   - ID.AM
   observable:
   - name: user
+    role:
+    - Attacker
     type: User
-    role:
-    - Attacker
   - name: src
-    type: IP Address
     role:
     - Attacker
+    type: IP Address
   - name: object
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Change.All_Changes.action
+  - Change.All_Changes.command
+  - Change.All_Changes.object
+  - Change.All_Changes.src
+  - Change.All_Changes.status
+  - Change.All_Changes.user
   - _time
-  - All_Changes.action
-  - All_Changes.status
-  - All_Changes.src
-  - All_Changes.user
-  - All_Changes.object
-  - All_Changes.command
   risk_score: 42
   security_domain: threat
   supported_tas:
   - Splunk_TA_aws-kinesis-firehose
+type: Anomaly
+version: 1
diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml
index b3f286b339..04cf8f8a03 100644
--- a/detections/cloud/detect_aws_console_login_by_new_user.yml
+++ b/detections/cloud/detect_aws_console_login_by_new_user.yml
@@ -1,23 +1,12 @@
-name: Detect AWS Console Login by New User
-id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
-version: 1
-date: '2020-05-28'
 author: Rico Valdez, Splunk
-type: Hunting
 datamodel:
-- Authentication
+- Authentication.Authentication
+date: '2020-05-28'
 description: This search looks for AWS CloudTrail events wherein a console login event
   by a user was recorded within the last hour, then compares the event to a lookup
   file of previously seen users (by ARN values) who have logged into the console.
   The alert is fired if the user has logged into the console for the first time within
   the last hour
-search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
-  where Authentication.signature=ConsoleLogin by Authentication.user | `drop_dm_object_name(Authentication)`
-  | join user type=outer [ inputlookup previously_seen_users_console_logins | stats
-  min(firstTime) as earliestseen by user] | eval userStatus=if(earliestseen >= relative_time(now(),
-  "-24h@h") OR isnull(earliestseen), "First Time Logging into AWS Console", "Previously
-  Seen User") | where userStatus="First Time Logging into AWS Console" | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `detect_aws_console_login_by_new_user_filter`'
 how_to_implement: You must install and configure the Splunk Add-on for AWS (version
   5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
   to the Authentication data model for cloud use cases. Run the `Previously Seen Users
@@ -25,10 +14,19 @@ how_to_implement: You must install and configure the Splunk Add-on for AWS (vers
   seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
   - Update` hourly (or more frequently depending on how often you run the detection
   searches) to refresh the baselines.
+id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
 known_false_positives: When a legitimate new user logins for the first time, this
   activity will be detected. Check how old the account is and verify that the user
   activity is legitimate.
+name: Detect AWS Console Login by New User
 references: []
+search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
+  where Authentication.signature=ConsoleLogin by Authentication.user | `drop_dm_object_name(Authentication)`
+  | join user type=outer [ inputlookup previously_seen_users_console_logins | stats
+  min(firstTime) as earliestseen by user] | eval userStatus=if(earliestseen >= relative_time(now(),
+  "-24h@h") OR isnull(earliestseen), "First Time Logging into AWS Console", "Previously
+  Seen User") | where userStatus="First Time Logging into AWS Console" | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_aws_console_login_by_new_user_filter`'
 tags:
   analytic_story:
   - Suspicious Cloud Authentication Activities
@@ -53,17 +51,19 @@ tags:
   - DE.AE
   observable:
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Authentication.Authentication.signature
+  - Authentication.Authentication.user
   - _time
-  - Authentication.signature
-  - Authentication.user
   risk_score: 30
   security_domain: threat
+type: Hunting
+version: 1
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
index e1604415d7..f35f690fbe 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
@@ -1,16 +1,27 @@
-name: Detect AWS Console Login by User from New City
-id: 121b0b11-f8ac-4ed6-a132-3800ca4fc07a
-version: 1
-date: '2020-10-07'
 author: Bhavin Patel, Splunk
-type: Hunting
 datamodel:
-- Authentication
+- Authentication.Authentication
+date: '2020-10-07'
 description: This search looks for AWS CloudTrail events wherein a console login event
   by a user was recorded within the last hour, then compares the event to a lookup
   file of previously seen users (by ARN values) who have logged into the console.
   The alert is fired if the user has logged into the console for the first time within
   the last hour
+how_to_implement: You must install and configure the Splunk Add-on for AWS (version
+  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
+  to the Authentication data model for cloud use cases. Run the `Previously Seen Users
+  in AWS CloudTrail - Initial` support search only once to create a baseline of previously
+  seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
+  - Update` hourly (or more frequently depending on how often you run the detection
+  searches) to refresh the baselines. You can also provide additional filtering for
+  this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter`
+  macro.
+id: 121b0b11-f8ac-4ed6-a132-3800ca4fc07a
+known_false_positives: When a legitimate new user logins for the first time, this
+  activity will be detected. Check how old the account is and verify that the user
+  activity is legitimate.
+name: Detect AWS Console Login by User from New City
+references: []
 search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
   where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
   | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
@@ -21,19 +32,6 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
   OR isnull(earliestseen), "New User","Old User") | where userCity = "New City" AND
   userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | table firstTime lastTime user City  userStatus userCity  | `detect_aws_console_login_by_user_from_new_city_filter`'
-how_to_implement: You must install and configure the Splunk Add-on for AWS (version
-  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
-  to the Authentication data model for cloud use cases. Run the `Previously Seen Users
-  in AWS CloudTrail - Initial` support search only once to create a baseline of previously
-  seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
-  - Update` hourly (or more frequently depending on how often you run the detection
-  searches) to refresh the baselines. You can also provide additional filtering for
-  this search by customizing the `detect_aws_console_login_by_user_from_new_city_filter`
-  macro.
-known_false_positives: When a legitimate new user logins for the first time, this
-  activity will be detected. Check how old the account is and verify that the user
-  activity is legitimate.
-references: []
 tags:
   analytic_story:
   - Suspicious AWS Login Activities
@@ -62,18 +60,20 @@ tags:
   - DE.AE
   observable:
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Authentication.Authentication.signature
+  - Authentication.Authentication.src
+  - Authentication.Authentication.user
   - _time
-  - Authentication.signature
-  - Authentication.user
-  - Authentication.src
   risk_score: 18
   security_domain: threat
+type: Hunting
+version: 1
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
index f017005eef..daaf83194a 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
@@ -1,16 +1,27 @@
-name: Detect AWS Console Login by User from New Country
-id: 67bd3def-c41c-4bf6-837b-ae196b4257c6
-version: 1
-date: '2020-10-07'
 author: Bhavin Patel, Splunk
-type: Hunting
 datamodel:
-- Authentication
+- Authentication.Authentication
+date: '2020-10-07'
 description: This search looks for AWS CloudTrail events wherein a console login event
   by a user was recorded within the last hour, then compares the event to a lookup
   file of previously seen users (by ARN values) who have logged into the console.
   The alert is fired if the user has logged into the console for the first time within
   the last hour
+how_to_implement: You must install and configure the Splunk Add-on for AWS (version
+  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
+  to the Authentication data model for cloud use cases. Run the `Previously Seen Users
+  in AWS CloudTrail - Initial` support search only once to create a baseline of previously
+  seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
+  - Update` hourly (or more frequently depending on how often you run the detection
+  searches) to refresh the baselines. You can also provide additional filtering for
+  this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter`
+  macro.
+id: 67bd3def-c41c-4bf6-837b-ae196b4257c6
+known_false_positives: When a legitimate new user logins for the first time, this
+  activity will be detected. Check how old the account is and verify that the user
+  activity is legitimate.
+name: Detect AWS Console Login by User from New Country
+references: []
 search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
   where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
   | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
@@ -21,19 +32,6 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
   OR isnull(earliestseen), "New User","Old User") | where userCountry = "New Country"
   AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | table firstTime lastTime user Country  userStatus userCountry  | `detect_aws_console_login_by_user_from_new_country_filter`'
-how_to_implement: You must install and configure the Splunk Add-on for AWS (version
-  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
-  to the Authentication data model for cloud use cases. Run the `Previously Seen Users
-  in AWS CloudTrail - Initial` support search only once to create a baseline of previously
-  seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
-  - Update` hourly (or more frequently depending on how often you run the detection
-  searches) to refresh the baselines. You can also provide additional filtering for
-  this search by customizing the `detect_aws_console_login_by_user_from_new_country_filter`
-  macro.
-known_false_positives: When a legitimate new user logins for the first time, this
-  activity will be detected. Check how old the account is and verify that the user
-  activity is legitimate.
-references: []
 tags:
   analytic_story:
   - Suspicious AWS Login Activities
@@ -62,18 +60,20 @@ tags:
   - DE.AE
   observable:
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Authentication.Authentication.signature
+  - Authentication.Authentication.src
+  - Authentication.Authentication.user
   - _time
-  - Authentication.signature
-  - Authentication.user
-  - Authentication.src
   risk_score: 42
   security_domain: threat
+type: Hunting
+version: 1
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
index ef02104408..65f75ba3aa 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
@@ -1,16 +1,27 @@
-name: Detect AWS Console Login by User from New Region
-id: 9f31aa8e-e37c-46bc-bce1-8b3be646d026
-version: 1
-date: '2020-10-07'
 author: Bhavin Patel, Splunk
-type: Hunting
 datamodel:
-- Authentication
+- Authentication.Authentication
+date: '2020-10-07'
 description: This search looks for AWS CloudTrail events wherein a console login event
   by a user was recorded within the last hour, then compares the event to a lookup
   file of previously seen users (by ARN values) who have logged into the console.
   The alert is fired if the user has logged into the console for the first time within
   the last hour
+how_to_implement: You must install and configure the Splunk Add-on for AWS (version
+  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
+  to the Authentication data model for cloud use cases. Run the `Previously Seen Users
+  in AWS CloudTrail - Initial` support search only once to create a baseline of previously
+  seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
+  - Update` hourly (or more frequently depending on how often you run the detection
+  searches) to refresh the baselines. You can also provide additional filtering for
+  this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter`
+  macro.
+id: 9f31aa8e-e37c-46bc-bce1-8b3be646d026
+known_false_positives: When a legitimate new user logins for the first time, this
+  activity will be detected. Check how old the account is and verify that the user
+  activity is legitimate.
+name: Detect AWS Console Login by User from New Region
+references: []
 search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication.Authentication
   where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src
   | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table
@@ -21,19 +32,6 @@ search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from da
   OR isnull(earliestseen), "New User","Old User") | where userRegion = "New Region"
   AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | table firstTime lastTime user Region  userStatus userRegion  | `detect_aws_console_login_by_user_from_new_region_filter`'
-how_to_implement: You must install and configure the Splunk Add-on for AWS (version
-  5.1.0 or later) and Enterprise Security 6.2, which contains the required updates
-  to the Authentication data model for cloud use cases. Run the `Previously Seen Users
-  in AWS CloudTrail - Initial` support search only once to create a baseline of previously
-  seen IAM users within the last 30 days. Run `Previously Seen Users in AWS CloudTrail
-  - Update` hourly (or more frequently depending on how often you run the detection
-  searches) to refresh the baselines. You can also provide additional filtering for
-  this search by customizing the `detect_aws_console_login_by_user_from_new_region_filter`
-  macro.
-known_false_positives: When a legitimate new user logins for the first time, this
-  activity will be detected. Check how old the account is and verify that the user
-  activity is legitimate.
-references: []
 tags:
   analytic_story:
   - Suspicious AWS Login Activities
@@ -62,18 +60,20 @@ tags:
   - DE.AE
   observable:
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Authentication.Authentication.signature
+  - Authentication.Authentication.src
+  - Authentication.Authentication.user
   - _time
-  - Authentication.signature
-  - Authentication.user
-  - Authentication.src
   risk_score: 36
   security_domain: threat
+type: Hunting
+version: 1
diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml
index 2cf1e5d425..aaf848bbde 100644
--- a/detections/cloud/detect_new_open_s3_buckets.yml
+++ b/detections/cloud/detect_new_open_s3_buckets.yml
@@ -1,12 +1,16 @@
-name: Detect New Open S3 buckets
-id: 2a9b80d3-6340-4345-b5ad-290bf3d0dac4
-version: 3
-date: '2021-07-19'
 author: Bhavin Patel, Patrick Bareiss, Splunk
-type: TTP
 datamodel: []
+date: '2021-07-19'
 description: This search looks for AWS CloudTrail events where a user has created
   an open/public S3 bucket.
+how_to_implement: You must install the AWS App for Splunk.
+id: 2a9b80d3-6340-4345-b5ad-290bf3d0dac4
+known_false_positives: While this search has no known false positives, it is possible
+  that an AWS admin has legitimately created a public bucket for a specific purpose.
+  That said, AWS strongly advises against granting full control to the "All Users"
+  group.
+name: Detect New Open S3 buckets
+references: []
 search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw
   "(?<json_field>{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{}
   | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI
@@ -16,12 +20,6 @@ search: '`cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex
   max(_time) as lastTime by user_arn userIdentity.principalId userAgent uri permission
   bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `detect_new_open_s3_buckets_filter` '
-how_to_implement: You must install the AWS App for Splunk.
-known_false_positives: While this search has no known false positives, it is possible
-  that an AWS admin has legitimately created a public bucket for a specific purpose.
-  That said, AWS strongly advises against granting full control to the "All Users"
-  group.
-references: []
 tags:
   analytic_story:
   - Suspicious AWS S3 Activities
@@ -50,13 +48,13 @@ tags:
   - DE.CM
   observable:
   - name: user_arn
-    type: User
     role:
     - Attacker
+    type: User
   - name: bucketName
-    type: Other
     role:
     - Victim
+    type: Other
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -64,13 +62,13 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - eventSource
   - eventName
-  - requestParameters.bucketName
-  - user_arn
-  - userIdentity.principalId
-  - userAgent
-  - uri
+  - eventSource
   - permission
+  - uri
+  - userAgent
+  - user_arn
   risk_score: 48
   security_domain: threat
+type: TTP
+version: 3
diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
index 95fec6af8a..5dc6ba9855 100644
--- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
+++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml
@@ -1,12 +1,16 @@
-name: Detect New Open S3 Buckets over AWS CLI
-id: 39c61d09-8b30-4154-922b-2d0a694ecc22
-version: 2
-date: '2021-07-19'
 author: Patrick Bareiss, Splunk
-type: TTP
 datamodel: []
+date: '2021-07-19'
 description: This search looks for AWS CloudTrail events where a user has created
   an open/public S3 bucket over the aws cli.
+how_to_implement: ''
+id: 39c61d09-8b30-4154-922b-2d0a694ecc22
+known_false_positives: While this search has no known false positives, it is possible
+  that an AWS admin has legitimately created a public bucket for a specific purpose.
+  That said, AWS strongly advises against granting full control to the "All Users"
+  group.
+name: Detect New Open S3 Buckets over AWS CLI
+references: []
 search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli*
   ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp
   IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write
@@ -18,12 +22,6 @@ search: '`cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR u
   requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write
   requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` '
-how_to_implement: ''
-known_false_positives: While this search has no known false positives, it is possible
-  that an AWS admin has legitimately created a public bucket for a specific purpose.
-  That said, AWS strongly advises against granting full control to the "All Users"
-  group.
-references: []
 tags:
   analytic_story:
   - Suspicious AWS S3 Activities
@@ -54,13 +52,13 @@ tags:
   - DE.CM
   observable:
   - name: userIdentity.userName
-    type: User
     role:
     - Attacker
+    type: User
   - name: bucketName
-    type: Other
     role:
     - Victim
+    type: Other
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -68,16 +66,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - eventSource
-  - eventName
-  - requestParameters.accessControlList.x-amz-grant-read-acp
-  - requestParameters.accessControlList.x-amz-grant-write
-  - requestParameters.accessControlList.x-amz-grant-write-acp
-  - requestParameters.accessControlList.x-amz-grant-full-control
-  - requestParameters.bucketName
-  - userIdentity.userName
-  - userIdentity.principalId
-  - userAgent
   - bucketName
+  - eventName
+  - eventSource
+  - userAgent
   risk_score: 48
   security_domain: threat
+type: TTP
+version: 2
diff --git a/detections/cloud/detect_shared_ec2_snapshot.yml b/detections/cloud/detect_shared_ec2_snapshot.yml
index e297f4c0d5..326095953b 100644
--- a/detections/cloud/detect_shared_ec2_snapshot.yml
+++ b/detections/cloud/detect_shared_ec2_snapshot.yml
@@ -1,23 +1,21 @@
-name: Detect shared ec2 snapshot
-id: 2a9b80d3-6340-4345-b5ad-290bf3d222c4
-version: 2
-date: '2021-07-20'
 author: Bhavin Patel, Splunk
-type: TTP
 datamodel: []
+date: '2021-07-20'
 description: The following analytic utilizes AWS CloudTrail events to identify when
   an EC2 snapshot permissions are modified to be shared with a different AWS account.
   This method is used by adversaries to exfiltrate the EC2 snapshot.
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+id: 2a9b80d3-6340-4345-b5ad-290bf3d222c4
+known_false_positives: It is possible that an AWS admin has legitimately shared a
+  snapshot with others for  a specific purpose.
+name: Detect shared ec2 snapshot
+references:
+- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
 search: '`cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId
   as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No
   Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id
   aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter` '
-how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
-  search works with AWS CloudTrail logs.
-known_false_positives: It is possible that an AWS admin has legitimately shared a
-  snapshot with others for  a specific purpose.
-references:
-- https://labs.nettitude.com/blog/how-to-exfiltrate-aws-ec2-data/
 tags:
   analytic_story:
   - Suspicious Cloud Instance Activities
@@ -48,13 +46,13 @@ tags:
   - DE.CM
   observable:
   - name: user_arn
+    role:
+    - Attacker
     type: User
-    role:
-    - Attacker
   - name: src_ip
-    type: IP Address
     role:
     - Attacker
+    type: IP Address
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -62,12 +60,13 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - eventName
-  - user_arn
-  - src_ip
-  - requestParameters.attributeType
   - aws_account_id
-  - vendor_region
+  - eventName
+  - src_ip
   - user_agent
+  - user_arn
+  - vendor_region
   risk_score: 48
   security_domain: threat
+type: TTP
+version: 2
diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
index db578d529d..825e339f96 100644
--- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
+++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
@@ -1,12 +1,16 @@
-name: Detect Spike in AWS Security Hub Alerts for EC2 Instance
-id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222
-version: 3
-date: '2021-01-26'
 author: Bhavin Patel, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-01-26'
 description: This search looks for a spike in number of of AWS security Hub alerts
   for an EC2 instance in 4 hours intervals
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security
+  Hub inputs. The threshold_value should be tuned to your environment and schedule
+  these searches according to the bucket span interval.
+id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222
+known_false_positives: None
+name: Detect Spike in AWS Security Hub Alerts for EC2 Instance
+references: []
 search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h
   _time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account)
   as vendor_account values(vendor_region) as vendor_region values(severity) as severity
@@ -14,12 +18,6 @@ search: '`aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket sp
   | eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev
   * threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types
   vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`'
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
-  and Splunk Add-on for AWS (version 4.4.0 or later), then configure your Security
-  Hub inputs. The threshold_value should be tuned to your environment and schedule
-  these searches according to the bucket span interval.
-known_false_positives: None
-references: []
 tags:
   analytic_story:
   - AWS Security Hub Alerts
@@ -39,22 +37,23 @@ tags:
   - DE.DP
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - Resources{}.Type
   - Title
   - Types{}
+  - _time
+  - dest
+  - severity
   - vendor_account
   - vendor_region
-  - severity
-  - dest
   risk_score: 15
   security_domain: endpoint
+type: Anomaly
+version: 3
diff --git a/detections/cloud/github_dependabot_alert.yml b/detections/cloud/github_dependabot_alert.yml
index 0ac8b391b0..0ba893e275 100644
--- a/detections/cloud/github_dependabot_alert.yml
+++ b/detections/cloud/github_dependabot_alert.yml
@@ -1,22 +1,20 @@
-name: GitHub Dependabot Alert
-id: 05032b04-4469-4034-9df7-05f607d75cba
-version: 1
-date: '2021-09-01'
 author: Patrick Bareiss, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-09-01'
 description: This search looks for Dependabot Alerts in Github logs.
+how_to_implement: You must index GitHub logs. You can follow the url in reference
+  to onboard GitHub logs.
+id: 05032b04-4469-4034-9df7-05f607d75cba
+known_false_positives: unknown
+name: GitHub Dependabot Alert
+references:
+- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
 search: '`github` alert.id=* action=create | rename repository.full_name as repository,
   repository.html_url as repository_url sender.login as user | stats min(_time) as
   firstTime max(_time) as lastTime by action alert.affected_package_name alert.affected_range
   alert.created_at alert.external_identifier alert.external_reference alert.fixed_in
   alert.severity repository repository_url user | eval phase="code" | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `github_dependabot_alert_filter`'
-how_to_implement: You must index GitHub logs. You can follow the url in reference
-  to onboard GitHub logs.
-known_false_positives: unknown
-references:
-- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
 tags:
   analytic_story:
   - Dev Sec Ops
@@ -40,9 +38,9 @@ tags:
   - DE.CM
   observable:
   - name: repository
-    type: System
     role:
     - Victim
+    type: System
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -50,16 +48,8 @@ tags:
   - Dev Sec Ops Analytics
   required_fields:
   - _time
-  - alert.id
-  - repository.full_name
-  - repository.html_url
   - action
-  - alert.affected_package_name
-  - alert.affected_range
-  - alert.created_at
-  - alert.external_identifier
-  - alert.external_reference
-  - alert.fixed_in
-  - alert.severity
   risk_score: 27
   security_domain: network
+type: Anomaly
+version: 1
diff --git a/detections/cloud/github_pull_request_from_unknown_user.yml b/detections/cloud/github_pull_request_from_unknown_user.yml
index 82025ef1a6..2ef298e96d 100644
--- a/detections/cloud/github_pull_request_from_unknown_user.yml
+++ b/detections/cloud/github_pull_request_from_unknown_user.yml
@@ -1,22 +1,20 @@
-name: GitHub Pull Request from Unknown User
-id: 9d7b9100-8878-4404-914e-ca5e551a641e
-version: 1
-date: '2021-09-01'
 author: Patrick Bareiss, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-09-01'
 description: This search looks for Pull Request from unknown user.
+how_to_implement: You must index GitHub logs. You can follow the url in reference
+  to onboard GitHub logs.
+id: 9d7b9100-8878-4404-914e-ca5e551a641e
+known_false_positives: unknown
+name: GitHub Pull Request from Unknown User
+references:
+- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
 search: '`github` check_suite.pull_requests{}.id=* | stats count by check_suite.head_commit.author.name
   repository.full_name check_suite.pull_requests{}.head.ref check_suite.head_commit.message
   | rename check_suite.head_commit.author.name as user repository.full_name as repository
   check_suite.pull_requests{}.head.ref as ref_head check_suite.head_commit.message
   as commit_message | search NOT `github_known_users` | eval phase="code" | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `github_pull_request_from_unknown_user_filter`'
-how_to_implement: You must index GitHub logs. You can follow the url in reference
-  to onboard GitHub logs.
-known_false_positives: unknown
-references:
-- https://www.splunk.com/en_us/blog/tips-and-tricks/getting-github-data-with-webhooks.html
 tags:
   analytic_story:
   - Dev Sec Ops
@@ -40,26 +38,16 @@ tags:
   - DE.CM
   observable:
   - name: repository
-    type: System
     role:
     - Victim
+    type: System
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   - Dev Sec Ops Analytics
-  required_fields:
-  - _time
-  - alert.id
-  - repository.full_name
-  - repository.html_url
-  - action
-  - alert.affected_package_name
-  - alert.affected_range
-  - alert.created_at
-  - alert.external_identifier
-  - alert.external_reference
-  - alert.fixed_in
-  - alert.severity
+  required_fields: []
   risk_score: 27
   security_domain: network
+type: Anomaly
+version: 1
diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml
index 04a38dc077..22f7be9295 100644
--- a/detections/cloud/gsuite_drive_share_in_external_email.yml
+++ b/detections/cloud/gsuite_drive_share_in_external_email.yml
@@ -1,13 +1,20 @@
-name: Gsuite Drive Share In External Email
-id: f6ee02d6-fea0-11eb-b2c2-acde48001122
-version: 1
-date: '2021-08-16'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-08-16'
 description: This search is to detect suspicious google drive or google docs files
   shared outside or externally. This behavior might be a good hunting query to monitor
   exfitration of data made by an attacker or insider to a targetted machine.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to gsuite having the file attachment metadata like file type, file
+  extension, source email, destination email, num of attachment and etc. In order
+  for the search to work for your environment, please edit the query to use your company
+  specific email domain instead of `internal_test_email.com`.
+id: f6ee02d6-fea0-11eb-b2c2-acde48001122
+known_false_positives: network admin or normal user may share files to customer and
+  external team.
+name: Gsuite Drive Share In External Email
+references:
+- https://www.redhat.com/en/topics/devops/what-is-devsecops
 search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner "[^@]+@(?<src_domain>[^@]+)"
   | rex field=email "[^@]+@(?<dest_domain>[^@]+)" | where src_domain = "internal_test_email.com"
   and not dest_domain = "internal_test_email.com" | eval phase="plan" | eval severity="low"
@@ -17,15 +24,6 @@ search: '`gsuite_drive` NOT (email IN("", "null")) | rex field=parameters.owner
   lastTime by parameters.owner ip_address phase severity  | rename parameters.owner
   as user ip_address as src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `gsuite_drive_share_in_external_email_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs related to gsuite having the file attachment metadata like file type, file
-  extension, source email, destination email, num of attachment and etc. In order
-  for the search to work for your environment, please edit the query to use your company
-  specific email domain instead of `internal_test_email.com`.
-known_false_positives: network admin or normal user may share files to customer and
-  external team.
-references:
-- https://www.redhat.com/en/topics/devops/what-is-devsecops
 tags:
   analytic_story:
   - Dev Sec Ops
@@ -46,13 +44,13 @@ tags:
   - T1567
   observable:
   - name: parameters.owner
-    type: User
     role:
     - Attacker
-  - name: email
     type: User
+  - name: email
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -60,12 +58,10 @@ tags:
   - Dev Sec Ops Analytics
   required_fields:
   - _time
-  - parameters.doc_title
-  - src_domain
   - dest_domain
   - email
-  - parameters.visibility
-  - parameters.owner
-  - parameters.doc_type
+  - src_domain
   risk_score: 72
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/cloud/gsuite_email_suspicious_attachment.yml b/detections/cloud/gsuite_email_suspicious_attachment.yml
index 9c9133fe0b..4e7708da6a 100644
--- a/detections/cloud/gsuite_email_suspicious_attachment.yml
+++ b/detections/cloud/gsuite_email_suspicious_attachment.yml
@@ -1,15 +1,21 @@
-name: GSuite Email Suspicious Attachment
-id: 6d663014-fe92-11eb-ab07-acde48001122
-version: 1
-date: '2021-08-16'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-08-16'
 description: This search is to detect a suspicious attachment file extension in Gsuite
   email that may related to spear phishing attack. This file type is commonly used
   by malware to lure user to click on it to execute malicious code to compromised
   targetted machine. But this search can also catch some normal files related to this
   file type that maybe send by employee or network admin.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to gsuite having the file attachment metadata like file type, file
+  extension, source email, destination email, num of attachment and etc.
+id: 6d663014-fe92-11eb-ab07-acde48001122
+known_false_positives: network admin and normal user may send this file attachment
+  as part of their day to day work. having a good protocol in attaching this file
+  type to an e-mail may reduce the risk of having a spear phishing attack.
+name: GSuite Email Suspicious Attachment
+references:
+- https://www.redhat.com/en/topics/devops/what-is-devsecops
 search: '`gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb", "sh",
   "bat", "exe", "dll", "cpl", "com", "js", "vbs", "ps1", "reg","swf", "cmd", "go")
   | eval phase="plan" | eval severity="medium" | stats count min(_time) as firstTime
@@ -18,14 +24,6 @@ search: '`gsuite_gmail` "attachment{}.file_extension_type" IN ("pl", "py", "rb",
   by destination{}.service num_message_attachments  subject destination{}.address
   source.address phase severity | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `gsuite_email_suspicious_attachment_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs related to gsuite having the file attachment metadata like file type, file
-  extension, source email, destination email, num of attachment and etc.
-known_false_positives: network admin and normal user may send this file attachment
-  as part of their day to day work. having a good protocol in attaching this file
-  type to an e-mail may reduce the risk of having a spear phishing attack.
-references:
-- https://www.redhat.com/en/topics/devops/what-is-devsecops
 tags:
   analytic_story:
   - Dev Sec Ops
@@ -44,13 +42,13 @@ tags:
   - T1566
   observable:
   - name: source.address
-    type: User
     role:
     - attacker
-  - name: destination{}.address
     type: User
+  - name: destination{}.address
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -58,13 +56,10 @@ tags:
   - Dev Sec Ops Analytics
   required_fields:
   - _time
-  - attachment{}.file_extension_type
-  - attachment{}.sha256
-  - destination{}.service
   - num_message_attachments
   - payload_size
   - subject
-  - destination{}.address
-  - source.address
   risk_score: 49
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml
index b65fe208be..4d8fb879c4 100644
--- a/detections/cloud/gsuite_suspicious_shared_file_name.yml
+++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml
@@ -1,16 +1,24 @@
-name: Gsuite Suspicious Shared File Name
-id: 07eed200-03f5-11ec-98fb-acde48001122
-version: 1
-date: '2021-08-23'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-08-23'
 description: This search is to detect a shared file in google drive with suspicious
   file name that are commonly used by spear phishing campaign. This technique is very
   popular to lure the user by running a malicious document or click a malicious link
   within the shared file that will redirected to malicious website. This detection
   can also catch some normal email communication between organization and its external
   customer.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs related to gsuite having the file attachment metadata like file type, file
+  extension, source email, destination email, num of attachment and etc. In order
+  for the search to work for your environment, please edit the query to use your company
+  specific email domain instead of `internal_test_email.com`.
+id: 07eed200-03f5-11ec-98fb-acde48001122
+known_false_positives: normal user or normal transaction may contain the subject and
+  file type attachment that this detection try to search
+name: Gsuite Suspicious Shared File Name
+references:
+- https://www.redhat.com/en/topics/devops/what-is-devsecops
+- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
 search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_title"
   IN ("*dhl*", "* ups *", "*delivery*", "*parcel*", "*label*", "*invoice*", "*postal*",
   "*fedex*", "* usps *", "* express *", "*shipment*", "*Banking/Tax*","*shipment*",
@@ -22,16 +30,6 @@ search: '`gsuite_drive` parameters.owner_is_team_drive=false "parameters.doc_tit
   parameters.target_user parameters.doc_title parameters.doc_type phase severity |
   rename parameters.target_user AS user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `gsuite_suspicious_shared_file_name_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs related to gsuite having the file attachment metadata like file type, file
-  extension, source email, destination email, num of attachment and etc. In order
-  for the search to work for your environment, please edit the query to use your company
-  specific email domain instead of `internal_test_email.com`.
-known_false_positives: normal user or normal transaction may contain the subject and
-  file type attachment that this detection try to search
-references:
-- https://www.redhat.com/en/topics/devops/what-is-devsecops
-- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-top-spear-phishing-words.pdf
 tags:
   analytic_story:
   - Dev Sec Ops
@@ -51,13 +49,13 @@ tags:
   - T1566
   observable:
   - name: parameters.owner
-    type: User
     role:
     - attacker
-  - name: email
     type: User
+  - name: email
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -65,12 +63,9 @@ tags:
   - Dev Sec Ops Analytics
   required_fields:
   - _time
-  - parameters.doc_title
-  - src_domain
   - dest_domain
   - email
-  - parameters.visibility
-  - parameters.owner
-  - parameters.doc_type
   risk_score: 21
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml
index cd76a25d77..d1a0bd8e52 100644
--- a/detections/cloud/kubernetes_scanner_image_pulling.yml
+++ b/detections/cloud/kubernetes_scanner_image_pulling.yml
@@ -1,22 +1,20 @@
-name: Kubernetes Scanner Image Pulling
-id: 4890cd6b-0112-4974-a272-c5c153aee551
-version: 1
-date: '2021-08-24'
 author: Patrick Bareiss, Splunk
-type: TTP
 datamodel: []
+date: '2021-08-24'
 description: This search uses the Kubernetes logs from Splunk Connect from Kubernetes
   to detect Kubernetes Security Scanner.
+how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
+id: 4890cd6b-0112-4974-a272-c5c153aee551
+known_false_positives: unknown
+name: Kubernetes Scanner Image Pulling
+references:
+- https://github.com/splunk/splunk-connect-for-kubernetes
 search: '`kube_objects_events` object.message IN ("Pulling image *kube-hunter*", "Pulling
   image *kube-bench*", "Pulling image *kube-recon*", "Pulling image *kube-recon*")
   | rename object.* AS * | rename involvedObject.* AS * | rename source.host AS host
   | eval phase="operate" | eval severity="high" | stats min(_time) as firstTime max(_time)
   as lastTime count by host, name, namespace, kind, reason, message, phase, severity
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `kubernetes_scanner_image_pulling_filter`'
-how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes.
-known_false_positives: unknown
-references:
-- https://github.com/splunk/splunk-connect-for-kubernetes
 tags:
   analytic_story:
   - Dev Sec Ops
@@ -47,13 +45,8 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   - Dev Sec Ops Analytics
-  required_fields:
-  - object.message
-  - source.host
-  - object.involvedObject.name
-  - object.involvedObject.namespace
-  - object.involvedObject.kind
-  - object.message
-  - object.reason
+  required_fields: []
   risk_score: 81
   security_domain: network
+type: TTP
+version: 1
diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml
index 731f801395..f4d48de0c8 100644
--- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml
+++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml
@@ -1,25 +1,23 @@
-name: O365 Add App Role Assignment Grant User
-id: b2c81cc6-6040-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-26'
 author: Rod Soto, Splunk
-type: TTP
 datamodel: []
+date: '2021-01-26'
 description: This search detects the creation of a new Federation setting by alerting
   about an specific event related to its creation.
+how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
+  works with o365:management:activity
+id: b2c81cc6-6040-11eb-ae93-0242ac130002
+known_false_positives: The creation of a new Federation is not necessarily malicious,
+  however this events need to be followed closely, as it may indicate federated credential
+  abuse or backdoor via federated identities at a different cloud provider.
+name: O365 Add App Role Assignment Grant User
+references:
+- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
+- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
 search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app
   role assignment grant to user." | stats count min(_time) as firstTime max(_time)
   as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by
   ActorIpAddress dest ResultStatus | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `o365_add_app_role_assignment_grant_user_filter`'
-how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
-  works with o365:management:activity
-known_false_positives: The creation of a new Federation is not necessarily malicious,
-  however this events need to be followed closely, as it may indicate federated credential
-  abuse or backdoor via federated identities at a different cloud provider.
-references:
-- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
-- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
 tags:
   analytic_story:
   - Office 365 Detections
@@ -44,30 +42,30 @@ tags:
   - T1136
   observable:
   - name: ActorIpAddress
+    role:
+    - Attacker
     type: IP Address
-    role:
-    - Attacker
   - name: Actor.ID
-    type: User
     role:
     - Attacker
+    type: User
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - Workload
-  - Operation
-  - Actor{}.ID
-  - Actor{}.Type
   - ActorIpAddress
-  - dest
+  - Operation
   - ResultStatus
+  - Workload
+  - _time
+  - dest
   risk_score: 18
   security_domain: threat
+type: TTP
+version: 1
diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml
index 08efdec24d..d85a8cd112 100644
--- a/detections/cloud/o365_added_service_principal.yml
+++ b/detections/cloud/o365_added_service_principal.yml
@@ -1,28 +1,26 @@
-name: O365 Added Service Principal
-id: 1668812a-6047-11eb-ae93-0242ac130002
-version: 1
-date: '2022-02-03'
 author: Rod Soto, Splunk
-type: TTP
 datamodel: []
+date: '2022-02-03'
 description: This search detects the creation of a new Federation setting by alerting
   about an specific event related to its creation.
+how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
+  works with o365:management:activity
+id: 1668812a-6047-11eb-ae93-0242ac130002
+known_false_positives: The creation of a new Federation is not necessarily malicious,
+  however these events need to be followed closely, as it may indicate federated credential
+  abuse or backdoor via federated identities at a different cloud provider.
+name: O365 Added Service Principal
+references:
+- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
+- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
+- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
+- https://www.sygnia.co/golden-saml-advisory
 search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add service
   principal credentials." | stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID)
   as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue)
   as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress
   Operation | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `o365_added_service_principal_filter`'
-how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
-  works with o365:management:activity
-known_false_positives: The creation of a new Federation is not necessarily malicious,
-  however these events need to be followed closely, as it may indicate federated credential
-  abuse or backdoor via federated identities at a different cloud provider.
-references:
-- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
-- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
-- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
-- https://www.sygnia.co/golden-saml-advisory
 tags:
   analytic_story:
   - Office 365 Detections
@@ -47,26 +45,23 @@ tags:
   - T1136
   observable:
   - name: ActorIpAddress
-    type: IP Address
     role:
     - Attacker
+    type: IP Address
   - name: Target.ID
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - Workload
-  - signature
-  - Actor{}.ID
-  - ModifiedProperties{}.Name
-  - ModifiedProperties{}.NewValue
-  - Target{}.ID
   - ActorIpAddress
+  - Workload
+  - _time
   risk_score: 42
   security_domain: threat
+type: TTP
+version: 1
diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
index aaee2fa67e..c9dbc41d5f 100644
--- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
+++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml
@@ -1,13 +1,18 @@
-name: O365 Bypass MFA via Trusted IP
-id: c783dd98-c703-4252-9e8a-f19d9f66949e
-version: 2
-date: '2022-02-03'
 author: Bhavin Patel, Splunk
-type: TTP
 datamodel: []
+date: '2022-02-03'
 description: This search detects newly added IP addresses/CIDR blocks to the list
   of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known
   to use this technique so that they can bypass the MFA system.
+how_to_implement: You must install Splunk Microsoft Office 365 add-on. This search
+  works with o365:management:activity
+id: c783dd98-c703-4252-9e8a-f19d9f66949e
+known_false_positives: Unless it is a special case, it is uncommon to continually
+  update Trusted IPs to MFA configuration.
+name: O365 Bypass MFA via Trusted IP
+references:
+- https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf
+- https://attack.mitre.org/techniques/T1562/007/
 search: '`o365_management_activity` Operation="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy
   | rex max_match=100 field=ModifiedProperties{}.NewValue "(?<ip_addresses_new_added>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
   | rex max_match=100 field=ModifiedProperties{}.OldValue "(?<ip_addresses_old>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})"
@@ -17,13 +22,6 @@ search: '`o365_management_activity` Operation="Set Company Information." Modifie
   as ip_addresses_old by user ip_addresses_new_added Operation Workload vendor_account
   status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
   `o365_bypass_mfa_via_trusted_ip_filter`'
-how_to_implement: You must install Splunk Microsoft Office 365 add-on. This search
-  works with o365:management:activity
-known_false_positives: Unless it is a special case, it is uncommon to continually
-  update Trusted IPs to MFA configuration.
-references:
-- https://i.blackhat.com/USA-20/Thursday/us-20-Bienstock-My-Cloud-Is-APTs-Cloud-Investigating-And-Defending-Office-365.pdf
-- https://attack.mitre.org/techniques/T1562/007/
 tags:
   analytic_story:
   - Office 365 Detections
@@ -48,13 +46,13 @@ tags:
   - T1562
   observable:
   - name: ip_addresses_new_added
+    role:
+    - Attacker
     type: IP Address
-    role:
-    - Attacker
   - name: user_id
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
@@ -62,14 +60,12 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - signature
-  - ModifiedProperties{}.Name
-  - ModifiedProperties{}.NewValue
-  - ModifiedProperties{}.OldValue
-  - user
-  - vendor_account
-  - status
-  - user_id
   - action
+  - status
+  - user
+  - user_id
+  - vendor_account
   risk_score: 42
   security_domain: threat
+type: TTP
+version: 2
diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml
index 3a7ef5e300..a7725fb0dc 100644
--- a/detections/cloud/o365_disable_mfa.yml
+++ b/detections/cloud/o365_disable_mfa.yml
@@ -1,22 +1,20 @@
-name: O365 Disable MFA
-id: c783dd98-c703-4252-9e8a-f19d9f5c949e
-version: 1
-date: '2022-02-03'
 author: Rod Soto, Splunk
-type: TTP
 datamodel: []
+date: '2022-02-03'
 description: This search detects when multi factor authentication has been disabled,
   what entitiy performed the action and against what user
+how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
+  works with o365:management:activity
+id: c783dd98-c703-4252-9e8a-f19d9f5c949e
+known_false_positives: Unless it is a special case, it is uncommon to disable MFA
+  or Strong Authentication
+name: O365 Disable MFA
+references:
+- https://attack.mitre.org/techniques/T1556/
 search: '`o365_management_activity` Operation="Disable Strong Authentication." | stats
   count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation
   UserId ResultStatus |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
   | `o365_disable_mfa_filter`'
-how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
-  works with o365:management:activity
-known_false_positives: Unless it is a special case, it is uncommon to disable MFA
-  or Strong Authentication
-references:
-- https://attack.mitre.org/techniques/T1556/
 tags:
   analytic_story:
   - Office 365 Detections
@@ -40,26 +38,24 @@ tags:
   - T1556
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: user
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
   - Operation
-  - UserType
-  - user
-  - status
-  - signature
-  - dest
   - ResultStatus
+  - UserType
+  - _time
   risk_score: 64
   security_domain: threat
+type: TTP
+version: 1
diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml
index 7a416e6f60..0c321f337b 100644
--- a/detections/cloud/o365_new_federated_domain_added.yml
+++ b/detections/cloud/o365_new_federated_domain_added.yml
@@ -1,27 +1,25 @@
-name: O365 New Federated Domain Added
-id: e155876a-6048-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-26'
 author: Rod Soto, Splunk
-type: TTP
 datamodel: []
+date: '2021-01-26'
 description: This search detects the addition of a new Federated domain.
-search: '`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain"
-  | stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value)
-  as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId
-  UserKey | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `o365_new_federated_domain_added_filter`'
 how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
   works with o365:management:activity.
+id: e155876a-6048-11eb-ae93-0242ac130002
 known_false_positives: The creation of a new Federated domain is not necessarily malicious,
   however these events need to be followed closely, as it may indicate federated credential
   abuse or backdoor via federated identities at a similar or different cloud provider.
+name: O365 New Federated Domain Added
 references:
 - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
 - https://us-cert.cisa.gov/ncas/alerts/aa21-008a
 - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
 - https://www.sygnia.co/golden-saml-advisory
 - https://o365blog.com/post/aadbackdoor/
+search: '`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain"
+  | stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value)
+  as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId
+  UserKey | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `o365_new_federated_domain_added_filter`'
 tags:
   analytic_story:
   - Office 365 Detections
@@ -47,27 +45,28 @@ tags:
   - T1136
   observable:
   - name: OrganizationName
+    role:
+    - Victim
     type: Other
-    role:
-    - Victim
   - name: UserId
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Security Analytics for AWS
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - Workload
-  - Operation
-  - Parameters{}.Value
   - ObjectId
+  - Operation
   - OrganizationName
   - OriginatingServer
   - UserId
   - UserKey
+  - Workload
+  - _time
   risk_score: 64
   security_domain: threat
+type: TTP
+version: 1
diff --git a/detections/endpoint/7zip_commandline_to_smb_share_path.yml b/detections/endpoint/7zip_commandline_to_smb_share_path.yml
index 71a2f82616..1803c3a432 100644
--- a/detections/endpoint/7zip_commandline_to_smb_share_path.yml
+++ b/detections/endpoint/7zip_commandline_to_smb_share_path.yml
@@ -1,16 +1,21 @@
-name: 7zip CommandLine To SMB Share Path
-id: 01d29b48-ff6f-11eb-b81e-acde48001122
-version: 1
-date: '2021-08-17'
 author: Teoderick Contreras, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-17'
 description: This search is to detect a suspicious 7z process with commandline pointing
   to SMB network share. This technique was seen in CONTI LEAK tools where it use 7z
   to archive a sensitive files and place it in network share tmp folder. This search
   is a good hunting query that may give analyst a hint why specific user try to archive
   a file pointing to SMB user which is un usual.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed 7z.exe may be used.
+id: 01d29b48-ff6f-11eb-b81e-acde48001122
+known_false_positives: unknown
+name: 7zip CommandLine To SMB Share Path
+references:
+- https://threadreaderapp.com/thread/1423361119926816776.html
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name ="7z.exe"
   OR Processes.process_name = "7za.exe" OR Processes.original_file_name = "7z.exe"
@@ -20,13 +25,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_id Processes.process_id  Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `7zip_commandline_to_smb_share_path_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed 7z.exe may be used.
-known_false_positives: unknown
-references:
-- https://threadreaderapp.com/thread/1423361119926816776.html
 tags:
   analytic_story:
   - Ransomware
@@ -47,26 +45,29 @@ tags:
   - T1560
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: SourceImage
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml
index f5c8857b30..144757c0d6 100644
--- a/detections/endpoint/account_discovery_with_net_app.yml
+++ b/detections/endpoint/account_discovery_with_net_app.yml
@@ -1,11 +1,7 @@
-name: Account Discovery With Net App
-id: 339805ce-ac30-11eb-b87d-acde48001122
-version: 3
-date: '2021-09-16'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: this search is to detect a potential account discovery series of command
   used by several malware or attack to recon the target machine. This technique is
   also seen in some note worthy malware like trickbot where it runs a cmd process,
@@ -13,6 +9,18 @@ description: this search is to detect a potential account discovery series of co
   of command are good correlation search and indicator of attacker recon if seen in
   the machines within a none technical user or department (HR, finance, ceo and etc)
   network.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product..
+id: 339805ce-ac30-11eb-b87d-acde48001122
+known_false_positives: admin or power user may used this series of command.
+name: Account Discovery With Net App
+references:
+- https://labs.vipre.com/trickbot-and-its-modules/
+- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
+- https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.parent_process) as parent_process values(Processes.process_id)
   as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
@@ -20,16 +28,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   OR Processes.process="*view /all*") by  Processes.process_name Processes.dest Processes.user
   Processes.parent_process_name | where count >=5 | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product..
-known_false_positives: admin or power user may used this series of command.
-references:
-- https://labs.vipre.com/trickbot-and-its-modules/
-- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
-- https://app.any.run/tasks/48414a33-3d66-4a46-afe5-c2003bb55ccf/
 tags:
   analytic_story:
   - Trickbot
@@ -50,35 +48,33 @@ tags:
   - T1087
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: process_name
-    type: Process Name
     role:
     - Process
+    type: Process Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 5
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 3
diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml
index 86071ff0f0..242f4c4a42 100644
--- a/detections/endpoint/active_setup_registry_autostart.yml
+++ b/detections/endpoint/active_setup_registry_autostart.yml
@@ -1,11 +1,8 @@
-name: Active Setup Registry Autostart
-id: f64579c0-203f-11ec-abcc-acde48001122
-version: 2
-date: '2022-01-26'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-26'
 description: This analytic is to detect a suspicious modification of the active setup
   registry for persistence and privilege escalation. This technique was seen in several
   malware (poisonIvy), adware and APT to gain persistence to the compromised machine
@@ -13,6 +10,18 @@ description: This analytic is to detect a suspicious modification of the active
   do the modification since modification of this registry is not commonly done. check
   the legitimacy of the file and process involve in this rules to check if it is a
   valid setup installer that creating or modifying this registry.
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+id: f64579c0-203f-11ec-abcc-acde48001122
+known_false_positives: Active setup installer may add or modify this registry.
+name: Active Setup Registry Autostart
+references:
+- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E
+- https://attack.mitre.org/techniques/T1547/014/
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
   where Registry.registry_value_name= "StubPath" Registry.registry_path = "*\\SOFTWARE\\Microsoft\\Active
   Setup\\Installed Components*" by _time span=1h Registry.dest Registry.user Registry.registry_path
@@ -26,16 +35,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name
   parent_process process_name process_path process proc_guid registry_path registry_value_name
   registry_value_data | `active_setup_registry_autostart_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: Active setup installer may add or modify this registry.
-references:
-- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor%3aWin32%2fPoisonivy.E
-- https://attack.mitre.org/techniques/T1547/014/
 tags:
   analytic_story:
   - Windows Persistence Techniques
@@ -56,25 +55,35 @@ tags:
   - T1547
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
   risk_score: 64
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml
index 52aae5c92b..a39d5b9864 100644
--- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml
+++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml
@@ -1,17 +1,23 @@
-name: Add DefaultUser And Password In Registry
-id: d4a3eb62-0f1e-11ec-a971-acde48001122
-version: 2
-date: '2022-01-26'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-26'
 description: this search is to detect a suspicious registry modification to implement
   auto admin logon to a host. This technique was seen in BlackMatter ransomware to
   automatically logon to the compromise host after  triggering a safemode boot to
   continue encrypting the whole network. This behavior is not a common practice and
   really a suspicious TTP or alert need to be consider if found within then network
   premise.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: d4a3eb62-0f1e-11ec-a971-acde48001122
+known_false_positives: unknown
+name: Add DefaultUser And Password In Registry
+references:
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon*"
   AND Registry.registry_value_name= DefaultPassword OR Registry.registry_value_name=
@@ -27,13 +33,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   registry_key_name] | table _time dest user parent_process_name parent_process process_name
   process_path process proc_guid registry_path registry_value_name registry_value_data
   registry_key_name | `add_defaultuser_and_password_in_registry_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: unknown
-references:
-- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
 tags:
   analytic_story:
   - BlackMatter Ransomware
@@ -54,20 +53,32 @@ tags:
   - T1552
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
   risk_score: 25
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: Anomaly
+version: 2
diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml
index be1e38c53e..0c34fc5b39 100644
--- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml
+++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml
@@ -1,17 +1,25 @@
-name: Add or Set Windows Defender Exclusion
-id: 773b66fe-4dd9-11ec-8289-acde48001122
-version: 1
-date: '2021-11-25'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-25'
 description: This analytic will identify a suspicious process command-line related
   to Windows Defender exclusion feature. This command is abused by adversaries, malware
   authors and red teams to bypass Windows Defender Antivirus products by excluding
   folder path, file path, process and extensions. From its real time or schedule scan
   to execute their malicious code. This is a good indicator for defense evasion and
   to look further for events after this behavior.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: 773b66fe-4dd9-11ec-8289-acde48001122
+known_false_positives: Admin or user may choose to use this windows features. Filter
+  as needed.
+name: Add or Set Windows Defender Exclusion
+references:
+- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
+- https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*Add-MpPreference
   *" OR Processes.process = "*Set-MpPreference *") AND Processes.process="*-exclusion*"
@@ -19,16 +27,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `add_or_set_windows_defender_exclusion_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: Admin or user may choose to use this windows features. Filter
-  as needed.
-references:
-- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
-- https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Remcos
@@ -50,31 +48,31 @@ tags:
   - T1562
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
index 41bc3e37ff..bfef3288ed 100644
--- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
+++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml
@@ -1,14 +1,22 @@
-name: Allow File And Printing Sharing In Firewall
-id: ce27646e-d411-11eb-8a00-acde48001122
-version: 2
-date: '2021-06-23'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-06-23'
 description: This search is to detect a suspicious modification of firewall to allow
   file and printer sharing. This technique was seen in ransomware to be able to discover
   more machine connected to the compromised host to encrypt more files
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: ce27646e-d411-11eb-8a00-acde48001122
+known_false_positives: network admin may modify this firewall feature that may cause
+  this rule to be triggered.
+name: Allow File And Printing Sharing In Firewall
+references:
+- https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469
+- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_netsh` Processes.process=
   "*firewall*" Processes.process= "*group=\"File and Printer Sharing\"*"  Processes.process="*enable=Yes*"
@@ -16,16 +24,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `allow_file_and_printing_sharing_in_firewall_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: network admin may modify this firewall feature that may cause
-  this rule to be triggered.
-references:
-- https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469
-- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
 tags:
   analytic_story:
   - Ransomware
@@ -42,18 +40,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml
index 10d10e646c..ee487524c2 100644
--- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml
+++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml
@@ -1,15 +1,22 @@
-name: Allow Inbound Traffic By Firewall Rule Registry
-id: 0a46537c-be02-11eb-92ca-acde48001122
-version: 2
-date: '2022-01-26'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-26'
 description: This analytic detects a potential suspicious modification of firewall
   rule registry allowing inbound traffic in specific port with public profile. This
   technique was identified when an adversary wants to grant remote access to a machine
   by allowing the traffic in a firewall rule.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: 0a46537c-be02-11eb-92ca-acde48001122
+known_false_positives: network admin may add/remove/modify public inbound firewall
+  rule that may cause this rule to be triggered.
+name: Allow Inbound Traffic By Firewall Rule Registry
+references:
+- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*"
   Registry.registry_value_data = "*|Action=Allow|*" Registry.registry_value_data =
@@ -26,14 +33,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   _time dest user parent_process_name parent_process process_name process_path process
   proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `allow_inbound_traffic_by_firewall_rule_registry_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: network admin may add/remove/modify public inbound firewall
-  rule that may cause this rule to be triggered.
-references:
-- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps
 tags:
   analytic_story:
   - Prohibited Traffic Allowed or Protocol Mismatch
@@ -54,25 +53,36 @@ tags:
   - T1021
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_path
-  - Registry.registry_value_name
-  - Registry.registry_key_name
-  - Registry.dest
-  - Registry.user
   risk_score: 3
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
index 644a57103f..2452068297 100644
--- a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
+++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
@@ -1,26 +1,23 @@
-name: Allow Inbound Traffic In Firewall Rule
-id: a5d85486-b89c-11eb-8267-acde48001122
-version: 1
-date: '2021-05-19'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-05-19'
 description: The following analytic identifies suspicious PowerShell command to allow
   inbound traffic inbound to a specific local port within the public profile. This
   technique was seen in some attacker want to have a remote access to a machine by
   allowing the traffic in firewall rule.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the powershell logs  from your endpoints. make sure you enable needed
+  registry to monitor this event.
+id: a5d85486-b89c-11eb-8267-acde48001122
+known_false_positives: administrator may allow inbound traffic in certain network
+  or machine.
+name: Allow Inbound Traffic In Firewall Rule
+references:
+- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps
 search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Inbound*"
   Message = "*Allow*"  Message = "*-LocalPort*" | stats count min(_time) as firstTime
   max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `allow_inbound_traffic_in_firewall_rule_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the powershell logs  from your endpoints. make sure you enable needed
-  registry to monitor this event.
-known_false_positives: administrator may allow inbound traffic in certain network
-  or machine.
-references:
-- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps
 tags:
   analytic_story:
   - Prohibited Traffic Allowed or Protocol Mismatch
@@ -41,13 +38,13 @@ tags:
   - T1021
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: ComputerName
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -60,3 +57,5 @@ tags:
   - User
   risk_score: 3
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml
index 87fcccb2b4..3abdbc64a4 100644
--- a/detections/endpoint/allow_network_discovery_in_firewall.yml
+++ b/detections/endpoint/allow_network_discovery_in_firewall.yml
@@ -1,15 +1,23 @@
-name: Allow Network Discovery In Firewall
-id: ccd6a38c-d40b-11eb-85a5-acde48001122
-version: 2
-date: '2021-06-23'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-06-23'
 description: This search is to detect a suspicious modification to the firewall to
   allow network discovery on a machine. This technique was seen in couple of ransomware
   (revil, reddot) to discover other machine connected to the compromised host to encrypt
   more files.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: ccd6a38c-d40b-11eb-85a5-acde48001122
+known_false_positives: network admin may modify this firewall feature that may cause
+  this rule to be triggered.
+name: Allow Network Discovery In Firewall
+references:
+- https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469
+- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_netsh` Processes.process=
   "*firewall*" Processes.process= "*group=\"Network Discovery\"*"  Processes.process="*enable*"
@@ -17,16 +25,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `allow_network_discovery_in_firewall_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: network admin may modify this firewall feature that may cause
-  this rule to be triggered.
-references:
-- https://kb.fortinet.com/kb/documentLink.do?externalID=FD52469
-- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
 tags:
   analytic_story:
   - Ransomware
@@ -44,18 +42,18 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml
index 06d6b5dcc7..b67976e62e 100644
--- a/detections/endpoint/allow_operation_with_consent_admin.yml
+++ b/detections/endpoint/allow_operation_with_consent_admin.yml
@@ -1,16 +1,25 @@
-name: Allow Operation with Consent Admin
-id: 7de17d7a-c9d8-11eb-a812-acde48001122
-version: 2
-date: '2022-01-26'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-26'
 description: This analytic identifies a potential privilege escalation attempt to
   perform malicious task. This registry modification is designed to allow the `Consent
   Admin` to perform an operation that requires elevation without consent or credentials.
   We also found this in some attacker to gain privilege escalation to the compromise
   machine.
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+id: 7de17d7a-c9d8-11eb-a812-acde48001122
+known_false_positives: unknown
+name: Allow Operation with Consent Admin
+references:
+- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4
+- https://www.trendmicro.com/vinfo/no/threat-encyclopedia/malware/Ransom.Win32.MRDEC.MRA/
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
   where Registry.registry_path= "*\\Microsoft\\Windows\\CurrentVersion\\Policies\\System*"
   Registry.registry_value_name = ConsentPromptBehaviorAdmin Registry.registry_value_data
@@ -26,16 +35,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   _time dest user parent_process_name parent_process process_name process_path process
   proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `allow_operation_with_consent_admin_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: unknown
-references:
-- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gpsb/341747f5-6b5d-4d30-85fc-fa1cc04038d4
-- https://www.trendmicro.com/vinfo/no/threat-encyclopedia/malware/Ransom.Win32.MRDEC.MRA/
 tags:
   analytic_story:
   - Ransomware
@@ -55,24 +54,36 @@ tags:
   - T1548
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
   risk_score: 25
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/anomalous_usage_of_7zip.yml b/detections/endpoint/anomalous_usage_of_7zip.yml
index 481f9a8198..3496733d8b 100644
--- a/detections/endpoint/anomalous_usage_of_7zip.yml
+++ b/detections/endpoint/anomalous_usage_of_7zip.yml
@@ -1,11 +1,7 @@
-name: Anomalous usage of 7zip
-id: 9364ee8e-a39a-11eb-8f1d-acde48001122
-version: 1
-date: '2021-04-22'
 author: Michael Haag, Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-04-22'
 description: The following detection identifies a 7z.exe spawned from `Rundll32.exe`
   or `Dllhost.exe`. It is assumed that the adversary has brought in `7z.exe` and `7z.dll`.
   It has been observed where an adversary will rename `7z.exe`. Additional coverage
@@ -13,21 +9,23 @@ description: The following detection identifies a 7z.exe spawned from `Rundll32.
   triage, identify the source of injection into `Rundll32.exe` or `Dllhost.exe`. Capture
   any files written to disk and analyze as needed. Review parallel processes for additional
   behaviors. Typically, archiving files will result in exfiltration.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 9364ee8e-a39a-11eb-8f1d-acde48001122
+known_false_positives: False positives should be limited as this behavior is not normal
+  for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip.
+name: Anomalous usage of 7zip
+references:
+- https://attack.mitre.org/techniques/T1560/001/
+- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
+- https://thedfirreport.com/2021/01/31/bazar-no-ryuk/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("rundll32.exe", "dllhost.exe") Processes.process_name=*7z* by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `anomalous_usage_of_7zip_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: False positives should be limited as this behavior is not normal
-  for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip.
-references:
-- https://attack.mitre.org/techniques/T1560/001/
-- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
-- https://thedfirreport.com/2021/01/31/bazar-no-ryuk/
 tags:
   analytic_story:
   - Cobalt Strike
@@ -50,37 +48,38 @@ tags:
   - T1560
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.parent_process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml
index ea941bfa39..ee56e47808 100644
--- a/detections/endpoint/any_powershell_downloadfile.yml
+++ b/detections/endpoint/any_powershell_downloadfile.yml
@@ -1,34 +1,32 @@
-name: Any Powershell DownloadFile
-id: 1a93b7ea-7af7-11eb-adb5-acde48001122
-version: 2
-date: '2021-03-01'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-03-01'
 description: The following analytic identifies the use of PowerShell downloading a
   file using `DownloadFile` method. This particular method is utilized in many different
   PowerShell frameworks to download files and output to disk. Identify the source
   (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
   transaction logs are available, review for further details of the implant.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 1a93b7ea-7af7-11eb-adb5-acde48001122
+known_false_positives: False positives may be present and filtering will need to occur
+  by parent process or command line argument. It may be required to modify this query
+  to an EDR product for more granular coverage.
+name: Any Powershell DownloadFile
+references:
+- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*DownloadFile*
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
   `any_powershell_downloadfile_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives may be present and filtering will need to occur
-  by parent process or command line argument. It may be required to modify this query
-  to an EDR product for more granular coverage.
-references:
-- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0
-- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -54,39 +52,38 @@ tags:
   - T1059.001
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml
index 0b89645de4..42c25872cb 100644
--- a/detections/endpoint/any_powershell_downloadstring.yml
+++ b/detections/endpoint/any_powershell_downloadstring.yml
@@ -1,33 +1,31 @@
-name: Any Powershell DownloadString
-id: 4d015ef2-7adf-11eb-95da-acde48001122
-version: 2
-date: '2021-03-01'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-03-01'
 description: The following analytic identifies the use of PowerShell downloading a
   file using `DownloadString` method. This particular method is utilized in many different
   PowerShell frameworks to download files and output to disk. Identify the source
   (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell
   transaction logs are available, review for further details of the implant.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*.DownloadString*  by
-  Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadstring_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: 4d015ef2-7adf-11eb-95da-acde48001122
 known_false_positives: False positives may be present and filtering will need to occur
   by parent process or command line argument. It may be required to modify this query
   to an EDR product for more granular coverage.
+name: Any Powershell DownloadString
 references:
 - https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-5.0
 - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*.DownloadString*  by
+  Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadstring_filter`'
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -48,39 +46,38 @@ tags:
   - T1059.001
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml
index f29439bb45..87aef90198 100644
--- a/detections/endpoint/attacker_tools_on_endpoint.yml
+++ b/detections/endpoint/attacker_tools_on_endpoint.yml
@@ -1,13 +1,20 @@
-name: Attacker Tools On Endpoint
-id: a51bfe1a-94f0-48cc-b4e4-16a110145893
-version: 2
-date: '2021-11-04'
 author: Bhavin Patel, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-04'
 description: This search looks for execution of commonly used attacker tools on an
   endpoint.
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records process activity from your hosts to populate the endpoint data model
+  in the processes node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is usually generated via logs that report process tracking
+  in your Windows audit settings.
+id: a51bfe1a-94f0-48cc-b4e4-16a110145893
+known_false_positives: Some administrator activity can be potentially triggered, please
+  add those users to the filter macro.
+name: Attacker Tools On Endpoint
+references: []
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime values(Processes.process) as process values(Processes.parent_process)
   as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown
@@ -15,15 +22,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `drop_dm_object_name(Processes)` | lookup attacker_tools attacker_tool_names AS
   process_name OUTPUT description | search description !=false| `attacker_tools_on_endpoint_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records process activity from your hosts to populate the endpoint data model
-  in the processes node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is usually generated via logs that report process tracking
-  in your Windows audit settings.
-known_false_positives: Some administrator activity can be potentially triggered, please
-  add those users to the filter macro.
-references: []
 tags:
   analytic_story:
   - Monitor for Unauthorized Software
@@ -59,32 +57,35 @@ tags:
   - PR.DS
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
     - Attacker
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.process_name
-  - Processes.parent_process
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 64
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
index 7c871d858f..5df6cae5d3 100644
--- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
+++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml
@@ -1,28 +1,26 @@
-name: Attempt To Add Certificate To Untrusted Store
-id: 6bc5243e-ef36-45dc-9b12-f4a6be131159
-version: 7
-date: '2021-09-16'
 author: Patrick Bareiss, Rico Valdez, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: Attempt To Add Certificate To Untrusted Store
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+id: 6bc5243e-ef36-45dc-9b12-f4a6be131159
+known_false_positives: There may be legitimate reasons for administrators to add a
+  certificate to the untrusted certificate store. In such cases, this will typically
+  be done on a large number of systems.
+name: Attempt To Add Certificate To Untrusted Store
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
   as process max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil`
   (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
   | `attempt_to_add_certificate_to_untrusted_store_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
-known_false_positives: There may be legitimate reasons for administrators to add a
-  certificate to the untrusted certificate store. In such cases, this will typically
-  be done on a large number of systems.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1553.004/T1553.004.md
 tags:
   analytic_story:
   - Disabling Security Tools
@@ -53,36 +51,37 @@ tags:
   - PR.IP
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.parent_process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 7
diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml
index 4e742ebb72..7e9b55a01e 100644
--- a/detections/endpoint/attempt_to_stop_security_service.yml
+++ b/detections/endpoint/attempt_to_stop_security_service.yml
@@ -1,13 +1,21 @@
-name: Attempt To Stop Security Service
-id: c8e349c6-b97c-486e-8949-bd7bcd1f3910
-version: 4
-date: '2020-07-21'
 author: Rico Valdez, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-07-21'
 description: This search looks for attempts to stop security-related services on the
   endpoint.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: c8e349c6-b97c-486e-8949-bd7bcd1f3910
+known_false_positives: None identified. Attempts to disable security-related services
+  should be identified and understood.
+name: Attempt To Stop Security Service
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where `process_net` OR  Processes.process_name = sc.exe Processes.process="* stop
@@ -16,16 +24,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   |lookup security_services_lookup service as process OUTPUTNEW category, description
   | search category=security | `attempt_to_stop_security_service_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: None identified. Attempts to disable security-related services
-  should be identified and understood.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Disabling Security Tools
@@ -58,39 +56,38 @@ tags:
   - PR.IP
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 20
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 4
diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
index da30681035..a8dc8d805e 100644
--- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -1,13 +1,19 @@
-name: Attempted Credential Dump From Registry via Reg exe
-id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
-version: 6
-date: '2021-09-16'
 author: Patrick Bareiss, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: Monitor for execution of reg.exe with parameters specifying an export
   of keys that contain hashed credentials that attackers may try to crack offline.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
+known_false_positives: None identified.
+name: Attempted Credential Dump From Registry via Reg exe
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_reg` OR `process_cmd`
   Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM*
@@ -16,14 +22,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: None identified.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
 tags:
   analytic_story:
   - Credential Dumping
@@ -52,39 +50,38 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 90
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 6
diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml
index 7041013f6a..ce7fbacf04 100644
--- a/detections/endpoint/auto_admin_logon_registry_entry.yml
+++ b/detections/endpoint/auto_admin_logon_registry_entry.yml
@@ -1,17 +1,23 @@
-name: Auto Admin Logon Registry Entry
-id: 1379d2b8-0f18-11ec-8ca3-acde48001122
-version: 2
-date: '2020-01-28'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2020-01-28'
 description: this search is to detect a suspicious registry modification to implement
   auto admin logon to a host. This technique was seen in BlackMatter ransomware to
   automatically logon to the compromise host after  triggering a safemode boot to
   continue encrypting the whole network. This behavior is not a common practice and
   really a suspicious TTP or alert need to be consider if found within then network
   premise.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: 1379d2b8-0f18-11ec-8ca3-acde48001122
+known_false_positives: unknown
+name: Auto Admin Logon Registry Entry
+references:
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*SOFTWARE\\Microsoft\\Windows
   NT\\CurrentVersion\\Winlogon*" AND Registry.registry_value_name=AutoAdminLogon AND
@@ -27,13 +33,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   _time dest user parent_process_name parent_process process_name process_path process
   proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `auto_admin_logon_registry_entry_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: unknown
-references:
-- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
 tags:
   analytic_story:
   - BlackMatter Ransomware
@@ -54,20 +53,32 @@ tags:
   - T1552
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml
index 6461f64403..abb4e16c70 100644
--- a/detections/endpoint/batch_file_write_to_system32.yml
+++ b/detections/endpoint/batch_file_write_to_system32.yml
@@ -1,13 +1,25 @@
-name: Batch File Write to System32
-id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3
-version: 2
-date: '2021-09-16'
 author: Michael Haag, Rico Valdez, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+- Endpoint.Processes
+date: '2021-09-16'
 description: The search looks for a batch file (.bat) written to the Windows system
   directory tree.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3
+known_false_positives: It is possible for this search to generate a notable event
+  for a batch file write to a path that includes the string "system32", but is not
+  the actual Windows system directory. As such, you should confirm the path of the
+  batch file identified by the search. In addition, a false positive may be generated
+  by an administrator copying a legitimate batch file in this directory tree. You
+  should confirm that the activity is legitimate and modify the search to add exclusions,
+  as necessary.
+name: Batch File Write to System32
+references: []
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where Processes.process_name=*  by _time span=1h Processes.process_id Processes.process_name
   Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
@@ -18,19 +30,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   | fields _time dest file_create_time file_name file_path process_name process_path
   process] | dedup file_create_time | table dest file_create_time, file_name, file_path,
   process_name  | `batch_file_write_to_system32_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: It is possible for this search to generate a notable event
-  for a batch file write to a path that includes the string "system32", but is not
-  the actual Windows system directory. As such, you should confirm the path of the
-  batch file identified by the search. In addition, a false positive may be generated
-  by an administrator copying a legitimate batch file in this directory tree. You
-  should confirm that the activity is legitimate and modify the search to add exclusions,
-  as necessary.
-references: []
 tags:
   analytic_story:
   - SamSam Ransomware
@@ -57,31 +56,33 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: file_name
-    type: File Name
     role:
     - Victim
+    type: File Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
   - _time
-  - Filesystem.dest
-  - Filesystem.file_name
-  - Filesystem.user
-  - Filesystem.file_path
-  - Processes.process_id
-  - Processes.process_name
-  - Processes.dest
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
index 4bc260d08d..a627725d6c 100644
--- a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
+++ b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml
@@ -1,30 +1,28 @@
-name: Bcdedit Command Back To Normal Mode Boot
-id: dc7a8004-0f18-11ec-8c54-acde48001122
-version: 1
-date: '2021-09-06'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-06'
 description: This search is to detect a suspicious bcdedit commandline to configure
   the host from safe mode back to normal boot configuration. This technique was seen
   in blackMatter ransomware where it force the compromised host to boot in safe mode
   to continue its encryption and bring back to normal boot using bcdedit deletevalue
   command. This TTP can be a good alert for host that booted from safe mode forcefully
   since it need to modify the boot configuration to bring it back to normal.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+id: dc7a8004-0f18-11ec-8c54-acde48001122
+known_false_positives: unknown
+name: Bcdedit Command Back To Normal Mode Boot
+references:
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe
   Processes.process="*/deletevalue*" Processes.process="*{current}*"  Processes.process="*safeboot*"
   by Processes.process_name Processes.process Processes.parent_process_name Processes.dest
   Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `bcdedit_command_back_to_normal_mode_boot_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: unknown
-references:
-- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
 tags:
   analytic_story:
   - BlackMatter Ransomware
@@ -44,26 +42,27 @@ tags:
   - T1490
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.dest
-  - Processes.user
   risk_score: 35
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml
index fd4eacf029..22cf831035 100644
--- a/detections/endpoint/bcdedit_failure_recovery_modification.yml
+++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml
@@ -1,26 +1,24 @@
-name: BCDEdit Failure Recovery Modification
-id: 809b31d2-5462-11eb-ae93-0242ac130002
-version: 1
-date: '2020-12-21'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-12-21'
 description: This search looks for flags passed to bcdedit.exe modifications to the
   built-in Windows error recovery boot configurations. This is typically used by ransomware
   to prevent recovery.
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints to populate the Endpoint
+  data model in the Processes node. Tune based on parent process names.
+id: 809b31d2-5462-11eb-ae93-0242ac130002
+known_false_positives: Administrators may modify the boot configuration.
+name: BCDEdit Failure Recovery Modification
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe
   Processes.process="*recoveryenabled*" (Processes.process="* no*") by Processes.process_name
   Processes.process Processes.parent_process_name Processes.dest Processes.user |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `bcdedit_failure_recovery_modification_filter`'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. Tune based on parent process names.
-known_false_positives: Administrators may modify the boot configuration.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
 tags:
   analytic_story:
   - Ryuk Ransomware
@@ -47,33 +45,35 @@ tags:
   - PR.IP
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.user
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml
index 1f32249fd9..be1078938e 100644
--- a/detections/endpoint/bits_job_persistence.yml
+++ b/detections/endpoint/bits_job_persistence.yml
@@ -1,11 +1,7 @@
-name: BITS Job Persistence
-id: e97a5ffe-90bf-11eb-928a-acde48001122
-version: 2
-date: '2021-09-16'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: The following query identifies Microsoft Background Intelligent Transfer
   Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
   The query identifies the parameters used to create, resume or add a file to a BITS
@@ -13,6 +9,21 @@ description: The following query identifies Microsoft Background Intelligent Tra
   the BITS job created and capture any files written to disk. It is possible for BITS
   to be used to upload files and this may require further network data analysis to
   identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: e97a5ffe-90bf-11eb-928a-acde48001122
+known_false_positives: Limited false positives will be present. Typically, applications
+  will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
+  (legitimate applications) or parent process.
+name: BITS Job Persistence
+references:
+- https://attack.mitre.org/techniques/T1197/
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute
+- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process
   IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, *setminretrydelay*,
@@ -20,19 +31,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `bits_job_persistence_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives will be present. Typically, applications
-  will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
-  (legitimate applications) or parent process.
-references:
-- https://attack.mitre.org/techniques/T1197/
-- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md#atomic-test-3---persist-download--execute
-- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
 tags:
   analytic_story:
   - BITS Jobs
@@ -52,39 +50,38 @@ tags:
   - T1197
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml
index 740f549f79..356cb0450c 100644
--- a/detections/endpoint/bitsadmin_download_file.yml
+++ b/detections/endpoint/bitsadmin_download_file.yml
@@ -1,11 +1,7 @@
-name: BITSAdmin Download File
-id: 80630ff4-8e4c-11eb-aab5-acde48001122
-version: 2
-date: '2021-09-16'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: The following query identifies Microsoft Background Intelligent Transfer
   Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote
   object. In addition, look for `download` or `upload` on the command-line, the switches
@@ -18,24 +14,26 @@ description: The following query identifies Microsoft Background Intelligent Tra
   and child processes to capture any behaviors and artifacts. In some suspicious and
   malicious instances, BITS jobs will be created. You can use `bitsadmin /list /verbose`
   to list out the jobs during investigation.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 80630ff4-8e4c-11eb-aab5-acde48001122
+known_false_positives: Limited false positives, however it may be required to filter
+  based on parent process name or network connection.
+name: BITSAdmin Download File
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download
+- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md
+- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
+- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_bitsadmin` Processes.process=*transfer*
   by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `bitsadmin_download_file_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives, however it may be required to filter
-  based on parent process name or network connection.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/8eb52117b748d378325f7719554a896e37bccec7/atomics/T1105/T1105.md#atomic-test-9---windows---bitsadmin-bits-download
-- https://github.com/redcanaryco/atomic-red-team/blob/bc705cb7aaa5f26f2d96585fac8e4c7052df0ff9/atomics/T1197/T1197.md
-- https://docs.microsoft.com/en-us/windows/win32/bits/bitsadmin-tool
-- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
 tags:
   analytic_story:
   - Ingress Tool Transfer
@@ -58,39 +56,38 @@ tags:
   - T1105
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
index 091aa6f61e..0699829edb 100644
--- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml
@@ -1,11 +1,7 @@
-name: CertUtil Download With URLCache and Split Arguments
-id: 415b4306-8bfb-11eb-85c4-acde48001122
-version: 3
-date: '2022-02-03'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-02-03'
 description: Certutil.exe may download a file from a remote destination using `-urlcache`.
   This behavior does require a URL to be passed on the command-line. In addition,
   `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
@@ -13,23 +9,25 @@ description: Certutil.exe may download a file from a remote destination using `-
   However, it is uncommon for `certutil.exe` to write files to world writeable paths.\
   During triage, capture any files on disk and review. Review the reputation of the
   remote IP or domain in question.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 415b4306-8bfb-11eb-85c4-acde48001122
+known_false_positives: Limited false positives in most environments, however tune
+  as needed based on parent-child relationship or network connection.
+name: CertUtil Download With URLCache and Split Arguments
+references:
+- https://attack.mitre.org/techniques/T1105/
+- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
+- https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*urlcache*
   Processes.process=*split*) OR Processes.process=*urlcache* by Processes.dest Processes.user
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.original_file_name Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_urlcache_and_split_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives in most environments, however tune
-  as needed based on parent-child relationship or network connection.
-references:
-- https://attack.mitre.org/techniques/T1105/
-- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
-- https://www.fireeye.com/blog/threat-research/2019/10/certutil-qualms-they-came-to-drop-fombs.html
 tags:
   analytic_story:
   - Ingress Tool Transfer
@@ -50,39 +48,38 @@ tags:
   - T1105
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 90
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 3
diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
index aa671b6eb9..7bd1844a77 100644
--- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
+++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml
@@ -1,11 +1,7 @@
-name: CertUtil Download With VerifyCtl and Split Arguments
-id: 801ad9e4-8bfb-11eb-8b31-acde48001122
-version: 3
-date: '2022-02-03'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-02-03'
 description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`.
   This behavior does require a URL to be passed on the command-line. In addition,
   `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will
@@ -13,24 +9,26 @@ description: 'Certutil.exe may download a file from a remote destination using `
   \ During triage, capture any files on disk and review. Review the reputation of
   the remote IP or domain in question. Using `-VerifyCtl`, the file will either be
   written to the current working directory or `%APPDATA%\..\LocalLow\Microsoft\CryptnetUrlCache\Content\<hash>`. '
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 801ad9e4-8bfb-11eb-8b31-acde48001122
+known_false_positives: Limited false positives in most environments, however tune
+  as needed based on parent-child relationship or network connection.
+name: CertUtil Download With VerifyCtl and Split Arguments
+references:
+- https://attack.mitre.org/techniques/T1105/
+- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl
+- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_certutil` (Processes.process=*verifyctl*
   Processes.process=*split*) OR Processes.process=*verifyctl* by Processes.dest Processes.user
   Processes.original_file_name Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_download_with_verifyctl_and_split_arguments_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives in most environments, however tune
-  as needed based on parent-child relationship or network connection.
-references:
-- https://attack.mitre.org/techniques/T1105/
-- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin/
-- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#-verifyctl
-- https://www.avira.com/en/blog/certutil-abused-by-attackers-to-spread-threats
 tags:
   analytic_story:
   - Ingress Tool Transfer
@@ -51,39 +49,38 @@ tags:
   - T1105
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 90
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 3
diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml
index 45ba783055..99573db8d9 100644
--- a/detections/endpoint/certutil_exe_certificate_extraction.yml
+++ b/detections/endpoint/certutil_exe_certificate_extraction.yml
@@ -1,26 +1,24 @@
-name: Certutil exe certificate extraction
-id: 337a46be-600f-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-26'
 author: Rod Soto, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-01-26'
 description: This search looks for arguments to certutil.exe indicating the manipulation
   or extraction of Certificate. This certificate can then be used to sign new authentication
   tokens specially inside Federated environments such as Windows ADFS.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 337a46be-600f-11eb-ae93-0242ac130002
+known_false_positives: Unless there are specific use cases, manipulating or exporting
+  certificates using certutil is uncommon. Extraction of certificate has been observed
+  during attacks such as Golden SAML and other campaigns targeting Federated services.
+name: Certutil exe certificate extraction
+references: []
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe
   Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `certutil_exe_certificate_extraction_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Unless there are specific use cases, manipulating or exporting
-  certificates using certutil is uncommon. Extraction of certificate has been observed
-  during attacks such as Golden SAML and other campaigns targeting Federated services.
-references: []
 tags:
   analytic_story:
   - Windows Persistence Techniques
@@ -40,39 +38,37 @@ tags:
     on endpoint $dest$ by user $user$ attempting export a certificate.
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml
index 9a0cfa8f5d..edd1b7dd16 100644
--- a/detections/endpoint/certutil_with_decode_argument.yml
+++ b/detections/endpoint/certutil_with_decode_argument.yml
@@ -1,11 +1,7 @@
-name: CertUtil With Decode Argument
-id: bfe94226-8c10-11eb-a4b3-acde48001122
-version: 2
-date: '2021-03-23'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-03-23'
 description: CertUtil.exe may be used to `encode` and `decode` a file, including PE
   and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----`
   and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded
@@ -14,24 +10,26 @@ description: CertUtil.exe may be used to `encode` and `decode` a file, including
   and `decodehex`. Similarly, the file will be encoded in HEX and later decoded for
   further execution. During triage, identify the source of the file being decoded.
   Review its contents or execution behavior for further analysis.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*decode*
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_with_decode_argument_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: bfe94226-8c10-11eb-a4b3-acde48001122
 known_false_positives: Typically seen used to `encode` files, but it is possible to
   see legitimate use of `decode`. Filter based on parent-child relationship, file
   paths, endpoint or user.
+name: CertUtil With Decode Argument
 references:
 - https://attack.mitre.org/techniques/T1140/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1140/T1140.md
 - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
 - https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_certutil` Processes.process=*decode*
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `certutil_with_decode_argument_filter`'
 tags:
   analytic_story:
   - Deobfuscate-Decode Files or Information
@@ -51,39 +49,37 @@ tags:
   - T1140
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 40
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml
index 282c29c085..ca01acdb60 100644
--- a/detections/endpoint/change_default_file_association.yml
+++ b/detections/endpoint/change_default_file_association.yml
@@ -1,31 +1,29 @@
-name: Change Default File Association
-id: 462d17d8-1f71-11ec-ad07-acde48001122
-version: 1
-date: '2021-09-27'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Registry
+date: '2021-09-27'
 description: This analytic is developed to detect suspicious registry modification
   to change the default file association of windows to malicious payload. This techninique
   was seen in some APT where it modify the default process to run file association,
   like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other
   payload that will load malicious command to the compromised host.
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
-  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
-  ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest  Registry.user
-  Registry.registry_path Registry.registry_key_name Registry.registry_value_name |
-  `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
-  | `change_default_file_association_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response
   product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
   used for this search is typically generated via logs that report reads and writes
   to the registry.
+id: 462d17d8-1f71-11ec-ad07-acde48001122
 known_false_positives: unknown
+name: Change Default File Association
 references:
 - https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
+  ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest  Registry.user
+  Registry.registry_path Registry.registry_key_name Registry.registry_value_name |
+  `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
+  | `change_default_file_association_filter`'
 tags:
   analytic_story:
   - Windows Persistence Techniques
@@ -46,25 +44,27 @@ tags:
   - T1546
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/change_to_safe_mode_with_network_config.yml b/detections/endpoint/change_to_safe_mode_with_network_config.yml
index 90f758f46d..0237e8d089 100644
--- a/detections/endpoint/change_to_safe_mode_with_network_config.yml
+++ b/detections/endpoint/change_to_safe_mode_with_network_config.yml
@@ -1,30 +1,28 @@
-name: Change To Safe Mode With Network Config
-id: 81f1dce0-0f18-11ec-a5d7-acde48001122
-version: 1
-date: '2021-09-06'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-06'
 description: This search is to detect a suspicious bcdedit commandline to configure
   the host to boot in safe mode with network config. This technique was seen in blackMatter
   ransomware where it force the compromised host to boot in safe mode to continue
   its encryption and bring back to normal boot using bcdedit deletevalue command.
   This TTP can be a good alert for host that booted from safe mode forcefully since
   it need to modify the boot configuration to bring it back to normal.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+id: 81f1dce0-0f18-11ec-a5d7-acde48001122
+known_false_positives: unknown
+name: Change To Safe Mode With Network Config
+references:
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = bcdedit.exe
   Processes.process="*/set*" Processes.process="*{current}*"  Processes.process="*safeboot*"
   Processes.process="*network*" by Processes.process_name Processes.process Processes.parent_process_name
   Processes.dest Processes.user |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `change_to_safe_mode_with_network_config_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: unknown
-references:
-- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
 tags:
   analytic_story:
   - BlackMatter Ransomware
@@ -43,26 +41,27 @@ tags:
   - T1490
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.dest
-  - Processes.user
   risk_score: 25
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml
index dabadf67ed..1099b06df8 100644
--- a/detections/endpoint/chcp_command_execution.yml
+++ b/detections/endpoint/chcp_command_execution.yml
@@ -1,29 +1,27 @@
-name: CHCP Command Execution
-id: 21d236ec-eec1-11eb-b23e-acde48001122
-version: 1
-date: '2021-07-27'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-07-27'
 description: This search is to detect execution of chcp.exe application. this utility
   is used to change the active code page of the console. This technique was seen in
   icedid malware to know the locale region/language/country of the compromise host.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed chcp.com may be used.
+id: 21d236ec-eec1-11eb-b23e-acde48001122
+known_false_positives: other tools or script may used this to change code page to
+  UTF-* or others
+name: CHCP Command Execution
+references:
+- https://ss64.com/nt/chcp.html
+- https://twitter.com/tccontre18/status/1419941156633329665?s=20
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com
   Processes.parent_process_name = cmd.exe Processes.parent_process=*/c* by  Processes.process_name
   Processes.process Processes.parent_process_name Processes.parent_process Processes.process_id
   Processes.parent_process_id Processes.dest Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `chcp_command_execution_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed chcp.com may be used.
-known_false_positives: other tools or script may used this to change code page to
-  UTF-* or others
-references:
-- https://ss64.com/nt/chcp.html
-- https://twitter.com/tccontre18/status/1419941156633329665?s=20
 tags:
   analytic_story:
   - IcedID
@@ -43,26 +41,36 @@ tags:
   - T1059
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - process_name
-  - process
-  - parent_process_name
-  - parent_process
-  - process_id
-  - parent_process_id
   - dest
+  - parent_process
+  - parent_process_id
+  - parent_process_name
+  - process
+  - process_id
+  - process_name
   - user
   risk_score: 9
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml
index 20d3b7f612..5d9053aa46 100644
--- a/detections/endpoint/check_elevated_cmd_using_whoami.yml
+++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml
@@ -1,11 +1,7 @@
-name: Check Elevated CMD using whoami
-id: a9079b18-1633-11ec-859c-acde48001122
-version: 1
-date: '2021-09-15'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-15'
 description: This search is to detect a suspicious whoami execution to check if the
   cmd or shell instance process is with elevated privileges. This technique was seen
   in FIN7 js implant where it execute this as part of its data collection to the infected
@@ -13,18 +9,20 @@ description: This search is to detect a suspicious whoami execution to check if
   really a good alert for known attacker that recon on the targetted host. This command
   is not so commonly executed by a normal user or even an admin to check if a process
   is elevated.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+id: a9079b18-1633-11ec-859c-acde48001122
+known_false_positives: unknown
+name: Check Elevated CMD using whoami
+references: []
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where  Processes.process = "*whoami*"
   Processes.process = "*/group*" Processes.process = "* find *" Processes.process
   = "*12288*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `check_elevated_cmd_using_whoami_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: unknown
-references: []
 tags:
   analytic_story:
   - FIN7
@@ -43,27 +41,29 @@ tags:
   - T1033
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process_id
-  - Processes.process
-  - Processes.dest
-  - Processes.user
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml
index 5f95a83096..ac81cdbde5 100644
--- a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml
+++ b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml
@@ -1,27 +1,25 @@
-name: Clear Unallocated Sector Using Cipher App
-id: cd80a6ac-c9d9-11eb-8839-acde48001122
-version: 1
-date: '2021-06-10'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-06-10'
 description: this search is to detect execution of `cipher.exe` to clear the unallocated
   sectors of a specific disk. This technique was seen in some ransomware to make it
   impossible to forensically recover deleted files.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: cd80a6ac-c9d9-11eb-8839-acde48001122
+known_false_positives: administrator may execute this app to manage disk
+name: Clear Unallocated Sector Using Cipher App
+references:
+- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/
+- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cipher.exe"
   Processes.process = "*/w:*" by Processes.parent_process_name Processes.parent_process
   Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `clear_unallocated_sector_using_cipher_app_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: administrator may execute this app to manage disk
-references:
-- https://unit42.paloaltonetworks.com/vatet-pyxie-defray777/3/
-- https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/sophoslabs-ransomware-behavior-report.pdf
 tags:
   analytic_story:
   - Ransomware
@@ -43,39 +41,38 @@ tags:
   - T1070
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 90
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/clop_common_exec_parameter.yml b/detections/endpoint/clop_common_exec_parameter.yml
index ea8701cc6e..7aaf32686e 100644
--- a/detections/endpoint/clop_common_exec_parameter.yml
+++ b/detections/endpoint/clop_common_exec_parameter.yml
@@ -1,11 +1,7 @@
-name: Clop Common Exec Parameter
-id: 5a8a2a72-8322-11eb-9ee9-acde48001122
-version: 1
-date: '2021-03-17'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-03-17'
 description: The following analytics are designed to identifies some CLOP ransomware
   variant that using arguments to execute its main code or feature of its code. In
   this variant if the parameter is "runrun", CLOP ransomware will try to encrypt files
@@ -13,6 +9,15 @@ description: The following analytics are designed to identifies some CLOP ransom
   pipe or file start encrypting files within the infected local machines. This technique
   can be also identified as an anti-sandbox technique to make its code non-responsive
   since it is waiting for some parameter to execute properly.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 5a8a2a72-8322-11eb-9ee9-acde48001122
+known_false_positives: Operators can execute third party tools using these parameters.
+name: Clop Common Exec Parameter
+references:
+- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
+- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
 search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline
   values(Processes.parent_process_name) as parent_process values(Processes.process_name)
   count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
@@ -20,13 +25,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   = "*temp.dat*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_common_exec_parameter_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Operators can execute third party tools using these parameters.
-references:
-- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
-- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
 tags:
   analytic_story:
   - Clop Ransomware
@@ -47,39 +45,38 @@ tags:
   - T1204
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 100
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/clop_ransomware_known_service_name.yml b/detections/endpoint/clop_ransomware_known_service_name.yml
index 3fd889e83f..fb451606ea 100644
--- a/detections/endpoint/clop_ransomware_known_service_name.yml
+++ b/detections/endpoint/clop_ransomware_known_service_name.yml
@@ -1,26 +1,23 @@
-name: Clop Ransomware Known Service Name
-id: 07e08a12-870c-11eb-b5f9-acde48001122
-version: 1
-date: '2021-03-17'
 author: Teoderick Contreras
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-03-17'
 description: This detection is to identify the common service name created by the
   CLOP ransomware as part of its persistence and high privilege code execution in
   the infected machine. Ussually CLOP ransomware use StartServiceCtrlDispatcherW API
   in creating this service entry.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the Service name, Service File Name Service Start type, and Service Type
+  from your endpoints.
+id: 07e08a12-870c-11eb-b5f9-acde48001122
+known_false_positives: unknown
+name: Clop Ransomware Known Service Name
+references:
+- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
+- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
 search: '`wineventlog_system` EventCode=7045 Service_Name IN ("SecurityCenterIBM",
   "WinCheckDRVs") | stats count min(_time) as firstTime max(_time) as lastTime by
   EventCode Service_File_Name Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `clop_ransomware_known_service_name_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the Service name, Service File Name Service Start type, and Service Type
-  from your endpoints.
-known_false_positives: unknown
-references:
-- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
-- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
 tags:
   analytic_story:
   - Clop Ransomware
@@ -40,32 +37,29 @@ tags:
   - T1543
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
   - EventCode
-  - cmdline
   - _time
-  - parent_process_name
-  - process_name
-  - OriginalFileName
-  - process_path
   risk_score: 100
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
index da15eb4ccf..8a805f95b0 100644
--- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml
+++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml
@@ -1,33 +1,31 @@
-name: CMD Carry Out String Command Parameter
-id: 54a6ed00-3256-11ec-b031-acde48001122
-version: 3
-date: '2022-01-18'
 author: Teoderick Contreras, Bhavin Patel, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-01-18'
 description: The following analytic identifies command-line arguments where `cmd.exe
   /c` is used to execute a program. `cmd /c` is used to run commands in MS-DOS and
   terminate after command or process completion. This technique is commonly seen in
   adversaries and malware to execute batch command using different shell like PowerShell
   or different process other than `cmd.exe`. This is a good hunting query for suspicious
   command-line made by a script or relative process execute it.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 54a6ed00-3256-11ec-b031-acde48001122
+known_false_positives: False positives may be high based on legitimate scripted code
+  in any environment. Filter as needed.
+name: CMD Carry Out String Command Parameter
+references:
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_cmd` AND Processes.process="*
   /c *" by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `cmd_carry_out_string_command_parameter_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives may be high based on legitimate scripted code
-  in any environment. Filter as needed.
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - IcedID
@@ -53,27 +51,28 @@ tags:
   - T1059
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process_id
-  - Processes.process
-  - Processes.dest
-  - Processes.user
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 30
   security_domain: endpoint
+type: Hunting
+version: 3
diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml
index d2e19bae02..5ead19f94e 100644
--- a/detections/endpoint/cmd_echo_pipe___escalation.yml
+++ b/detections/endpoint/cmd_echo_pipe___escalation.yml
@@ -1,31 +1,29 @@
-name: CMD Echo Pipe - Escalation
-id: eb277ba0-b96b-11eb-b00e-acde48001122
-version: 2
-date: '2021-05-20'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-05-20'
 description: This analytic identifies a common behavior by Cobalt Strike and other
   frameworks where the adversary will escalate privileges, either via `jump` (Cobalt
   Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will
   look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: eb277ba0-b96b-11eb-b00e-acde48001122
+known_false_positives: Unknown. It is possible filtering may be required to ensure
+  fidelity.
+name: CMD Echo Pipe - Escalation
+references:
+- https://redcanary.com/threat-detection-report/threats/cobalt-strike/
+- https://github.com/rapid7/meterpreter/blob/master/source/extensions/priv/server/elevate/namedpipe.c
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_cmd` OR Processes.process=*%comspec%*
   (Processes.process=*echo* AND Processes.process=*pipe*) by Processes.dest Processes.user
   Processes.parent_process Processes.process_name Processes.original_file_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_echo_pipe___escalation_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Unknown. It is possible filtering may be required to ensure
-  fidelity.
-references:
-- https://redcanary.com/threat-detection-report/threats/cobalt-strike/
-- https://github.com/rapid7/meterpreter/blob/master/source/extensions/priv/server/elevate/namedpipe.c
 tags:
   analytic_story:
   - Cobalt Strike
@@ -50,39 +48,38 @@ tags:
   - T1543
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml
index ca1384fc22..69cef39240 100644
--- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml
+++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml
@@ -1,11 +1,7 @@
-name: Cmdline Tool Not Executed In CMD Shell
-id: 6c3f7dd8-153c-11ec-ac2d-acde48001122
-version: 1
-date: '2021-09-14'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-14'
 description: The following analytic identifies a non-standard parent process (not
   matching CMD, PowerShell, or Explorer) spawning `ipconfig.exe` or `systeminfo.exe`.
   This particular behavior was seen in FIN7's JSSLoader .NET payload. This is also
@@ -14,6 +10,19 @@ description: The following analytic identifies a non-standard parent process (no
   executed with a shell application or Explorer parent, and not by another application.
   This TTP is a good indicator for an adversary gathering host information, but one
   possible false positive might be an automated tool used by a system administator.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 6c3f7dd8-153c-11ec-ac2d-acde48001122
+known_false_positives: A network operator or systems administrator may utilize an
+  automated host discovery application that may generate false positives. Filter as
+  needed.
+name: Cmdline Tool Not Executed In CMD Shell
+references:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where  (Processes.process_name = "ipconfig.exe"
   OR Processes.process_name = "systeminfo.exe") AND NOT (Processes.parent_process_name
@@ -22,17 +31,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.original_file_name Processes.process_id
   Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmdline_tool_not_executed_in_cmd_shell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: A network operator or systems administrator may utilize an
-  automated host discovery application that may generate false positives. Filter as
-  needed.
-references:
-- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
-- https://attack.mitre.org/groups/G0046/
 tags:
   analytic_story:
   - FIN7
@@ -53,39 +51,38 @@ tags:
   - T1059.007
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml
index c14995c3de..68a2f8ddd1 100644
--- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml
+++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml
@@ -1,26 +1,23 @@
-name: CMLUA Or CMSTPLUA UAC Bypass
-id: f87b5062-b405-11eb-a889-acde48001122
-version: 1
-date: '2021-05-13'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-05-13'
 description: This analytic detects a potential process using COM Object like CMLUA
   or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries
   to gain administrative privileges to its running process.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and imageloaded executions from your endpoints. If you
+  are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+id: f87b5062-b405-11eb-a889-acde48001122
+known_false_positives: Legitimate windows application that are not on the list loading
+  this dll. Filter as needed.
+name: CMLUA Or CMSTPLUA UAC Bypass
+references:
+- https://attack.mitre.org/techniques/T1218/003/
 search: '`sysmon` EventCode=7  ImageLoaded IN ("*\\CMLUA.dll", "*\\CMSTPLUA.dll",
   "*\\CMLUAUTIL.dll") NOT(process_name IN("CMSTP.exe", "CMMGR32.exe")) NOT(Image IN("*\\windows\\*",
   "*\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime
   by Image ImageLoaded process_name Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `cmlua_or_cmstplua_uac_bypass_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name and imageloaded executions from your endpoints. If you
-  are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: Legitimate windows application that are not on the list loading
-  this dll. Filter as needed.
-references:
-- https://attack.mitre.org/techniques/T1218/003/
 tags:
   analytic_story:
   - DarkSide Ransomware
@@ -42,17 +39,17 @@ tags:
   - T1218.003
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: ImageLoaded
-    type: Other
     role:
     - Other
+    type: Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -68,3 +65,5 @@ tags:
   - ProcessId
   risk_score: 80
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml
index 8c69dd4cfa..5991c33c11 100644
--- a/detections/endpoint/common_ransomware_extensions.yml
+++ b/detections/endpoint/common_ransomware_extensions.yml
@@ -1,18 +1,9 @@
-name: Common Ransomware Extensions
-id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec
-version: 4
-date: '2020-11-09'
 author: David Dorsey, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2020-11-09'
 description: The search looks for file modifications with extensions commonly used
   by Ransomware
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path)
-  as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)`
-  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| rex
-  field=file_name "(?<file_extension>\.[^\.]+)$" | `ransomware_extensions` | `common_ransomware_extensions_filter`'
 how_to_implement: 'You must be ingesting data that records the filesystem activity
   from your hosts to populate the Endpoint file-system data model node. If you are
   using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
@@ -31,10 +22,17 @@ how_to_implement: 'You must be ingesting data that records the filesystem activi
 
   Detailed documentation on how to create a new field within Incident Review may be
   found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`'
+id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec
 known_false_positives: It is possible for a legitimate file with these extensions
   to be created. If this is a true ransomware attack, there will be a large number
   of files created with these extensions.
+name: Common Ransomware Extensions
 references: []
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path)
+  as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)`
+  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`| rex
+  field=file_name "(?<file_extension>\.[^\.]+)$" | `ransomware_extensions` | `common_ransomware_extensions_filter`'
 tags:
   Consequence: Data Destruction
   analytic_story:
@@ -65,26 +63,28 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: file_name
-    type: File Name
     role:
     - Victim
+    type: File Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.user
   - _time
-  - Filesystem.user
-  - Filesystem.dest
-  - Filesystem.file_path
-  - Filesystem.file_name
   risk_score: 90
   security_domain: endpoint
+type: Hunting
+version: 4
diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml
index c685c5bc5e..f813559323 100644
--- a/detections/endpoint/common_ransomware_notes.yml
+++ b/detections/endpoint/common_ransomware_notes.yml
@@ -1,26 +1,24 @@
-name: Common Ransomware Notes
-id: ada0f478-84a8-4641-a3f1-d82362d6bd71
-version: 4
-date: '2020-11-09'
 author: David Dorsey, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2020-11-09'
 description: The search looks for files created with names matching those typically
   used in ransomware notes that tell the victim how to get their data back.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path)
-  as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)`
-  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ransomware_notes`
-  | `common_ransomware_notes_filter`'
 how_to_implement: You must be ingesting data that records file-system activity from
   your hosts to populate the Endpoint Filesystem data-model node. This is typically
   populated via endpoint detection-and-response product, such as Carbon Black, or
   via other endpoint data sources, such as Sysmon. The data used for this search is
   typically generated via logs that report file-system reads and writes.
+id: ada0f478-84a8-4641-a3f1-d82362d6bd71
 known_false_positives: It's possible that a legitimate file could be created with
   the same name used by ransomware note files.
+name: Common Ransomware Notes
 references: []
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path)
+  as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)`
+  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ransomware_notes`
+  | `common_ransomware_notes_filter`'
 tags:
   Consequence: Data Destruction
   analytic_story:
@@ -50,26 +48,28 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: file_name
-    type: File Name
     role:
     - Victim
+    type: File Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.user
   - _time
-  - Filesystem.user
-  - Filesystem.dest
-  - Filesystem.file_path
-  - Filesystem.file_name
   risk_score: 90
   security_domain: endpoint
+type: Hunting
+version: 4
diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml
index 5512203ac6..208c789646 100644
--- a/detections/endpoint/conti_common_exec_parameter.yml
+++ b/detections/endpoint/conti_common_exec_parameter.yml
@@ -1,14 +1,20 @@
-name: Conti Common Exec parameter
-id: 624919bc-c382-11eb-adcc-acde48001122
-version: 1
-date: '2021-06-02'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-06-02'
 description: This search detects the suspicious commandline argument of revil ransomware
   to encrypt specific or all local drive and network shares of the compromised machine
   or host.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 624919bc-c382-11eb-adcc-acde48001122
+known_false_positives: 3rd party tool may have commandline parameter that can trigger
+  this detection.
+name: Conti Common Exec parameter
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.conti
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-m local*"
   OR Processes.process = "*-m net*" OR Processes.process = "*-m all*" OR Processes.process
@@ -16,14 +22,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `conti_common_exec_parameter_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: 3rd party tool may have commandline parameter that can trigger
-  this detection.
-references:
-- https://malpedia.caad.fkie.fraunhofer.de/details/win.conti
 tags:
   analytic_story:
   - Ransomware
@@ -44,39 +42,38 @@ tags:
   - T1204
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml
index 13e215abb1..228bd9f950 100644
--- a/detections/endpoint/control_loading_from_world_writable_directory.yml
+++ b/detections/endpoint/control_loading_from_world_writable_directory.yml
@@ -1,15 +1,27 @@
-name: Control Loading from World Writable Directory
-id: 10423ac4-10c9-11ec-8dc4-acde48001122
-version: 1
-date: '2021-09-08'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-08'
 description: The following detection identifies control.exe loading either a .cpl
   or .inf from a writable directory. This is related to CVE-2021-40444. During triage,
   review parallel processes, parent and child, for further suspicious behaviors. In
   addition, capture file modifications and analyze.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 10423ac4-10c9-11ec-8dc4-acde48001122
+known_false_positives: Limited false positives will be present as control.exe does
+  not natively load from writable paths as defined. One may add .cpl or .inf to the
+  command-line if there is any false positives. Tune as needed.
+name: Control Loading from World Writable Directory
+references:
+- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
+- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+- https://attack.mitre.org/techniques/T1218/011/
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=control.exe
   OR Processes.original_file_name=CONTROL.EXE) AND Processes.process IN ("*\\appdata\\*",
@@ -17,20 +29,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `control_loading_from_world_writable_directory_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives will be present as control.exe does
-  not natively load from writable paths as defined. One may add .cpl or .inf to the
-  command-line if there is any false positives. Tune as needed.
-references:
-- https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
-- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
-- https://attack.mitre.org/techniques/T1218/011/
-- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
 tags:
   analytic_story:
   - Microsoft MSHTML Remote Code Execution CVE-2021-40444
@@ -53,38 +51,37 @@ tags:
   - T1218.002
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
index ca3390c2f4..c22397cca3 100644
--- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
@@ -1,13 +1,18 @@
-name: Create local admin accounts using net exe
-id: b89919ed-fe5f-492c-b139-151bb162040e
-version: 6
-date: '2021-09-08'
 author: Bhavin Patel, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-08'
 description: This search looks for the creation of local administrator accounts using
   net.exe .
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+id: b89919ed-fe5f-492c-b139-151bb162040e
+known_false_positives: Administrators often leverage net.exe to create admin accounts.
+name: Create local admin accounts using net exe
+references: []
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
   user values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe
@@ -16,13 +21,6 @@ search: '| tstats `security_content_summariesonly` count values(Processes.user)
   Processes.process=*administrador* OR Processes.process=*amministratori* OR Processes.process=*administratorer*)
   by Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_local_admin_accounts_using_net_exe_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
-known_false_positives: Administrators often leverage net.exe to create admin accounts.
-references: []
 tags:
   analytic_story:
   - DHS Report TA18-074A
@@ -52,39 +50,35 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 30
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 6
diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
index af27466036..310e40f558 100644
--- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
+++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
@@ -1,28 +1,26 @@
-name: Create or delete windows shares using net exe
-id: qw9919ed-fe5f-492c-b139-151bb162140e
-version: 6
-date: '2020-09-16'
 author: Bhavin Patel, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-09-16'
 description: This search looks for the creation or deletion of hidden shares using
   net.exe.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: qw9919ed-fe5f-492c-b139-151bb162140e
+known_false_positives: Administrators often leverage net.exe to create or delete network
+  shares. You should verify that the activity was intentional and is legitimate.
+name: Create or delete windows shares using net exe
+references:
+- https://attack.mitre.org/techniques/T1070/005
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
   user values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by
   Processes.process Processes.process_name Processes.original_file_name Processes.dest
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | search process=*share* | `create_or_delete_windows_shares_using_net_exe_filter` '
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Administrators often leverage net.exe to create or delete network
-  shares. You should verify that the activity was intentional and is legitimate.
-references:
-- https://attack.mitre.org/techniques/T1070/005
 tags:
   analytic_story:
   - Hidden Cobra Malware
@@ -49,39 +47,36 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 6
diff --git a/detections/endpoint/create_remote_thread_in_shell_application.yml b/detections/endpoint/create_remote_thread_in_shell_application.yml
index b3d17dfb23..786a1997ea 100644
--- a/detections/endpoint/create_remote_thread_in_shell_application.yml
+++ b/detections/endpoint/create_remote_thread_in_shell_application.yml
@@ -1,26 +1,23 @@
-name: Create Remote Thread In Shell Application
-id: 10399c1e-f51e-11eb-b920-acde48001122
-version: 1
-date: '2021-08-04'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-08-04'
 description: This search is to detect suspicious process injection in command shell.
   This technique was seen in IcedID where it execute cmd.exe process to inject its
   shellcode as part of its execution as banking trojan. It is really uncommon to have
   a create remote thread execution in the following application.
-search: '`sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*") | stats
-  count min(_time) as firstTime max(_time) as lastTime by  TargetImage TargetProcessId
-  SourceProcessId  EventCode StartAddress SourceImage Computer | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `create_remote_thread_in_shell_application_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
+id: 10399c1e-f51e-11eb-b920-acde48001122
 known_false_positives: unknown
+name: Create Remote Thread In Shell Application
 references:
 - https://thedfirreport.com/2021/07/19/icedid-and-cobalt-strike-vs-antivirus/
+search: '`sysmon` EventCode=8 TargetImage IN ("*\\cmd.exe", "*\\powershell*") | stats
+  count min(_time) as firstTime max(_time) as lastTime by  TargetImage TargetProcessId
+  SourceProcessId  EventCode StartAddress SourceImage Computer | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `create_remote_thread_in_shell_application_filter`'
 tags:
   analytic_story:
   - IcedID
@@ -40,13 +37,13 @@ tags:
   - T1055
   observable:
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: SourceImage
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -62,3 +59,5 @@ tags:
   - Computer
   risk_score: 70
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml
index bc3f53bc27..d0dcabc882 100644
--- a/detections/endpoint/creation_of_shadow_copy.yml
+++ b/detections/endpoint/creation_of_shadow_copy.yml
@@ -1,13 +1,19 @@
-name: Creation of Shadow Copy
-id: eb120f5f-b879-4a63-97c1-93352b5df844
-version: 1
-date: '2019-12-10'
 author: Patrick Bareiss, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2019-12-10'
 description: Monitor for signs that Vssadmin or Wmic has been used to create a shadow
   copy.
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints, to populate the Endpoint
+  data model in the Processes node. The command-line arguments are mapped to the "process"
+  field in the Endpoint data model.
+id: eb120f5f-b879-4a63-97c1-93352b5df844
+known_false_positives: Legitimate administrator usage of Vssadmin or Wmic will create
+  false positives.
+name: Creation of Shadow Copy
+references:
+- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe
   Processes.process=*create* Processes.process=*shadow*) OR (Processes.process_name=wmic.exe
@@ -15,14 +21,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process  Processes.parent_process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `creation_of_shadow_copy_filter`'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints, to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
-known_false_positives: Legitimate administrator usage of Vssadmin or Wmic will create
-  false positives.
-references:
-- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
 tags:
   analytic_story:
   - Credential Dumping
@@ -50,39 +48,37 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 81
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
index 52b61c246c..0bc189b22c 100644
--- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
+++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
@@ -1,26 +1,24 @@
-name: Creation of Shadow Copy with wmic and powershell
-id: 2ed8b538-d284-449a-be1d-82ad1dbd186b
-version: 3
-date: '2021-09-16'
 author: Patrick Bareiss, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: This search detects the use of wmic and Powershell to create a shadow
   copy.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_wmic` OR `process_powershell`
-  Processes.process=*shadowcopy* Processes.process=*create* by Processes.user Processes.process_name
-  Processes.original_file_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_with_wmic_and_powershell_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: 2ed8b538-d284-449a-be1d-82ad1dbd186b
 known_false_positives: Legtimate administrator usage of wmic to create a shadow copy.
+name: Creation of Shadow Copy with wmic and powershell
 references:
 - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_wmic` OR `process_powershell`
+  Processes.process=*shadowcopy* Processes.process=*create* by Processes.user Processes.process_name
+  Processes.original_file_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_with_wmic_and_powershell_filter`'
 tags:
   analytic_story:
   - Credential Dumping
@@ -48,39 +46,35 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 81
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 3
diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
index 982bb93c5f..fa24020601 100644
--- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
+++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml
@@ -1,13 +1,19 @@
-name: Credential Dumping via Copy Command from Shadow Copy
-id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b
-version: 2
-date: '2021-09-16'
 author: Patrick Bareiss, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: This search detects credential dumping using copy command from a shadow
   copy.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b
+known_false_positives: unknown
+name: Credential Dumping via Copy Command from Shadow Copy
+references:
+- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_cmd` (Processes.process=*\\system32\\config\\sam*
   OR Processes.process=*\\system32\\config\\security* OR Processes.process=*\\system32\\config\\system*
@@ -15,14 +21,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process  Processes.parent_process Processes.original_file_name
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_copy_command_from_shadow_copy_filter` '
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: unknown
-references:
-- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
 tags:
   analytic_story:
   - Credential Dumping
@@ -50,39 +48,38 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 81
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
index e7e11cc09c..c939bf7054 100644
--- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
+++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
@@ -1,26 +1,24 @@
-name: Credential Dumping via Symlink to Shadow Copy
-id: c5eac648-fae0-4263-91a6-773df1f4c903
-version: 2
-date: '2021-09-16'
 author: Patrick Bareiss, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: This search detects the creation of a symlink to a shadow copy.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: c5eac648-fae0-4263-91a6-773df1f4c903
+known_false_positives: unknown
+name: Credential Dumping via Symlink to Shadow Copy
+references:
+- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*mklink*
   Processes.process=*HarddiskVolumeShadowCopy* by Processes.dest Processes.user Processes.process_name
   Processes.process  Processes.parent_process Processes.original_file_name Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: unknown
-references:
-- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
 tags:
   analytic_story:
   - Credential Dumping
@@ -48,39 +46,38 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 81
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/csc_net_on_the_fly_compilation.yml b/detections/endpoint/csc_net_on_the_fly_compilation.yml
index 416939c42f..9eacb239e9 100644
--- a/detections/endpoint/csc_net_on_the_fly_compilation.yml
+++ b/detections/endpoint/csc_net_on_the_fly_compilation.yml
@@ -1,11 +1,7 @@
-name: CSC Net On The Fly Compilation
-id: ea73128a-43ab-11ec-9753-acde48001122
-version: 1
-date: '2021-11-12'
 author: Teoderick Contreras, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-12'
 description: this analytic is to detect a suspicious compile before delivery approach
   of .net compiler csc.exe. This technique was seen in several adversaries, malware
   and even in red teams to take advantage the csc.exe .net compiler tool to compile
@@ -14,6 +10,19 @@ description: this analytic is to detect a suspicious compile before delivery app
   event and check the file path that passed to csc.exe which is the .net code. Aside
   from that, powershell is capable of using this compiler in executing .net code in
   a powershell script so filter on that case is needed.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: ea73128a-43ab-11ec-9753-acde48001122
+known_false_positives: A network operator or systems administrator may utilize an
+  automated powershell script taht execute .net code that may generate false positive.
+  filter is needed.
+name: CSC Net On The Fly Compilation
+references:
+- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/
+- https://tccontre.blogspot.com/2019/06/maicious-macro-that-compile-c-code-as.html
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_csc` Processes.process
   = "*/noconfig*" Processes.process = "*/fullpaths*" Processes.process = "*@*" by
@@ -21,17 +30,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `csc_net_on_the_fly_compilation_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: A network operator or systems administrator may utilize an
-  automated powershell script taht execute .net code that may generate false positive.
-  filter is needed.
-references:
-- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/
-- https://tccontre.blogspot.com/2019/06/maicious-macro-that-compile-c-code-as.html
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -51,22 +49,24 @@ tags:
   - T1027
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/curl_download_and_bash_execution.yml b/detections/endpoint/curl_download_and_bash_execution.yml
index fc436a3232..7683a48f34 100644
--- a/detections/endpoint/curl_download_and_bash_execution.yml
+++ b/detections/endpoint/curl_download_and_bash_execution.yml
@@ -1,32 +1,30 @@
-name: Curl Download and Bash Execution
-id: 900bc324-59f3-11ec-9fb4-acde48001122
-version: 1
-date: '2021-12-10'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-10'
 description: The following analytic identifies the use of curl on Linux or MacOS attempting
   to download a file from a remote source and pipe it to bash. This is typically found
   with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl
-  (Processes.process="*-s *") OR (Processes.process="*|*" AND Processes.process="*bash*")
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `curl_download_and_bash_execution_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is
   occurring correctly. If the EDR is not parsing the pipe bash in the command-line,
   modifying the analytic will be required. Add parent process name (Processes.parent_process_name)
   as needed to filter.
+id: 900bc324-59f3-11ec-9fb4-acde48001122
 known_false_positives: False positives should be limited, however filtering may be
   required.
+name: Curl Download and Bash Execution
 references:
 - https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java
 - https://www.lunasec.io/docs/blog/log4j-zero-day/
 - https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl
+  (Processes.process="*-s *") OR (Processes.process="*|*" AND Processes.process="*bash*")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `curl_download_and_bash_execution_filter`'
 tags:
   analytic_story:
   - Ingress Tool Transfer
@@ -48,32 +46,31 @@ tags:
   - T1105
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml
index 7349f7bf96..b8ac403b35 100644
--- a/detections/endpoint/delete_shadowcopy_with_powershell.yml
+++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml
@@ -1,27 +1,24 @@
-name: Delete ShadowCopy With PowerShell
-id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122
-version: 1
-date: '2021-05-12'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-05-12'
 description: This following analytic detects PowerShell command to delete shadow copy
   using the WMIC PowerShell module. This technique was seen used by a recent adversary
   to deploy DarkSide Ransomware where it executed a child process of PowerShell to
   execute a hex encoded command to delete shadow copy. This hex encoded command was
   able to be decrypted by PowerShell log.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the powershell logs  from your endpoints. make sure you enable needed
+  registry to monitor this event.
+id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122
+known_false_positives: unknown
+name: Delete ShadowCopy With PowerShell
+references:
+- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+- https://searchwindowsserver.techtarget.com/tutorial/Set-up-PowerShell-script-block-logging-for-added-security
 search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*"
   OR Message = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime
   by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `delete_shadowcopy_with_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the powershell logs  from your endpoints. make sure you enable needed
-  registry to monitor this event.
-known_false_positives: unknown
-references:
-- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
-- https://searchwindowsserver.techtarget.com/tutorial/Set-up-PowerShell-script-block-logging-for-added-security
 tags:
   analytic_story:
   - DarkSide Ransomware
@@ -43,13 +40,13 @@ tags:
   - T1490
   observable:
   - name: User
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: ComputerName
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -62,3 +59,5 @@ tags:
   - User
   risk_score: 81
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml
index 4e4527f998..7e7a7c30f7 100644
--- a/detections/endpoint/deleting_of_net_users.yml
+++ b/detections/endpoint/deleting_of_net_users.yml
@@ -1,17 +1,24 @@
-name: Deleting Of Net Users
-id: 1c8c6f66-acce-11eb-aafb-acde48001122
-version: 2
-date: '2021-05-04'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-05-04'
 description: This analytic will detect a suspicious net.exe/net1.exe command-line
   to delete a user on a system. This technique may be use by an administrator for
   legitimate purposes, however this behavior has been used in the wild to impair some
   user or deleting adversaries tracks created during its lateral movement additional
   systems. During triage, review parallel processes for additional behavior. Identify
   any other user accounts created before or after.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 1c8c6f66-acce-11eb-aafb-acde48001122
+known_false_positives: System administrators or scripts may delete user accounts via
+  this technique. Filter as needed.
+name: Deleting Of Net Users
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.parent_process) as parent_process values(Processes.process_id)
   as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
@@ -19,15 +26,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   by  Processes.process_name Processes.original_file_name Processes.dest Processes.user
   Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `deleting_of_net_users_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: System administrators or scripts may delete user accounts via
-  this technique. Filter as needed.
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   analytic_story:
   - XMRig
@@ -47,39 +45,38 @@ tags:
   - T1531
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml
index 99741805d5..c030d30b4a 100644
--- a/detections/endpoint/deleting_shadow_copies.yml
+++ b/detections/endpoint/deleting_shadow_copies.yml
@@ -1,14 +1,20 @@
-name: Deleting Shadow Copies
-id: b89919ed-ee5f-492c-b139-95dbb162039e
-version: 4
-date: '2020-11-09'
 author: David Dorsey, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-11-09'
 description: The vssadmin.exe utility is used to interact with the Volume Shadow Copy
   Service.  Wmic is an interface to the Windows Management Instrumentation.  This
   search looks for either of these tools being used to delete shadow copies.
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints to populate the Endpoint
+  data model in the Processes node. The command-line arguments are mapped to the "process"
+  field in the Endpoint data model.
+id: b89919ed-ee5f-492c-b139-95dbb162039e
+known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped
+  with modern versions of windows. They may be used by administrators to legitimately
+  delete old backup copies, although this is typically rare.
+name: Deleting Shadow Copies
+references: []
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe
@@ -16,14 +22,6 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `deleting_shadow_copies_filter`'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
-known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped
-  with modern versions of windows. They may be used by administrators to legitimately
-  delete old backup copies, although this is typically rare.
-references: []
 tags:
   analytic_story:
   - Windows Log Manipulation
@@ -54,39 +52,36 @@ tags:
   - PR.IP
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 81
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 4
diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml
index 2c4baed941..9578ef364c 100644
--- a/detections/endpoint/detect_azurehound_command_line_arguments.yml
+++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml
@@ -1,30 +1,28 @@
-name: Detect AzureHound Command-Line Arguments
-id: 26f02e96-c300-11eb-b611-acde48001122
-version: 1
-date: '2021-06-01'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-06-01'
 description: The following analytic identifies the common command-line argument used
   by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may
   be modified, but these changes are dependent upon the operator. In most instances
   the defaults are used. This analytic works to identify the common command-line attributes
   used. It does not cover the entirety of every argument in order to avoid false positives.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*invoke-azurehound*")
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_azurehound_command_line_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 26f02e96-c300-11eb-b611-acde48001122
 known_false_positives: Unknown.
+name: Detect AzureHound Command-Line Arguments
 references:
 - https://attack.mitre.org/software/S0521/
 - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
 - https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350
 - https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/AzureHound.ps1
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*invoke-azurehound*")
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_azurehound_command_line_arguments_filter`'
 tags:
   analytic_story:
   - Discovery Techniques
@@ -50,39 +48,37 @@ tags:
   - T1069
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml
index 3b77169959..4c430c03d7 100644
--- a/detections/endpoint/detect_azurehound_file_modifications.yml
+++ b/detections/endpoint/detect_azurehound_file_modifications.yml
@@ -1,11 +1,7 @@
-name: Detect AzureHound File Modifications
-id: 1c34549e-c31b-11eb-996b-acde48001122
-version: 1
-date: '2021-06-01'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2021-06-01'
 description: The following analytic is similar to SharpHound file modifications, but
   this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound
   equivilent but for Azure. It's possible this may never be seen in an environment
@@ -13,21 +9,23 @@ description: The following analytic is similar to SharpHound file modifications,
   zip file with a similar name will drop `20210601090751-azurecollection.zip`. In
   addition to the zip, multiple .json files will be written to disk, which are in
   the zip.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on file modifications that include the name of the process, and file, responsible
+  for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem`
+  node.
+id: 1c34549e-c31b-11eb-996b-acde48001122
+known_false_positives: False positives should be limited as the analytic is specific
+  to a filename with extension .zip. Filter as needed.
+name: Detect AzureHound File Modifications
+references:
+- https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350
+- https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Collectors/AzureHound.ps1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*-azurecollection.zip",
   "*-azprivroleadminrights.json", "*-azglobaladminrights.json", "*-azcloudappadmins.json",
   "*-azapplicationadmins.json") by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name
   Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `detect_azurehound_file_modifications_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on file modifications that include the name of the process, and file, responsible
-  for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem`
-  node.
-known_false_positives: False positives should be limited as the analytic is specific
-  to a filename with extension .zip. Filter as needed.
-references:
-- https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350
-- https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Collectors/AzureHound.ps1
 tags:
   analytic_story:
   - Discovery Techniques
@@ -53,27 +51,34 @@ tags:
   - T1069
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: file_name
-    type: File Name
     role:
     - Victim
+    type: File Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.process_id
   - _time
-  - file_path
   - dest
-  - file_name
-  - process_id
   - file_create_time
+  - file_name
+  - file_path
+  - process_id
   risk_score: 63
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml
index 6f4faf640f..c052c19b7c 100644
--- a/detections/endpoint/detect_excessive_user_account_lockouts.yml
+++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml
@@ -1,25 +1,23 @@
-name: Detect Excessive User Account Lockouts
-id: 95a7f9a5-6096-437e-a19e-86f42ac609bd
-version: 3
-date: '2020-07-21'
 author: David Dorsey, Splunk
-type: Anomaly
 datamodel:
-- Change
+- Change.All_Changes
+date: '2020-07-21'
 description: This search detects user accounts that have been locked out a relatively
   high number of times in a short period.
+how_to_implement: ou must ingest your Windows security event logs in the `Change`
+  datamodel under the nodename is `Account_Management`, for this search to execute
+  successfully. Please consider updating the cron schedule and the count of lockouts
+  you want to monitor, according to your environment.
+id: 95a7f9a5-6096-437e-a19e-86f42ac609bd
+known_false_positives: It is possible that a legitimate user is experiencing an issue
+  causing multiple account login failures leading to lockouts.
+name: Detect Excessive User Account Lockouts
+references: []
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Change.All_Changes where nodename=All_Changes.Account_Management
   All_Changes.result="lockout" by All_Changes.user All_Changes.result |`drop_dm_object_name("All_Changes")`
   |`drop_dm_object_name("Account_Management")`| `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | search count > 5 | `detect_excessive_user_account_lockouts_filter`'
-how_to_implement: ou must ingest your Windows security event logs in the `Change`
-  datamodel under the nodename is `Account_Management`, for this search to execute
-  successfully. Please consider updating the cron schedule and the count of lockouts
-  you want to monitor, according to your environment.
-known_false_positives: It is possible that a legitimate user is experiencing an issue
-  causing multiple account login failures leading to lockouts.
-references: []
 tags:
   analytic_story:
   - Account Monitoring and Controls
@@ -44,21 +42,23 @@ tags:
   - PR.IP
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: result
-    type: Other
     role:
     - Victim
+    type: Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Change.All_Changes.result
+  - Change.All_Changes.user
   - _time
-  - All_Changes.result
   - nodename
-  - All_Changes.user
   risk_score: 36
   security_domain: access
+type: Anomaly
+version: 3
diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml
index 5795b04f12..ce405d3965 100644
--- a/detections/endpoint/detect_exchange_web_shell.yml
+++ b/detections/endpoint/detect_exchange_web_shell.yml
@@ -1,11 +1,8 @@
-name: Detect Exchange Web Shell
-id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a
-version: 3
-date: '2021-10-05'
 author: Michael Haag, Shannon Davis, David Dorsey, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+- Endpoint.Processes
+date: '2021-10-05'
 description: 'The following query identifies suspicious .aspx created in 3 paths identified
   by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM
   group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`,
@@ -25,6 +22,20 @@ description: 'The following query identifies suspicious .aspx created in 3 paths
   untenable. However, using the asset information to limit this analytic to just the
   Exchange servers will reduce the noise allowing the hunter to focus only on the
   systems where this behavioral change is relevant.'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem`
+  node.
+id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a
+known_false_positives: The query is structured in a way that `action` (read, create)
+  is not defined. Review the results of this query, filter, and tune as necessary.
+  It may be necessary to generate this query specific to your endpoint product.
+name: Detect Exchange Web Shell
+references:
+- https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv
+- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
+- https://www.youtube.com/watch?v=FC6iHw258RI
+- https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where Processes.process_name=System  by _time span=1h Processes.process_id Processes.process_name
   Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
@@ -35,18 +46,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time
   file_name file_path process_name process_path process] | dedup file_create_time
   | table dest file_create_time, file_name, file_path, process_name | `detect_exchange_web_shell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem`
-  node.
-known_false_positives: The query is structured in a way that `action` (read, create)
-  is not defined. Review the results of this query, filter, and tune as necessary.
-  It may be necessary to generate this query specific to your endpoint product.
-references:
-- https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv
-- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
-- https://www.youtube.com/watch?v=FC6iHw258RI
-- https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do
 tags:
   analytic_story:
   - HAFNIUM Group
@@ -70,29 +69,33 @@ tags:
   - T1190
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: file_name
-    type: File Name
     role:
     - Victim
+    type: File Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
   - _time
-  - Filesystem.file_path
-  - Filesystem.process_id
-  - Filesystem.file_name
-  - Filesystem.file_hash
-  - Filesystem.user
   risk_score: 81
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 3
diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml
index 12d0f3ca29..3eb8197eb6 100644
--- a/detections/endpoint/detect_html_help_renamed.yml
+++ b/detections/endpoint/detect_html_help_renamed.yml
@@ -1,11 +1,7 @@
-name: Detect HTML Help Renamed
-id: 62fed254-513b-460e-953d-79771493a9f3
-version: 3
-date: '2021-09-16'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: The following analytic identifies a renamed instance of hh.exe (HTML
   Help) executing a Compiled HTML Help (CHM). This particular technique will load
   Windows script code from a compiled help file. CHM files may contain nearly any
@@ -17,22 +13,24 @@ description: The following analytic identifies a renamed instance of hh.exe (HTM
   or WSH script code. During investigation, identify script content origination. Validate
   it is the legitimate version of hh.exe by reviewing the PE metadata. hh.exe is natively
   found in C:\Windows\system32 and C:\Windows\syswow64.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_hh` by Processes.dest
-  Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: 62fed254-513b-460e-953d-79771493a9f3
 known_false_positives: Although unlikely a renamed instance of hh.exe will be used
   legitimately, filter as needed.
+name: Detect HTML Help Renamed
 references:
 - https://attack.mitre.org/techniques/T1218/001/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
 - https://lolbas-project.github.io/lolbas/Binaries/Hh/
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_hh` by Processes.dest
+  Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_renamed_filter`'
 tags:
   analytic_story:
   - Suspicious Compiled HTML Activity
@@ -59,37 +57,36 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
+type: Hunting
+version: 3
diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml
index ec49b6d6db..a97bbad5ab 100644
--- a/detections/endpoint/detect_html_help_spawn_child_process.yml
+++ b/detections/endpoint/detect_html_help_spawn_child_process.yml
@@ -1,11 +1,7 @@
-name: Detect HTML Help Spawn Child Process
-id: 723716de-ee55-4cd4-9759-c44e7e55ba4b
-version: 1
-date: '2021-02-11'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-02-11'
 description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
   HTML Help (CHM) that spawns a child process. This particular technique will load
   Windows script code from a compiled help file. CHM files may contain nearly any
@@ -17,22 +13,24 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a
   or WSH script code. During investigation, identify script content origination. Review
   child process events and investigate further. hh.exe is natively found in C:\Windows\system32
   and C:\Windows\syswow64.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=hh.exe
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_spawn_child_process_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 723716de-ee55-4cd4-9759-c44e7e55ba4b
 known_false_positives: Although unlikely, some legitimate applications (ex. web browsers)
   may spawn a child process. Filter as needed.
+name: Detect HTML Help Spawn Child Process
 references:
 - https://attack.mitre.org/techniques/T1218/001/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
 - https://lolbas-project.github.io/lolbas/Binaries/Hh/
 - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
 - https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=hh.exe
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_spawn_child_process_filter`'
 tags:
   analytic_story:
   - Suspicious Compiled HTML Activity
@@ -60,39 +58,38 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml
index 4714a277ec..9df0cce3c0 100644
--- a/detections/endpoint/detect_html_help_url_in_command_line.yml
+++ b/detections/endpoint/detect_html_help_url_in_command_line.yml
@@ -1,11 +1,7 @@
-name: Detect HTML Help URL in Command Line
-id: 8c5835b9-39d9-438b-817c-95f14c69a31e
-version: 2
-date: '2021-09-16'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
   HTML Help (CHM) file from a remote url. This particular technique will load Windows
   script code from a compiled help file. CHM files may  contain nearly any file type
@@ -17,19 +13,15 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a
   investigation, identify script content origination. Review reputation of remote
   IP and domain. Some instances, it is worth decompiling the .chm file to review its
   original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_hh` Processes.process=*http*
-  by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `detect_html_help_url_in_command_line_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: 8c5835b9-39d9-438b-817c-95f14c69a31e
 known_false_positives: Although unlikely, some legitimate applications may retrieve
   a CHM remotely, filter as needed.
+name: Detect HTML Help URL in Command Line
 references:
 - https://attack.mitre.org/techniques/T1218/001/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
@@ -37,6 +29,12 @@ references:
 - https://blog.sevagas.com/?Hacking-around-HTA-files
 - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
 - https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_hh` Processes.process=*http*
+  by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `detect_html_help_url_in_command_line_filter`'
 tags:
   analytic_story:
   - Suspicious Compiled HTML Activity
@@ -64,39 +62,38 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 90
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
index 1b6c30f710..3a04736ae9 100644
--- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
+++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml
@@ -1,11 +1,7 @@
-name: Detect HTML Help Using InfoTech Storage Handlers
-id: 0b2eefa5-5508-450d-b970-3dd2fb761aec
-version: 2
-date: '2021-09-16'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
   HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique
   will load Windows script code from a compiled help file, using InfoTech Storage
@@ -19,19 +15,15 @@ description: The following analytic identifies hh.exe (HTML Help) execution of a
   the execution of Shortcut commands or WSH script code. During investigation, identify
   script content origination. hh.exe is natively found in C:\Windows\system32 and
   C:\Windows\syswow64.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_hh` Processes.process
-  IN ("*its:*", "*mk:@MSITStore:*") by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `detect_html_help_using_infotech_storage_handlers_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: 0b2eefa5-5508-450d-b970-3dd2fb761aec
 known_false_positives: It is rare to see instances of InfoTech Storage Handlers being
   used, but it does happen in some legitimate instances. Filter as needed.
+name: Detect HTML Help Using InfoTech Storage Handlers
 references:
 - https://attack.mitre.org/techniques/T1218/001/
 - https://www.kb.cert.org/vuls/id/851869
@@ -39,6 +31,12 @@ references:
 - https://lolbas-project.github.io/lolbas/Binaries/Hh/
 - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
 - https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_hh` Processes.process
+  IN ("*its:*", "*mk:@MSITStore:*") by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `detect_html_help_using_infotech_storage_handlers_filter`'
 tags:
   analytic_story:
   - Suspicious Compiled HTML Activity
@@ -65,35 +63,33 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 72
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml
index 6617f7be17..bba8e5fc5c 100644
--- a/detections/endpoint/detect_mimikatz_using_loaded_images.yml
+++ b/detections/endpoint/detect_mimikatz_using_loaded_images.yml
@@ -1,29 +1,27 @@
-name: Detect Mimikatz Using Loaded Images
-id: 29e307ba-40af-4ab2-91b2-3c6b392bbba0
-version: 1
-date: '2019-12-03'
 author: Patrick Bareiss, Splunk
-type: TTP
 datamodel: []
+date: '2019-12-03'
 description: This search looks for reading loaded Images unique to credential dumping
   with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon
   Event Code.
-search: '`sysmon` EventCode=7 | stats values(ImageLoaded) as ImageLoaded values(ProcessId)
-  as ProcessId by Computer, Image | search ImageLoaded=*WinSCard.dll ImageLoaded=*cryptdll.dll
-  ImageLoaded=*hid.dll ImageLoaded=*samlib.dll ImageLoaded=*vaultcli.dll | rename
-  Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `detect_mimikatz_using_loaded_images_filter`'
 how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which
   includes EventCode 7 with powershell.exe. This search uses an input macro named
   `sysmon`. We strongly recommend that you specify your environment-specific configurations
   (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
   with configurations for your Splunk environment. The search also uses a post-filter
   macro designed to filter out known false positives.
+id: 29e307ba-40af-4ab2-91b2-3c6b392bbba0
 known_false_positives: Other tools can import the same DLLs. These tools should be
   part of a whitelist. False positives may be present with any process that authenticates
   or uses credentials, PowerShell included. Filter based on parent process.
+name: Detect Mimikatz Using Loaded Images
 references:
 - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html
+search: '`sysmon` EventCode=7 | stats values(ImageLoaded) as ImageLoaded values(ProcessId)
+  as ProcessId by Computer, Image | search ImageLoaded=*WinSCard.dll ImageLoaded=*cryptdll.dll
+  ImageLoaded=*hid.dll ImageLoaded=*samlib.dll ImageLoaded=*vaultcli.dll | rename
+  Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `detect_mimikatz_using_loaded_images_filter`'
 tags:
   analytic_story:
   - Credential Dumping
@@ -54,31 +52,32 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: ImageLoaded
-    type: Parent Process
     role:
     - Other
+    type: Parent Process
   - name: Image
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
+  - Computer
   - EventCode
+  - Image
   - ImageLoaded
   - ProcessId
-  - Computer
-  - Image
   risk_score: 64
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml
index 499ad568b5..8cbdd9d542 100644
--- a/detections/endpoint/detect_mshta_inline_hta_execution.yml
+++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml
@@ -1,16 +1,25 @@
-name: Detect mshta inline hta execution
-id: a0873b32-5b68-11eb-ae93-0242ac130002
-version: 6
-date: '2021-09-16'
 author: Bhavin Patel, Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: The following analytic identifies "mshta.exe" execution with inline protocol
   handlers. "JavaScript", "VBScript", and "About" are the only supported options when
   invoking HTA content directly on the command-line. The search will return the first
   time and last time these command-line arguments were used for these executions,
   as well as the target system, the user, process "mshta.exe" and its parent process.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: a0873b32-5b68-11eb-ae93-0242ac130002
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+name: Detect mshta inline hta execution
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where `process_mshta` (Processes.process=*vbscript*
@@ -18,17 +27,6 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   Processes.process_name Processes.original_file_name Processes.parent_process_name
   Processes.dest  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `detect_mshta_inline_hta_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Although unlikely, some legitimate applications may exhibit
-  this behavior, triggering a false positive.
-references:
-- https://github.com/redcanaryco/AtomicTestHarnesses
-- https://redcanary.com/blog/introducing-atomictestharnesses/
-- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
 tags:
   analytic_story:
   - Suspicious MSHTA Activity
@@ -56,39 +54,37 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 90
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 6
diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml
index a67750f930..5227f74649 100644
--- a/detections/endpoint/detect_mshta_renamed.yml
+++ b/detections/endpoint/detect_mshta_renamed.yml
@@ -1,32 +1,30 @@
-name: Detect mshta renamed
-id: 8f45fcf0-5b68-11eb-ae93-0242ac130002
-version: 2
-date: '2021-09-16'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: The following analytic identifies renamed instances of mshta.exe executing.
   Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This
   analytic utilizes the internal name of the PE to identify if is the legitimate mshta
   binary. Further analysis should be performed to review the executed content and
   validation it is the real mshta.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 8f45fcf0-5b68-11eb-ae93-0242ac130002
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of mshta.exe, but never renamed, triggering a false positive.
+name: Detect mshta renamed
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_mshta` by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.original_file_name |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_mshta_renamed_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Although unlikely, some legitimate applications may use a moved
-  copy of mshta.exe, but never renamed, triggering a false positive.
-references:
-- https://github.com/redcanaryco/AtomicTestHarnesses
-- https://redcanary.com/blog/introducing-atomictestharnesses/
 tags:
   analytic_story:
   - Suspicious MSHTA Activity
@@ -53,37 +51,36 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
+type: Hunting
+version: 2
diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml
index 180b73585e..c3cbbb2be7 100644
--- a/detections/endpoint/detect_mshta_url_in_command_line.yml
+++ b/detections/endpoint/detect_mshta_url_in_command_line.yml
@@ -1,11 +1,7 @@
-name: Detect MSHTA Url in Command Line
-id: 9b3af1e6-5b68-11eb-ae93-0242ac130002
-version: 2
-date: '2021-09-16'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: This analytic identifies when Microsoft HTML Application Host (mshta.exe)
   utility is used to make remote http connections. Adversaries may use mshta.exe to
   proxy the download and execution of remote .hta files. The analytic identifies command
@@ -13,23 +9,25 @@ description: This analytic identifies when Microsoft HTML Application Host (msht
   malicious software to bypass preventative controls. The search will return the first
   time and last time these command-line arguments were used for these executions,
   as well as the target system, the user, process "rundll32.exe" and its parent process.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 9b3af1e6-5b68-11eb-ae93-0242ac130002
+known_false_positives: It is possible legitimate applications may perform this behavior
+  and will need to be filtered.
+name: Detect MSHTA Url in Command Line
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where `process_mshta` (Processes.process="*http://*"
   OR Processes.process="*https://*") by Processes.user Processes.process_name Processes.parent_process_name
   Processes.original_file_name Processes.dest  | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_mshta_url_in_command_line_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: It is possible legitimate applications may perform this behavior
-  and will need to be filtered.
-references:
-- https://github.com/redcanaryco/AtomicTestHarnesses
-- https://redcanary.com/blog/introducing-atomictestharnesses/
-- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
 tags:
   analytic_story:
   - Suspicious MSHTA Activity
@@ -57,39 +55,37 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml
index cd4be52fb9..e2039b63a0 100644
--- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml
+++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml
@@ -1,14 +1,20 @@
-name: Detect Path Interception By Creation Of program exe
-id: c77162d3-f93c-45cc-80c8-22f6v5264g9f
-version: 3
-date: '2020-07-03'
 author: Patrick Bareiss, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-07-03'
 description: 'The detection Detect Path Interception By Creation Of program exe is
   detecting the abuse of unquoted service paths, which is a popular technique for
   privilege escalation. '
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+id: c77162d3-f93c-45cc-80c8-22f6v5264g9f
+known_false_positives: unknown
+name: Detect Path Interception By Creation Of program exe
+references:
+- https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe
   by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
@@ -16,14 +22,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | eval process_name = lower(process_name) | eval service_process = lower(service_process)
   | where process_name != service_process | `security_content_ctime(firstTime)` |
   `security_content_ctime(lastTime)` | `detect_path_interception_by_creation_of_program_exe_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
-known_false_positives: unknown
-references:
-- https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae
 tags:
   analytic_story:
   - Windows Persistence Techniques
@@ -51,39 +49,35 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 3
diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml
index fc25eaa2bc..de7a19d4c8 100644
--- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml
+++ b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml
@@ -1,13 +1,21 @@
-name: Detect processes used for System Network Configuration Discovery
-id: a51bfe1a-94f0-48cc-b1e4-16ae10145893
-version: 2
-date: '2020-11-10'
 author: Bhavin Patel, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-11-10'
 description: This search looks for fast execution of processes used for system network
   configuration discovery on the endpoint.
+how_to_implement: You must be ingesting data that records registry activity from your
+  hosts to populate the Endpoint data model in the processes node. This is typically
+  populated via endpoint detection-and-response product, such as Carbon Black, or
+  endpoint data sources, such as Sysmon. The data used for this search is usually
+  generated via logs that report reads and writes to the registry or that are populated
+  via Windows event logs, after enabling process tracking in your Windows audit settings.
+id: a51bfe1a-94f0-48cc-b1e4-16ae10145893
+known_false_positives: It is uncommon for normal users to execute a series of commands
+  used for network discovery. System administrators often use scripts to execute these
+  commands. These can generate false positives.
+name: Detect processes used for System Network Configuration Discovery
+references: []
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where NOT Processes.user
@@ -16,16 +24,6 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   | search `system_network_configuration_discovery_tools` | transaction dest connected=false
   maxpause=5m |where eventcount>=5 | table firstTime lastTime dest user process_name
   process parent_process eventcount | `detect_processes_used_for_system_network_configuration_discovery_filter`'
-how_to_implement: You must be ingesting data that records registry activity from your
-  hosts to populate the Endpoint data model in the processes node. This is typically
-  populated via endpoint detection-and-response product, such as Carbon Black, or
-  endpoint data sources, such as Sysmon. The data used for this search is usually
-  generated via logs that report reads and writes to the registry or that are populated
-  via Windows event logs, after enabling process tracking in your Windows audit settings.
-known_false_positives: It is uncommon for normal users to execute a series of commands
-  used for network discovery. System administrators often use scripts to execute these
-  commands. These can generate false positives.
-references: []
 tags:
   analytic_story:
   - Unusual Processes
@@ -54,39 +52,35 @@ tags:
   - PR.DS
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 32
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml
index 0118aefed2..b4fbc05393 100644
--- a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml
+++ b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml
@@ -1,18 +1,9 @@
-name: Detect Prohibited Applications Spawning cmd exe
-id: dcfd6b40-42f9-469d-a433-2e53f7486664
-version: 6
-date: '2020-11-10'
 author: Bhavin Patel, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-11-10'
 description: This search looks for executions of cmd.exe spawned by a process that
   is often abused by attackers and that does not typically launch cmd.exe.
-search: '| tstats `security_content_summariesonly` count values(Processes.process)
-  as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where `process_cmd` by Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` |search [`prohibited_apps_launching_cmd`] | `detect_prohibited_applications_spawning_cmd_exe_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts and populates the Endpoint data model with the resultant dataset. This search
   includes a lookup file, `prohibited_apps_launching_cmd.csv`, that contains a list
@@ -22,10 +13,17 @@ how_to_implement: You must be ingesting data that records process activity from
   for the changes from your endpoints into the `Endpoint` datamodel in the `Processes`
   node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
   latest TA for the endpoint product.
+id: dcfd6b40-42f9-469d-a433-2e53f7486664
 known_false_positives: There are circumstances where an application may legitimately
   execute and interact with the Windows command-line interface. Investigate and modify
   the lookup file, as appropriate.
+name: Detect Prohibited Applications Spawning cmd exe
 references: []
+search: '| tstats `security_content_summariesonly` count values(Processes.process)
+  as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where `process_cmd` by Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` |search [`prohibited_apps_launching_cmd`] | `detect_prohibited_applications_spawning_cmd_exe_filter`'
 tags:
   analytic_story:
   - Suspicious Command-Line Executions
@@ -55,37 +53,34 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
+type: Hunting
+version: 6
diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
index 226b47f814..7a5169953e 100644
--- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml
+++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml
@@ -1,11 +1,7 @@
-name: Detect PsExec With accepteula Flag
-id: b89919ed-fe5f-492c-b139-151xb162040e
-version: 4
-date: '2021-09-16'
 author: Bhavin Patel, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: This search looks for events where `PsExec.exe` is run with the `accepteula`
   flag in the command line. PsExec is a built-in Windows utility that enables you
   to execute processes on other systems. It is fully interactive for console applications.
@@ -14,22 +10,24 @@ description: This search looks for events where `PsExec.exe` is run with the `ac
   If an attacker is running PsExec for the first time, they will be prompted to accept
   the end-user license agreement (EULA), which can be passed as the argument `accepteula`
   within the command line.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: b89919ed-fe5f-492c-b139-151xb162040e
+known_false_positives: Administrators can leverage PsExec for accessing remote systems
+  and might pass `accepteula` as an argument if they are running this tool for the
+  first time. However, it is not likely that you'd see multiple occurrences of this
+  event on a machine
+name: Detect PsExec With accepteula Flag
+references: []
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where `process_psexec` Processes.process=*accepteula* by Processes.dest Processes.user
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Administrators can leverage PsExec for accessing remote systems
-  and might pass `accepteula` as an argument if they are running this tool for the
-  first time. However, it is not likely that you'd see multiple occurrences of this
-  event on a machine
-references: []
 tags:
   analytic_story:
   - SamSam Ransomware
@@ -60,39 +58,37 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 4
diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml
index 5e172ae5d8..8057c783e1 100644
--- a/detections/endpoint/detect_rclone_command_line_usage.yml
+++ b/detections/endpoint/detect_rclone_command_line_usage.yml
@@ -1,11 +1,7 @@
-name: Detect RClone Command-Line Usage
-id: 32e0baea-b3f1-11eb-a2ce-acde48001122
-version: 2
-date: '2021-11-29'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-29'
 description: This analytic identifies commonly used command-line arguments used by
   `rclone.exe` to initiate a file transfer. Some arguments were negated as they are
   specific to the configuration used by adversaries. In particular, an adversary may
@@ -13,6 +9,20 @@ description: This analytic identifies commonly used command-line arguments used
   is not indicative of malicious behavior. During triage, at this stage of a ransomware
   event, exfiltration is about to occur or has already. Isolate the endpoint and continue
   investigating by review file modifications and parallel processes.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 32e0baea-b3f1-11eb-a2ce-acde48001122
+known_false_positives: False positives should be limited as this is restricted to
+  the Rclone process name. Filter or tune the analytic as needed.
+name: Detect RClone Command-Line Usage
+references:
+- https://redcanary.com/blog/rclone-mega-extortion/
+- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
+- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_rclone` Processes.process
   IN ("*copy*", "*mega*", "*pcloud*", "*ftp*", "*--config*", "*--progress*", "*--no-check-certificate*",
@@ -20,18 +30,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` |  `security_content_ctime(lastTime)` | `detect_rclone_command_line_usage_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives should be limited as this is restricted to
-  the Rclone process name. Filter or tune the analytic as needed.
-references:
-- https://redcanary.com/blog/rclone-mega-extortion/
-- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
-- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
-- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
 tags:
   analytic_story:
   - DarkSide Ransomware
@@ -53,36 +51,37 @@ tags:
   - T1020
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  - Processes.original_file_name
   risk_score: 35
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml
index d7c71727dc..ab8e79c2c5 100644
--- a/detections/endpoint/detect_regasm_spawning_a_process.yml
+++ b/detections/endpoint/detect_regasm_spawning_a_process.yml
@@ -1,11 +1,7 @@
-name: Detect Regasm Spawning a Process
-id: 72170ec5-f7d2-42f5-aefb-2b8be6aad15f
-version: 1
-date: '2021-02-12'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-02-12'
 description: The following analytic identifies regasm.exe spawning a process. This
   particular technique has been used in the wild to bypass application control products.
   Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process
@@ -14,22 +10,24 @@ description: The following analytic identifies regasm.exe spawning a process. Th
   suspicious behavior. Gather any other file modifications and review accordingly.
   regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
   and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=regasm.exe
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_spawning_a_process_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 72170ec5-f7d2-42f5-aefb-2b8be6aad15f
 known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe
   may cause a false positive. Filter based endpoint usage, command line arguments,
   or process lineage.
+name: Detect Regasm Spawning a Process
 references:
 - https://attack.mitre.org/techniques/T1218/009/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md
 - https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
 - https://lolbas-project.github.io/lolbas/Binaries/Regasm/
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=regasm.exe
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regasm_spawning_a_process_filter`'
 tags:
   analytic_story:
   - Suspicious Regsvcs Regasm Activity
@@ -57,35 +55,38 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml
index ad5797a361..a37e71bd2e 100644
--- a/detections/endpoint/detect_regasm_with_network_connection.yml
+++ b/detections/endpoint/detect_regasm_with_network_connection.yml
@@ -1,10 +1,6 @@
-name: Detect Regasm with Network Connection
-id: 07921114-6db4-4e2e-ae58-3ea8a52ae93f
-version: 2
-date: '2022-02-18'
 author: Michael Haag, Splunk
-type: TTP
 datamodel: []
+date: '2022-02-18'
 description: The following analytic identifies regasm.exe with a network connection
   to a public IP address, exluding private IP space. This particular technique has
   been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe
@@ -15,21 +11,23 @@ description: The following analytic identifies regasm.exe with a network connect
   and review accordingly. Review the reputation of the remote IP or domain and block
   as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
   and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16
-  process_name=regasm.exe | rename Computer as dest | stats count min(_time) as firstTime
-  max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `detect_regasm_with_network_connection_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
+id: 07921114-6db4-4e2e-ae58-3ea8a52ae93f
 known_false_positives: Although unlikely, limited instances of regasm.exe with a network
   connection may cause a false positive. Filter based endpoint usage, command line
   arguments, or process lineage.
+name: Detect Regasm with Network Connection
 references:
 - https://attack.mitre.org/techniques/T1218/009/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md
 - https://lolbas-project.github.io/lolbas/Binaries/Regasm/
+search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16
+  process_name=regasm.exe | rename Computer as dest | stats count min(_time) as firstTime
+  max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_regasm_with_network_connection_filter`'
 tags:
   analytic_story:
   - Suspicious Regsvcs Regasm Activity
@@ -56,30 +54,30 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
+  - Computer
   - EventID
+  - _time
   - dest_ip
   - process_name
-  - Computer
-  - user
   - src_ip
-  - dest_host
-  - dest_ip
+  - user
   risk_score: 80
   security_domain: endpoint
+type: TTP
+version: 2
diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
index 258427a5e9..74b299f50d 100644
--- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
+++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml
@@ -1,34 +1,32 @@
-name: Detect Regasm with no Command Line Arguments
-id: c3bc1430-04e7-4178-835f-047d8e6e97df
-version: 2
-date: '2021-09-20'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-20'
 description: The following analytic identifies regasm.exe with no command line arguments.
   This particular behavior occurs when another process injects into regasm.exe, no
   command line arguments will be present. During investigation, identify any network
   connections and parallel processes. Identify any suspicious module loads related
   to credential dumping or file writes. Regasm.exe are natively found in `C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe`
   and `C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe`.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where `process_regasm` by _time span=1h  Processes.process_id Processes.process_name
-  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | regex process="(regasm\.exe.{0,4}$)" | `detect_regasm_with_no_command_line_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: c3bc1430-04e7-4178-835f-047d8e6e97df
 known_false_positives: Although unlikely, limited instances of regasm.exe or may cause
   a false positive. Filter based endpoint usage, command line arguments, or process
   lineage.
+name: Detect Regasm with no Command Line Arguments
 references:
 - https://attack.mitre.org/techniques/T1218/009/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md
 - https://lolbas-project.github.io/lolbas/Binaries/Regasm/
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where `process_regasm` by _time span=1h  Processes.process_id Processes.process_name
+  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | regex process="(regasm\.exe.{0,4}$)" | `detect_regasm_with_no_command_line_arguments_filter`'
 tags:
   analytic_story:
   - Suspicious Regsvcs Regasm Activity
@@ -55,39 +53,36 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml
index cc9286fe4a..756be5499f 100644
--- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml
+++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml
@@ -1,11 +1,7 @@
-name: Detect Regsvcs Spawning a Process
-id: bc477b57-5c21-4ab6-9c33-668772e7f114
-version: 1
-date: '2021-02-12'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-02-12'
 description: The following analytic identifies regsvcs.exe spawning a process. This
   particular technique has been used in the wild to bypass application control products.
   Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process
@@ -14,21 +10,23 @@ description: The following analytic identifies regsvcs.exe spawning a process. T
   suspicious behavior. Gather any other file modifications and review accordingly.
   regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
   and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: bc477b57-5c21-4ab6-9c33-668772e7f114
+known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe
+  may cause a false positive. Filter based endpoint usage, command line arguments,
+  or process lineage.
+name: Detect Regsvcs Spawning a Process
+references:
+- https://attack.mitre.org/techniques/T1218/009/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md
+- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=regsvcs.exe
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_spawning_a_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Although unlikely, limited instances of regasm.exe or regsvcs.exe
-  may cause a false positive. Filter based endpoint usage, command line arguments,
-  or process lineage.
-references:
-- https://attack.mitre.org/techniques/T1218/009/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md
-- https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
 tags:
   analytic_story:
   - Suspicious Regsvcs Regasm Activity
@@ -55,36 +53,38 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml
index c92572151b..d7c5121c3b 100644
--- a/detections/endpoint/detect_regsvcs_with_network_connection.yml
+++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml
@@ -1,10 +1,6 @@
-name: Detect Regsvcs with Network Connection
-id: e3e7a1c0-f2b9-445c-8493-f30a63522d1a
-version: 2
-date: '2022-02-18'
 author: Michael Haag, Splunk
-type: TTP
 datamodel: []
+date: '2022-02-18'
 description: The following analytic identifies Regsvcs.exe with a network connection
   to a public IP address, exluding private IP space. This particular technique has
   been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe
@@ -15,21 +11,23 @@ description: The following analytic identifies Regsvcs.exe with a network connec
   and review accordingly. Review the reputation of the remote IP or domain and block
   as needed. regsvcs.exe and regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
   and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16
-  process_name=regsvcs.exe | rename Computer as dest | stats count min(_time) as firstTime
-  max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `detect_regsvcs_with_network_connection_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
+id: e3e7a1c0-f2b9-445c-8493-f30a63522d1a
 known_false_positives: Although unlikely, limited instances of regsvcs.exe may cause
   a false positive. Filter based endpoint usage, command line arguments, or process
   lineage.
+name: Detect Regsvcs with Network Connection
 references:
 - https://attack.mitre.org/techniques/T1218/009/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md
 - https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
+search: '`sysmon` EventID=3 dest_ip!=10.0.0.0/12 dest_ip!=172.16.0.0/12 dest_ip!=192.168.0.0/16
+  process_name=regsvcs.exe | rename Computer as dest | stats count min(_time) as firstTime
+  max(_time) as lastTime by dest, user, process_name, src_ip, dest_ip | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_regsvcs_with_network_connection_filter`'
 tags:
   analytic_story:
   - Suspicious Regsvcs Regasm Activity
@@ -56,29 +54,30 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
+  - Computer
   - EventID
+  - _time
   - dest_ip
   - process_name
-  - Computer
-  - user
   - src_ip
-  - dest_host
+  - user
   risk_score: 80
   security_domain: Endpoint
+type: TTP
+version: 2
diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
index 12558d8096..0d6499c16a 100644
--- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
+++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml
@@ -1,34 +1,32 @@
-name: Detect Regsvcs with No Command Line Arguments
-id: 6b74d578-a02e-4e94-a0d1-39440d0bf254
-version: 2
-date: '2021-09-20'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-20'
 description: The following analytic identifies regsvcs.exe with no command line arguments.
   This particular behavior occurs when another process injects into regsvcs.exe, no
   command line arguments will be present. During investigation, identify any network
   connections and parallel processes. Identify any suspicious module loads related
   to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe
   and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where `process_regsvcs` by _time span=1h  Processes.process_id Processes.process_name
-  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | regex process="(regsvcs\.exe.{0,4}$)"| `detect_regsvcs_with_no_command_line_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: 6b74d578-a02e-4e94-a0d1-39440d0bf254
 known_false_positives: Although unlikely, limited instances of regsvcs.exe may cause
   a false positive. Filter based endpoint usage, command line arguments, or process
   lineage.
+name: Detect Regsvcs with No Command Line Arguments
 references:
 - https://attack.mitre.org/techniques/T1218/009/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md
 - https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where `process_regsvcs` by _time span=1h  Processes.process_id Processes.process_name
+  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | regex process="(regsvcs\.exe.{0,4}$)"| `detect_regsvcs_with_no_command_line_arguments_filter`'
 tags:
   analytic_story:
   - Suspicious Regsvcs Regasm Activity
@@ -55,39 +53,36 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
index a346085832..2992aace17 100644
--- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml
+++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml
@@ -1,11 +1,7 @@
-name: Detect Regsvr32 Application Control Bypass
-id: 070e9b80-6252-11eb-ae93-0242ac130002
-version: 2
-date: '2021-01-28'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-01-28'
 description: 'Adversaries may abuse Regsvr32.exe to proxy execution of malicious code.
   Regsvr32.exe is a command-line program used to register and unregister object linking
   and embedding controls, including dynamic link libraries (DLLs), on Windows systems.
@@ -16,24 +12,26 @@ description: 'Adversaries may abuse Regsvr32.exe to proxy execution of malicious
   or external). Be cautious to modify the query to look for "scrobj.dll", the ".dll"
   is not required to load scrobj. "scrobj.dll" will be loaded by "regsvr32.exe" upon
   execution. '
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 070e9b80-6252-11eb-ae93-0242ac130002
+known_false_positives: Limited false positives related to third party software registering
+  .DLL's.
+name: Detect Regsvr32 Application Control Bypass
+references:
+- https://attack.mitre.org/techniques/T1218/010/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
+- https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
+- https://support.microsoft.com/en-us/topic/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages-a98d960a-7392-e6fe-d90a-3f4e0cb543e5
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` Processes.process=*scrobj*
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `detect_regsvr32_application_control_bypass_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives related to third party software registering
-  .DLL's.
-references:
-- https://attack.mitre.org/techniques/T1218/010/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
-- https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
-- https://support.microsoft.com/en-us/topic/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages-a98d960a-7392-e6fe-d90a-3f4e0cb543e5
 tags:
   analytic_story:
   - Suspicious Regsvr32 Activity
@@ -62,39 +60,38 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml
index 686669851d..e617cce75d 100644
--- a/detections/endpoint/detect_renamed_7_zip.yml
+++ b/detections/endpoint/detect_renamed_7_zip.yml
@@ -1,30 +1,28 @@
-name: Detect Renamed 7-Zip
-id: 4057291a-b8cf-11eb-95fe-acde48001122
-version: 2
-date: '2021-09-16'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: The following analytic identifies renamed 7-Zip usage using Sysmon. At
   this stage of an attack, review parallel processes and file modifications for data
   that is staged or potentially have been exfiltrated. This analytic utilizes the
   OriginalFileName to capture the renamed process. During triage, validate this is
   the legitimate version of `7zip` by reviewing the PE metadata. In addition, review
   parallel processes for further suspicious behavior.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 4057291a-b8cf-11eb-95fe-acde48001122
+known_false_positives: Limited false positives, however this analytic will need to
+  be modified for each environment if Sysmon is not used.
+name: Detect Renamed 7-Zip
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=7z*.exe
   AND Processes.process_name!=7z*.exe) by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `detect_renamed_7_zip_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Limited false positives, however this analytic will need to
-  be modified for each environment if Sysmon is not used.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
 tags:
   analytic_story:
   - Collection and Staging
@@ -45,37 +43,36 @@ tags:
   - T1560
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 27
   security_domain: endpoint
+type: Hunting
+version: 2
diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml
index aae0bea823..3389465ab3 100644
--- a/detections/endpoint/detect_renamed_psexec.yml
+++ b/detections/endpoint/detect_renamed_psexec.yml
@@ -1,32 +1,30 @@
-name: Detect Renamed PSExec
-id: 683e6196-b8e8-11eb-9a79-acde48001122
-version: 3
-date: '2021-09-16'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: The following analytic identifies renamed instances of `PsExec.exe` being
   utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe`
   or other SysInternal utility usage with the command-line argument of `-accepteula`.
   During triage, validate this is the legitimate version of `PsExec` by reviewing
   the PE metadata. In addition, review parallel processes for further suspicious behavior.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 683e6196-b8e8-11eb-9a79-acde48001122
+known_false_positives: Limited false positives should be present. It is possible some
+  third party applications may use older versions of PsExec, filter as needed.
+name: Detect Renamed PSExec
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml
+- https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_psexec` by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.original_file_name |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_renamed_psexec_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives should be present. It is possible some
-  third party applications may use older versions of PsExec, filter as needed.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml
-- https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/
 tags:
   analytic_story:
   - SamSam Ransomware
@@ -53,37 +51,36 @@ tags:
   - T1569.002
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 27
   security_domain: endpoint
+type: Hunting
+version: 3
diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml
index c26cf9478a..b986f5ce04 100644
--- a/detections/endpoint/detect_renamed_rclone.yml
+++ b/detections/endpoint/detect_renamed_rclone.yml
@@ -1,34 +1,33 @@
-name: Detect Renamed RClone
-id: 6dca1124-b3ec-11eb-9328-acde48001122
-version: 2
-date: '2021-09-16'
 author: Michael Haag, Splunk
-type: Hunting
-datamodel: []
+datamodel:
+- Endpoint.Processes
+date: '2021-09-16'
 description: The following analytic identifies the usage of `rclone.exe`, renamed,
   being used to exfiltrate data to a remote destination. RClone has been used by multiple
   ransomware groups to exfiltrate data. In many instances, it will be downloaded from
   the legitimate site and executed accordingly. During triage, isolate the endpoint
   and begin to review parallel processes for additional behavior. At this stage, the
   adversary may have staged data to be exfiltrated.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 6dca1124-b3ec-11eb-9328-acde48001122
+known_false_positives: False positives should be limited as this analytic identifies
+  renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business
+  use case.
+name: Detect Renamed RClone
+references:
+- https://redcanary.com/blog/rclone-mega-extortion/
+- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=rclone.exe
   AND Processes.process_name!=rclone.exe) by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `detect_renamed_rclone_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives should be limited as this analytic identifies
-  renamed instances of `rclone.exe`. Filter as needed if there is a legitimate business
-  use case.
-references:
-- https://redcanary.com/blog/rclone-mega-extortion/
-- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
-- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
 tags:
   analytic_story:
   - DarkSide Ransomware
@@ -49,37 +48,36 @@ tags:
   - T1020
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 27
   security_domain: endpoint
+type: Hunting
+version: 2
diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml
index 6cdad6b951..f040a07f10 100644
--- a/detections/endpoint/detect_renamed_winrar.yml
+++ b/detections/endpoint/detect_renamed_winrar.yml
@@ -1,16 +1,23 @@
-name: Detect Renamed WinRAR
-id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122
-version: 3
-date: '2021-09-16'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: The following analtyic identifies renamed instances of `WinRAR.exe`.
   In most cases, it is not common for WinRAR to be used renamed, however it is common
   to be installed by a third party application and executed from a non-standard path.
   During triage, validate additional metadata from the binary that this is `WinRAR`.
   Review parallel processes and file modifications.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122
+known_false_positives: Unknown. It is possible third party applications use renamed
+  instances of WinRAR.
+name: Detect Renamed WinRAR
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=WinRAR.exe
   (Processes.process_name!=rar.exe OR Processes.process_name!=winrar.exe) by Processes.dest
@@ -18,15 +25,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_id Processes.parent_process_id Processes.original_file_name |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_renamed_winrar_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Unknown. It is possible third party applications use renamed
-  instances of WinRAR.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
 tags:
   analytic_story:
   - Collection and Staging
@@ -48,37 +46,36 @@ tags:
   - T1560
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 27
   security_domain: endpoint
+type: Hunting
+version: 3
diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
index ea505ebdbf..a904a7e87c 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml
@@ -1,11 +1,7 @@
-name: Detect Rundll32 Application Control Bypass - advpack
-id: 4aefadfe-9abd-4bf8-b3fd-867e9ef95bf8
-version: 2
-date: '2021-02-04'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-02-04'
 description: The following analytic identifies rundll32.exe loading advpack.dll and
   ieadvpack.dll by calling the LaunchINFSection function on the command line. This
   particular technique will load script code from a file. Upon a successful execution,
@@ -15,25 +11,27 @@ description: The following analytic identifies rundll32.exe loading advpack.dll
   Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During
   investigation, review any network connections and obtain the script content executed.
   It's possible other files are on disk.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*advpack*
-  by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `detect_rundll32_application_control_bypass___advpack_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: 4aefadfe-9abd-4bf8-b3fd-867e9ef95bf8
 known_false_positives: Although unlikely, some legitimate applications may use advpack.dll
   or ieadvpack.dll, triggering a false positive.
+name: Detect Rundll32 Application Control Bypass - advpack
 references:
 - https://attack.mitre.org/techniques/T1218/011/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
 - https://lolbas-project.github.io/lolbas/Binaries/Rundll32
 - https://lolbas-project.github.io/lolbas/Libraries/Advpack/
 - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*advpack*
+  by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `detect_rundll32_application_control_bypass___advpack_filter`'
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity
@@ -61,39 +59,38 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
index 1bd63ea426..a4c03318d3 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml
@@ -1,11 +1,7 @@
-name: Detect Rundll32 Application Control Bypass - setupapi
-id: 61e7b44a-6088-4f26-b788-9a96ba13b37a
-version: 2
-date: '2021-02-04'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-02-04'
 description: The following analytic identifies rundll32.exe loading setupapi.dll and
   iesetupapi.dll by calling the LaunchINFSection function on the command line. This
   particular technique will load script code from a file. Upon a successful execution,
@@ -15,23 +11,25 @@ description: The following analytic identifies rundll32.exe loading setupapi.dll
   Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During
   investigation, review any network connections and obtain the script content executed.
   It's possible other files are on disk.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*setupapi*
-  by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `detect_rundll32_application_control_bypass___setupapi_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 61e7b44a-6088-4f26-b788-9a96ba13b37a
 known_false_positives: Although unlikely, some legitimate applications may use setupapi
   triggering a false positive.
+name: Detect Rundll32 Application Control Bypass - setupapi
 references:
 - https://attack.mitre.org/techniques/T1218/011/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
 - https://lolbas-project.github.io/lolbas/Binaries/Rundll32
 - https://lolbas-project.github.io/lolbas/Libraries/Setupapi/
 - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*setupapi*
+  by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `detect_rundll32_application_control_bypass___setupapi_filter`'
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity
@@ -59,39 +57,38 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
index 5be793a4fb..32d9c92f23 100644
--- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
+++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml
@@ -1,11 +1,7 @@
-name: Detect Rundll32 Application Control Bypass - syssetup
-id: 71b9bf37-cde1-45fb-b899-1b0aa6fa1183
-version: 2
-date: '2021-02-04'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-02-04'
 description: The following analytic identifies rundll32.exe loading syssetup.dll by
   calling the LaunchINFSection function on the command line. This particular technique
   will load script code from a file. Upon a successful execution, the following module
@@ -15,25 +11,27 @@ description: The following analytic identifies rundll32.exe loading syssetup.dll
   found in C:\Windows\system32 and C:\Windows\syswow64. During investigation, review
   any network connections and obtain the script content executed. It's possible other
   files are on disk.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*syssetup*
-  by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `detect_rundll32_application_control_bypass___syssetup_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: 71b9bf37-cde1-45fb-b899-1b0aa6fa1183
 known_false_positives: Although unlikely, some legitimate applications may use syssetup.dll,
   triggering a false positive.
+name: Detect Rundll32 Application Control Bypass - syssetup
 references:
 - https://attack.mitre.org/techniques/T1218/011/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
 - https://lolbas-project.github.io/lolbas/Binaries/Rundll32
 - https://lolbas-project.github.io/lolbas/Libraries/Syssetup/
 - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*syssetup*
+  by Processes.dest Processes.user Processes.parent_process_name Processes.original_file_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `detect_rundll32_application_control_bypass___syssetup_filter`'
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity
@@ -61,39 +59,38 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
index 0ce3298538..052098e8ad 100644
--- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml
+++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml
@@ -1,11 +1,7 @@
-name: Detect Rundll32 Inline HTA Execution
-id: 91c79f14-5b41-11eb-ae93-0242ac130002
-version: 2
-date: '2021-01-20'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-01-20'
 description: The following analytic identifies "rundll32.exe" execution with inline
   protocol handlers. "JavaScript", "VBScript", and "About" are the only supported
   options when invoking HTA content directly on the command-line. This type of behavior
@@ -13,6 +9,19 @@ description: The following analytic identifies "rundll32.exe" execution with inl
   The search will return the first time and last time these command-line arguments
   were used for these executions, as well as the target system, the user, process
   "rundll32.exe" and its parent process.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 91c79f14-5b41-11eb-ae93-0242ac130002
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+name: Detect Rundll32 Inline HTA Execution
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32`
@@ -20,17 +29,6 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   by Processes.user Processes.process_name Processes.parent_process_name Processes.original_file_name
   Processes.dest  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `detect_rundll32_inline_hta_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Although unlikely, some legitimate applications may exhibit
-  this behavior, triggering a false positive.
-references:
-- https://github.com/redcanaryco/AtomicTestHarnesses
-- https://redcanary.com/blog/introducing-atomictestharnesses/
-- https://docs.microsoft.com/en-us/windows/win32/search/-search-3x-wds-extidx-prot-implementing
 tags:
   analytic_story:
   - Suspicious MSHTA Activity
@@ -59,27 +57,25 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml
index c884eb7f88..a56c2f2e16 100644
--- a/detections/endpoint/detect_sharphound_command_line_arguments.yml
+++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml
@@ -1,33 +1,31 @@
-name: Detect SharpHound Command-Line Arguments
-id: a0bdd2f6-c2ff-11eb-b918-acde48001122
-version: 1
-date: '2021-06-01'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-06-01'
 description: The following analytic identifies common command-line arguments used
   by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS,
   function names may be modified, but these changes are dependent upon the operator.
   In most instances the defaults are used. This analytic works to identify the common
   command-line attributes used. It does not cover the entirety of every argument in
   order to avoid false positives.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*")
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_command_line_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: a0bdd2f6-c2ff-11eb-b918-acde48001122
 known_false_positives: False positives should be limited as the arguments used are
   specific to SharpHound. Filter as needed or add more command-line arguments as needed.
+name: Detect SharpHound Command-Line Arguments
 references:
 - https://attack.mitre.org/software/S0521/
 - https://thedfirreport.com/?s=bloodhound
 - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
 - https://github.com/BloodHoundAD/SharpHound3
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*")
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_command_line_arguments_filter`'
 tags:
   analytic_story:
   - Discovery Techniques
@@ -53,23 +51,25 @@ tags:
   - T1069
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 24
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml
index f8b790df6d..d2d0a9a3bd 100644
--- a/detections/endpoint/detect_sharphound_file_modifications.yml
+++ b/detections/endpoint/detect_sharphound_file_modifications.yml
@@ -1,11 +1,7 @@
-name: Detect SharpHound File Modifications
-id: 42b4b438-beed-11eb-ba1d-acde48001122
-version: 1
-date: '2021-05-27'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2021-05-27'
 description: SharpHound is used as a reconnaissance collector, ingestor, for BloodHound.
   SharpHound will query the domain controller and begin gathering all the data related
   to the domain and trusts. For output, it will drop a .zip file upon completion following
@@ -20,24 +16,26 @@ description: SharpHound is used as a reconnaissance collector, ingestor, for Blo
   or remove these json's entirely if it is too noisy. During traige, review parallel
   processes for further suspicious behavior. Typically, the process executing the
   `.ps1` ingestor will be PowerShell.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*bloodhound.zip",
-  "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json")
-  by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.file_path
-  Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `detect_sharphound_file_modifications_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on file modifications that include the name of the process, and file, responsible
   for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem`
   node.
+id: 42b4b438-beed-11eb-ba1d-acde48001122
 known_false_positives: False positives should be limited as the analytic is specific
   to a filename with extension .zip. Filter as needed.
+name: Detect SharpHound File Modifications
 references:
 - https://attack.mitre.org/software/S0521/
 - https://thedfirreport.com/?s=bloodhound
 - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
 - https://github.com/BloodHoundAD/SharpHound3
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*bloodhound.zip",
+  "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json")
+  by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.file_path
+  Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `detect_sharphound_file_modifications_filter`'
 tags:
   analytic_story:
   - Discovery Techniques
@@ -63,23 +61,30 @@ tags:
   - T1069
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.process_id
   - _time
-  - file_path
   - dest
-  - file_name
-  - process_id
   - file_create_time
+  - file_name
+  - file_path
+  - process_id
   risk_score: 24
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml
index 02400d37b8..fe95ab1825 100644
--- a/detections/endpoint/detect_sharphound_usage.yml
+++ b/detections/endpoint/detect_sharphound_usage.yml
@@ -1,11 +1,7 @@
-name: Detect SharpHound Usage
-id: dd04b29a-beed-11eb-87bc-acde48001122
-version: 2
-date: '2021-05-27'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-05-27'
 description: The following analytic identifies SharpHound binary usage by using the
   original filena,e. In addition to renaming the PE, other coverage is available to
   detect command-line arguments. This particular analytic looks for the original_file_name
@@ -14,25 +10,27 @@ description: The following analytic identifies SharpHound binary usage by using
   re-compiled and the attributes removed or changed to anything else. During triage,
   review the metadata of the binary in question. Review parallel processes for suspicious
   behavior. Identify the source of this binary.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sharphound.exe
-  OR Processes.original_file_name=SharpHound.exe) by Processes.dest Processes.user
-  Processes.parent_process_name Processes.original_file_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_usage_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: dd04b29a-beed-11eb-87bc-acde48001122
 known_false_positives: False positives should be limited as this is specific to a
   file attribute not used by anything else. Filter as needed.
+name: Detect SharpHound Usage
 references:
 - https://attack.mitre.org/software/S0521/
 - https://thedfirreport.com/?s=bloodhound
 - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
 - https://github.com/BloodHoundAD/SharpHound3
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sharphound.exe
+  OR Processes.original_file_name=SharpHound.exe) by Processes.dest Processes.user
+  Processes.parent_process_name Processes.original_file_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_usage_filter`'
 tags:
   analytic_story:
   - Discovery Techniques
@@ -58,27 +56,26 @@ tags:
   - T1069
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 24
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml
index b56f9aa201..20a294a8e6 100644
--- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml
+++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml
@@ -1,27 +1,25 @@
-name: Detect Use of cmd exe to Launch Script Interpreters
-id: b89919ed-fe5f-492c-b139-95dbb162039e
-version: 4
-date: '2020-07-21'
 author: Bhavin Patel, Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-07-21'
 description: This search looks for the execution of the cscript.exe or wscript.exe
   processes, with a parent of cmd.exe. The search will return the count, the first
   and last time this execution was seen on a machine, the user, and the destination
   of the machine
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records process activity from your hosts to populate the endpoint data model
+  in the processes node. If you are using Sysmon, you must have at least version 6.0.4
+  of the Sysmon TA.
+id: b89919ed-fe5f-492c-b139-95dbb162039e
+known_false_positives: Some legitimate applications may exhibit this behavior.
+name: Detect Use of cmd exe to Launch Script Interpreters
+references: []
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where Processes.parent_process_name="cmd.exe" (Processes.process_name=cscript.exe
   OR Processes.process_name =wscript.exe) by Processes.parent_process Processes.process_name
   Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
   | `detect_use_of_cmd_exe_to_launch_script_interpreters_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records process activity from your hosts to populate the endpoint data model
-  in the processes node. If you are using Sysmon, you must have at least version 6.0.4
-  of the Sysmon TA.
-known_false_positives: Some legitimate applications may exhibit this behavior.
-references: []
 tags:
   analytic_story:
   - 'Emotet Malware  DHS Report TA18-201A '
@@ -50,22 +48,24 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.parent_process
-  - Processes.user
-  - Processes.dest
   risk_score: 35
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 4
diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml
index 9387e05324..8b1e04874f 100644
--- a/detections/endpoint/disable_amsi_through_registry.yml
+++ b/detections/endpoint/disable_amsi_through_registry.yml
@@ -1,15 +1,23 @@
-name: Disable AMSI Through Registry
-id: 9c27ec42-d338-11eb-9044-acde48001122
-version: 2
-date: '2022-01-26'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-26'
 description: this search is to identify modification in registry to disable AMSI windows
   feature to evade detections. This technique was seen in several ransomware, RAT
   and even APT to impaire defenses of the compromise machine and to be able to execute
   payload with minimal alert as much as possible.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: 9c27ec42-d338-11eb-9044-acde48001122
+known_false_positives: network operator may disable this feature of windows but not
+  so common.
+name: Disable AMSI Through Registry
+references:
+- https://blog.f-secure.com/hunting-for-amsi-bypasses/
+- https://gist.github.com/rxwx/8955e5abf18dc258fd6b43a3a7f4dbf9
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows
   Script\\Settings\\AmsiEnable" Registry.registry_value_data = "0x00000000" by _time
@@ -23,15 +31,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `disable_amsi_through_registry_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: network operator may disable this feature of windows but not
-  so common.
-references:
-- https://blog.f-secure.com/hunting-for-amsi-bypasses/
-- https://gist.github.com/rxwx/8955e5abf18dc258fd6b43a3a7f4dbf9
 tags:
   analytic_story:
   - Ransomware
@@ -48,12 +47,22 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.user
-  - Registry.dest
-  - Registry.registry_value_name
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml
index 1561147480..2d49d37b1b 100644
--- a/detections/endpoint/disable_defender_antivirus_registry.yml
+++ b/detections/endpoint/disable_defender_antivirus_registry.yml
@@ -1,16 +1,22 @@
-name: Disable Defender AntiVirus Registry
-id: aa4f695a-3024-11ec-9987-acde48001122
-version: 2
-date: '2022-01-26'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-26'
 description: This particular behavior is typically executed when an adversaries or
   malware gains access to an endpoint and beings to perform execution and to evade
   detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
   task modifications will occur. During triage, review parallel processes and identify
   any further file modifications. Endpoint should be isolated.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the registry value name, registry path, and registry value data from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: aa4f695a-3024-11ec-9987-acde48001122
+known_false_positives: admin or user may choose to disable windows defender product
+name: Disable Defender AntiVirus Registry
+references:
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender*" Registry.registry_value_name
   = DisableAntiVirus Registry.registry_value_data = 0x00000001 by _time span=1h Registry.dest
@@ -24,13 +30,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_antivirus_registry_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: admin or user may choose to disable windows defender product
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IceID
@@ -50,26 +49,35 @@ tags:
   - T1562
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_value_name
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.registry_value_data
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
index dbfea7ede7..344d959bd7 100644
--- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
+++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
@@ -1,15 +1,21 @@
-name: Disable Defender BlockAtFirstSeen Feature
-id: 2dd719ac-3021-11ec-97b4-acde48001122
-version: 2
-date: '2022-01-26'
 author: Teoderick Contreras
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-26'
 description: This analytic is to detect a suspicious modification of registry to disable
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the BlockAtFirstSeen feature where it block
   suspicious file first seen in the host.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the registry value name, registry path, and registry value data from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 2dd719ac-3021-11ec-97b4-acde48001122
+known_false_positives: admin or user may choose to disable windows defender product
+name: Disable Defender BlockAtFirstSeen Feature
+references:
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name
   = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001 by _time span=1h
@@ -23,13 +29,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_blockatfirstseen_feature_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: admin or user may choose to disable windows defender product
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IceID
@@ -49,26 +48,35 @@ tags:
   - T1562
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_value_name
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.registry_value_data
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml
index 970291b826..3660e9e7e1 100644
--- a/detections/endpoint/disable_defender_enhanced_notification.yml
+++ b/detections/endpoint/disable_defender_enhanced_notification.yml
@@ -1,15 +1,21 @@
-name: Disable Defender Enhanced Notification
-id: dc65678c-301f-11ec-8e30-acde48001122
-version: 2
-date: '2022-01-26'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-26'
 description: This analytic is to detect a suspicious modification of registry to disable
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the Enhanced Notification feature wher user
   or admin set to show or display alerts.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the registry value name, registry path, and registry value data executions
+  from your endpoints. If you are using Sysmon, you must have at least version 6.0.4
+  of the Sysmon TA.
+id: dc65678c-301f-11ec-8e30-acde48001122
+known_false_positives: user may choose to disable windows defender AV
+name: Disable Defender Enhanced Notification
+references:
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name
   = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001 by _time
@@ -23,13 +29,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_enhanced_notification_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data executions
-  from your endpoints. If you are using Sysmon, you must have at least version 6.0.4
-  of the Sysmon TA.
-known_false_positives: user may choose to disable windows defender AV
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IceID
@@ -49,26 +48,35 @@ tags:
   - T1562
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_value_name
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.registry_value_data
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml
index 370a57cfc1..f9a3686618 100644
--- a/detections/endpoint/disable_defender_mpengine_registry.yml
+++ b/detections/endpoint/disable_defender_mpengine_registry.yml
@@ -1,16 +1,22 @@
-name: Disable Defender MpEngine Registry
-id: cc391750-3024-11ec-955a-acde48001122
-version: 2
-date: '2022-01-26'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-26'
 description: This particular behavior is typically executed when an adversaries or
   malware gains access to an endpoint and beings to perform execution and to evade
   detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
   task modifications will occur. During triage, review parallel processes and identify
   any further file modifications. Endpoint should be isolated.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the registry value name, registry path, and registry value data from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: cc391750-3024-11ec-955a-acde48001122
+known_false_positives: admin or user may choose to disable windows defender product
+name: Disable Defender MpEngine Registry
+references:
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path = "*\\Policies\\Microsoft\\Windows Defender\\MpEngine*"
   Registry.registry_value_name = MpEnablePus Registry.registry_value_data = 0x00000000
@@ -24,13 +30,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_mpengine_registry_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: admin or user may choose to disable windows defender product
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IceID
@@ -50,26 +49,35 @@ tags:
   - T1562
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_value_name
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.registry_value_data
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml
index 99325b43e3..58796e427f 100644
--- a/detections/endpoint/disable_defender_spynet_reporting.yml
+++ b/detections/endpoint/disable_defender_spynet_reporting.yml
@@ -1,14 +1,20 @@
-name: Disable Defender Spynet Reporting
-id: 898debf4-3021-11ec-ba7c-acde48001122
-version: 2
-date: '2022-01-26'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-26'
 description: This analytic is to detect a suspicious modification of registry to disable
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the spynet reporting for its telemetry.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the registry value name, registry path, and registry value data from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 898debf4-3021-11ec-ba7c-acde48001122
+known_false_positives: admin or user may choose to disable windows defender product
+name: Disable Defender Spynet Reporting
+references:
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name
   = SpynetReporting Registry.registry_value_data = 0x00000000 by _time span=1h Registry.dest
@@ -22,13 +28,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_spynet_reporting_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: admin or user may choose to disable windows defender product
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IceID
@@ -48,26 +47,35 @@ tags:
   - T1562
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_value_name
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.registry_value_data
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
index 725608f220..7c4dd2609e 100644
--- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
+++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
@@ -1,14 +1,20 @@
-name: Disable Defender Submit Samples Consent Feature
-id: 73922ff8-3022-11ec-bf5e-acde48001122
-version: 2
-date: '2022-01-26'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-26'
 description: his analytic is to detect a suspicious modification of registry to disable
   windows defender feature. This technique is to bypassed or evade detection from
   Windows Defender AV product specially the submit samples feature for further analysis..
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the registry value name, registry path, and registry value data from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 73922ff8-3022-11ec-bf5e-acde48001122
+known_false_positives: admin or user may choose to disable windows defender product
+name: Disable Defender Submit Samples Consent Feature
+references:
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name
   = SubmitSamplesConsent Registry.registry_value_data = 0x00000000 by _time span=1h
@@ -22,13 +28,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `disable_defender_submit_samples_consent_feature_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the registry value name, registry path, and registry value data from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: admin or user may choose to disable windows defender product
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IceID
@@ -48,26 +47,35 @@ tags:
   - T1562
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_value_name
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.registry_value_data
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml
index b29449cebb..e82fa515a6 100644
--- a/detections/endpoint/disable_etw_through_registry.yml
+++ b/detections/endpoint/disable_etw_through_registry.yml
@@ -1,15 +1,22 @@
-name: Disable ETW Through Registry
-id: f0eacfa4-d33f-11eb-8f9d-acde48001122
-version: 2
-date: '2022-01-27'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-27'
 description: this search is to identify modification in registry to disable ETW windows
   feature to evade detections. This technique was seen in several ransomware, RAT
   and even APT to impaire defenses of the compromise machine and to be able to execute
   payload with minimal alert as much as possible.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: f0eacfa4-d33f-11eb-8f9d-acde48001122
+known_false_positives: network operator may disable this feature of windows but not
+  so common.
+name: Disable ETW Through Registry
+references:
+- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\.NETFramework\\ETWEnabled"
   Registry.registry_value_data = "0x00000000" by _time span=1h Registry.dest Registry.user
@@ -23,14 +30,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `disable_etw_through_registry_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: network operator may disable this feature of windows but not
-  so common.
-references:
-- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
 tags:
   analytic_story:
   - Ransomware
@@ -47,12 +46,22 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.user
-  - Registry.dest
-  - Registry.registry_value_name
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml
index 42a6106f04..cdea4d365e 100644
--- a/detections/endpoint/disable_logs_using_wevtutil.yml
+++ b/detections/endpoint/disable_logs_using_wevtutil.yml
@@ -1,28 +1,26 @@
-name: Disable Logs Using WevtUtil
-id: 236e7c8e-c9d9-11eb-a824-acde48001122
-version: 1
-date: '2021-06-10'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-06-10'
 description: This search is to detect execution of wevtutil.exe to disable logs. This
   technique was seen in several ransomware to disable the event logs to evade alerts
   and detections.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 236e7c8e-c9d9-11eb-a824-acde48001122
+known_false_positives: network operator may disable audit event logs for debugging
+  purposes.
+name: Disable Logs Using WevtUtil
+references:
+- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "wevtutil.exe"
   Processes.process = "*sl*" Processes.process = "*/e:false*" by Processes.parent_process_name
   Processes.parent_process Processes.process_name Processes.process Processes.dest
   Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disable_logs_using_wevtutil_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: network operator may disable audit event logs for debugging
-  purposes.
-references:
-- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
 tags:
   analytic_story:
   - Ransomware
@@ -42,24 +40,26 @@ tags:
   - T1070.001
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.dest
-  - Processes.user
-  - Processes.process_id
-  - Processes.process_guid
   risk_score: 24
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml
index 39f23f330c..2f32fcc109 100644
--- a/detections/endpoint/disable_registry_tool.yml
+++ b/detections/endpoint/disable_registry_tool.yml
@@ -1,16 +1,22 @@
-name: Disable Registry Tool
-id: cd2cf33c-9201-11eb-a10a-acde48001122
-version: 2
-date: '2022-01-27'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-27'
 description: This search identifies modification of registry to disable the regedit
   or registry tools of the windows operating system. Since registry tool is a swiss
   knife in analyzing registry, malware such as RAT or trojan Spy disable this application
   to prevent the removal of their registry entry such as persistence, file less components
   and defense evasion.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: cd2cf33c-9201-11eb-a10a-acde48001122
+known_false_positives: admin may disable this application for non technical user.
+name: Disable Registry Tool
+references:
+- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools"
   Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
@@ -24,13 +30,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `disable_registry_tool_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: admin may disable this application for non technical user.
-references:
-- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -52,21 +51,31 @@ tags:
   - T1562
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.user
-  - Registry.dest
-  - Registry.registry_value_name
   risk_score: 40
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disable_schedule_task.yml b/detections/endpoint/disable_schedule_task.yml
index 9a5bce2c78..8bbd1a4291 100644
--- a/detections/endpoint/disable_schedule_task.yml
+++ b/detections/endpoint/disable_schedule_task.yml
@@ -1,30 +1,28 @@
-name: Disable Schedule Task
-id: db596056-3019-11ec-a9ff-acde48001122
-version: 1
-date: '2021-10-18'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-10-18'
 description: This analytic is to detect a suspicious commandline to disable existing
   schedule task. This technique is used by adversaries or commodity malware like IceID
   to disable security application (AV products) in the targetted host to evade detections.
   This TTP is a good pivot to check further why and what other process run before
   and after this detection. check which process execute the commandline and what task
   is disabled. parent child process is quite valuable in this scenario too.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: db596056-3019-11ec-a9ff-acde48001122
+known_false_positives: admin may disable problematic schedule task
+name: Disable Schedule Task
+references:
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
   Processes.process=*/change*  Processes.process=*/disable* by Processes.user Processes.process_name
   Processes.process Processes.parent_process_name Processes.parent_process Processes.dest
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `disable_schedule_task_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: admin may disable problematic schedule task
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IcedID
@@ -45,20 +43,24 @@ tags:
   - T1562
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.user
-  - Processes.process_name
-  - Processes.parent_process_name
-  - Processes.dest
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml
index 8ff1bc575c..9cbc371963 100644
--- a/detections/endpoint/disable_security_logs_using_minint_registry.yml
+++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml
@@ -1,15 +1,23 @@
-name: Disable Security Logs Using MiniNt Registry
-id: 39ebdc68-25b9-11ec-aec7-acde48001122
-version: 2
-date: '2022-01-27'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-27'
 description: This analytic is to detect a suspicious registry modification to disable
   security audit logs. This technique was shared by a researcher to disable Security
   logs of windows by adding this registry. The Windows will think it is WinPE and
   will not log any event to the Security Log
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+id: 39ebdc68-25b9-11ec-aec7-acde48001122
+known_false_positives: Unknown.
+name: Disable Security Logs Using MiniNt Registry
+references:
+- https://twitter.com/0gtweet/status/1182516740955226112
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
   where Registry.registry_path="*\\Control\\MiniNt\\*" by _time span=1h Registry.dest
   Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
@@ -22,15 +30,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `disable_security_logs_using_minint_registry_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: Unknown.
-references:
-- https://twitter.com/0gtweet/status/1182516740955226112
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -49,26 +48,35 @@ tags:
   - T1112
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_value_name
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.registry_value_data
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml
index ced2b6bebf..b1497a5370 100644
--- a/detections/endpoint/disable_show_hidden_files.yml
+++ b/detections/endpoint/disable_show_hidden_files.yml
@@ -1,15 +1,21 @@
-name: Disable Show Hidden Files
-id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122
-version: 2
-date: '2022-01-27'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-27'
 description: The following analytic is to identify a modification in the Windows registry
   to prevent users from seeing all the files with hidden attributes. This event or
   techniques are known on some worm and trojan spy malware that will drop hidden files
   on the infected machine.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122
+known_false_positives: unknown
+name: Disable Show Hidden Files
+references:
+- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden"
   OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt"
@@ -25,13 +31,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `disable_show_hidden_files_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: unknown
-references:
-- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -55,19 +54,29 @@ tags:
   - T1562
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.user
-  - Registry.dest
-  - Registry.registry_value_nam
   risk_score: 40
   security_domain: endpoint
+type: TTP
+version: 2
diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml
index a8f72f0663..375d229f09 100644
--- a/detections/endpoint/disable_uac_remote_restriction.yml
+++ b/detections/endpoint/disable_uac_remote_restriction.yml
@@ -1,16 +1,24 @@
-name: Disable UAC Remote Restriction
-id: 9928b732-210e-11ec-b65e-acde48001122
-version: 2
-date: '2022-01-27'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-27'
 description: This analytic is to detect a suspicious modification of registry to disable
   UAC remote restriction. This technique was well documented in Microsoft page where
   attacker may modify this registry value to bypassed UAC feature of windows host.
   This is a good indicator that some tries to bypassed UAC to suspicious process or
   gain privilege escalation.
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+id: 9928b732-210e-11ec-b65e-acde48001122
+known_false_positives: admin may set this policy for non-critical machine.
+name: Disable UAC Remote Restriction
+references:
+- https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction
 search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
   max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\CurrentVersion\\Policies\\System*"
   Registry.registry_value_name="LocalAccountTokenFilterPolicy" Registry.registry_value_data="0x00000001"
@@ -24,15 +32,6 @@ search: '| tstats `security_content_summariesonly` count  min(_time) as firstTim
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `disable_uac_remote_restriction_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: admin may set this policy for non-critical machine.
-references:
-- https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/user-account-control-and-remote-restriction
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -53,26 +52,35 @@ tags:
   - T1548
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.registry_value_data
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml
index e65a348ce7..40dd3cd029 100644
--- a/detections/endpoint/disable_windows_app_hotkeys.yml
+++ b/detections/endpoint/disable_windows_app_hotkeys.yml
@@ -1,16 +1,24 @@
-name: Disable Windows App Hotkeys
-id: 1490f224-ad8b-11eb-8c4f-acde48001122
-version: 2
-date: '2022-01-27'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-27'
 description: This analytic detects a suspicious registry modification to disable Windows
   hotkey (shortcut keys) for native Windows applications. This technique is commonly
   used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`.
   This technique is used to impair the analyst in analyzing and removing the attacker
   implant in compromised systems.
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+id: 1490f224-ad8b-11eb-8c4f-acde48001122
+known_false_positives: unknown
+name: Disable Windows App Hotkeys
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
   where Registry.registry_path="*\\Windows NT\\CurrentVersion\\Image File Execution
   Options\\*" AND Registry.registry_value_data= "HotKey Disabled" AND Registry.registry_value_name
@@ -26,15 +34,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   _time dest user parent_process_name parent_process process_name process_path process
   proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `disable_windows_app_hotkeys_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: unknown
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   analytic_story:
   - XMRig
@@ -54,20 +53,32 @@ tags:
   - T1562
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.registry_value_name
-  - Registry.dest Registry.user
   risk_score: 40
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml
index 2117620028..8516be092f 100644
--- a/detections/endpoint/disable_windows_behavior_monitoring.yml
+++ b/detections/endpoint/disable_windows_behavior_monitoring.yml
@@ -1,14 +1,20 @@
-name: Disable Windows Behavior Monitoring
-id: 79439cae-9200-11eb-a4d3-acde48001122
-version: 2
-date: '2022-01-27'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-27'
 description: This search is to identifies a modification in registry to disable the
   windows denfender real time behavior monitoring. This event or technique is commonly
   seen in RAT, bot, or Trojan to disable AV to evade detections.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: 79439cae-9200-11eb-a4d3-acde48001122
+known_false_positives: admin or user may choose to disable this windows features.
+name: Disable Windows Behavior Monitoring
+references:
+- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
   Protection\\DisableBehaviorMonitoring" OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows
@@ -29,13 +35,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `disable_windows_behavior_monitoring_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: admin or user may choose to disable this windows features.
-references:
-- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -59,21 +58,31 @@ tags:
   - T1562
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.user
-  - Registry.dest
-  - Registry.registry_value_name
   risk_score: 40
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml
index 6f5fa6cbd7..61e01cf678 100644
--- a/detections/endpoint/disable_windows_smartscreen_protection.yml
+++ b/detections/endpoint/disable_windows_smartscreen_protection.yml
@@ -1,16 +1,22 @@
-name: Disable Windows SmartScreen Protection
-id: 664f0fd0-91ff-11eb-a56f-acde48001122
-version: 2
-date: '2022-01-27'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-27'
 description: The following search identifies a modification of registry to disable
   the smartscreen protection of windows machine. This is windows feature provide an
   early warning system against website that might engage in phishing attack or malware
   distribution. This modification are seen in RAT malware to cover their tracks upon
   downloading other of its component or other payload.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: 664f0fd0-91ff-11eb-a56f-acde48001122
+known_false_positives: admin or user may choose to disable this windows features.
+name: Disable Windows SmartScreen Protection
+references:
+- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled"  Registry.registry_value_data=
   "Off" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
@@ -23,13 +29,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `disable_windows_smartscreen_protection_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: admin or user may choose to disable this windows features.
-references:
-- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -51,23 +50,33 @@ tags:
   - T1562
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.user
-  - Registry.dest
-  - Registry.registry_value_nam
   risk_score: 25
   security_domain: endpoint
+type: TTP
+version: 2
diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml
index 6352615096..384a17f048 100644
--- a/detections/endpoint/disabling_cmd_application.yml
+++ b/detections/endpoint/disabling_cmd_application.yml
@@ -1,15 +1,21 @@
-name: Disabling CMD Application
-id: ff86077c-9212-11eb-a1e6-acde48001122
-version: 2
-date: '2022-01-27'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-27'
 description: this search is to identify modification in registry to disable cmd prompt
   application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging
   or deleting there samples through cmd application which is one of the tool of analyst
   to traverse on directory and files.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: ff86077c-9212-11eb-a1e6-acde48001122
+known_false_positives: admin may disable this application for non technical user.
+name: Disabling CMD Application
+references:
+- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD"
   Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
@@ -24,13 +30,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   registry_key_name] | table _time dest user parent_process_name parent_process process_name
   process_path process proc_guid registry_path registry_value_name registry_value_data
   registry_key_name | `disabling_cmd_application_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: admin may disable this application for non technical user.
-references:
-- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -52,25 +51,36 @@ tags:
   - T1562
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.user
-  - Registry.dest
-  - Registry.registry_value_name
   risk_score: 25
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml
index 1e511acb0e..d25c8ea6ba 100644
--- a/detections/endpoint/disabling_controlpanel.yml
+++ b/detections/endpoint/disabling_controlpanel.yml
@@ -1,14 +1,20 @@
-name: Disabling ControlPanel
-id: 6ae0148e-9215-11eb-a94a-acde48001122
-version: 2
-date: '2022-01-27'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-27'
 description: this search is to identify registry modification to disable control panel
   window. This technique is commonly seen in malware to prevent their artifacts ,
   persistence removed on the infected machine.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: 6ae0148e-9215-11eb-a94a-acde48001122
+known_false_positives: admin may disable this application for non technical user.
+name: Disabling ControlPanel
+references:
+- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel"
   Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
@@ -23,13 +29,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   registry_key_name] | table _time dest user parent_process_name parent_process process_name
   process_path process proc_guid registry_path registry_value_name registry_value_data
   registry_key_name | `disabling_controlpanel_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: admin may disable this application for non technical user.
-references:
-- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -51,25 +50,36 @@ tags:
   - T1562
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.user
-  - Registry.dest
-  - Registry.registry_value_name
   risk_score: 25
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml
index 954a4147b9..0bd20d10a4 100644
--- a/detections/endpoint/disabling_defender_services.yml
+++ b/detections/endpoint/disabling_defender_services.yml
@@ -1,16 +1,22 @@
-name: Disabling Defender Services
-id: 911eacdc-317f-11ec-ad30-acde48001122
-version: 2
-date: '2022-01-28'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-28'
 description: This particular behavior is typically executed when an adversaries or
   malware gains access to an endpoint and beings to perform execution and to evade
   detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
   task modifications will occur. During triage, review parallel processes and identify
   any further file modifications. Endpoint should be isolated.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 911eacdc-317f-11ec-ad30-acde48001122
+known_false_positives: admin or user may choose to disable windows defender product
+name: Disabling Defender Services
+references:
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND (Registry.registry_path
   IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*","*WinDefend*", "*SecurityHealthService*"))
@@ -25,13 +31,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `disabling_defender_services_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: admin or user may choose to disable windows defender product
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IceID
@@ -51,26 +50,35 @@ tags:
   - T1562
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_value_name
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.registry_value_data
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml
index dd4de0a3cd..fafd500ea6 100644
--- a/detections/endpoint/disabling_firewall_with_netsh.yml
+++ b/detections/endpoint/disabling_firewall_with_netsh.yml
@@ -1,29 +1,27 @@
-name: Disabling Firewall with Netsh
-id: 6860a62c-9203-11eb-9e05-acde48001122
-version: 2
-date: '2021-03-31'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-03-31'
 description: This search is to identifies suspicious firewall disabling using netsh
   application. this technique is commonly seen in malware that tries to communicate
   or download its component or other payload to its C2 server.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 6860a62c-9203-11eb-9e05-acde48001122
+known_false_positives: admin may disable firewall during testing or fixing network
+  problem.
+name: Disabling Firewall with Netsh
+references:
+- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_netsh` Processes.process=
   "*firewall*" (Processes.process= "*off*" OR  Processes.process= "*disable*") by
   Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_firewall_with_netsh_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: admin may disable firewall during testing or fixing network
-  problem.
-references:
-- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -45,31 +43,30 @@ tags:
   - T1562
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml
index b55293c3ce..78fd56818d 100644
--- a/detections/endpoint/disabling_folderoptions_windows_feature.yml
+++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml
@@ -1,16 +1,22 @@
-name: Disabling FolderOptions Windows Feature
-id: 83776de4-921a-11eb-868a-acde48001122
-version: 2
-date: '2022-01-28'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-28'
 description: This search is to identify registry modification to disable folder options
   feature of windows to show hidden files, file extension and etc. This technique
   used by malware in combination if disabling show hidden files feature to hide their
   files and also to hide the file extension to lure the user base on file icons or
   fake file extensions.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: 83776de4-921a-11eb-868a-acde48001122
+known_false_positives: admin may disable this application for non technical user.
+name: Disabling FolderOptions Windows Feature
+references:
+- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions"
   Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
@@ -25,13 +31,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   registry_key_name] | table _time dest user parent_process_name parent_process process_name
   process_path process proc_guid registry_path registry_value_name registry_value_data
   registry_key_name | `disabling_folderoptions_windows_feature_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: admin may disable this application for non technical user.
-references:
-- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -53,23 +52,34 @@ tags:
   - T1562
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.user
-  - Registry.dest
-  - Registry.registry_value_name
   risk_score: 25
   security_domain: endpoint
+type: TTP
+version: 2
diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml
index c048edf698..7ea53c362b 100644
--- a/detections/endpoint/disabling_net_user_account.yml
+++ b/detections/endpoint/disabling_net_user_account.yml
@@ -1,15 +1,21 @@
-name: Disabling Net User Account
-id: c0325326-acd6-11eb-98c2-acde48001122
-version: 2
-date: '2021-05-04'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-05-04'
 description: This analytic will identify a suspicious command-line that disables a
   user account using the `net.exe` utility native to Windows. This technique may used
   by the adversaries to interrupt availability of such users to do their malicious
   act.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: c0325326-acd6-11eb-98c2-acde48001122
+known_false_positives: unknown
+name: Disabling Net User Account
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.parent_process) as parent_process values(Processes.process_id)
   as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
@@ -17,14 +23,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   by  Processes.process_name Processes.original_file_name Processes.dest Processes.user
   Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `disabling_net_user_account_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: unknown
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   analytic_story:
   - XMRig
@@ -44,39 +42,38 @@ tags:
   - T1531
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml
index cf96acc806..b2e45b6c98 100644
--- a/detections/endpoint/disabling_norun_windows_app.yml
+++ b/detections/endpoint/disabling_norun_windows_app.yml
@@ -1,16 +1,23 @@
-name: Disabling NoRun Windows App
-id: de81bc46-9213-11eb-adc9-acde48001122
-version: 2
-date: '2022-01-28'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-28'
 description: This search is to identify modification of registry to disable run application
   in window start menu. this application is known to be a helpful shortcut to windows
   OS user to run known application and also to execute some reg or batch script. This
   technique is used malware to make cleaning of its infection more harder by preventing
   known application run easily through run shortcut.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: de81bc46-9213-11eb-adc9-acde48001122
+known_false_positives: admin may disable this application for non technical user.
+name: Disabling NoRun Windows App
+references:
+- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
+- https://blog.malwarebytes.com/detections/pum-optional-norun/
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun"
   Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
@@ -25,14 +32,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   registry_key_name] | table _time dest user parent_process_name parent_process process_name
   process_path process proc_guid registry_path registry_value_name registry_value_data
   registry_key_name | `disabling_norun_windows_app_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: admin may disable this application for non technical user.
-references:
-- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
-- https://blog.malwarebytes.com/detections/pum-optional-norun/
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -55,25 +54,36 @@ tags:
   - T1562
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.user
-  - Registry.dest
-  - Registry.registry_value_name
   risk_score: 25
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml
index d0ea85b197..cc71448f10 100644
--- a/detections/endpoint/disabling_remote_user_account_control.yml
+++ b/detections/endpoint/disabling_remote_user_account_control.yml
@@ -1,26 +1,25 @@
-name: Disabling Remote User Account Control
-id: bbc644bc-37df-4e1a-9c88-ec9a53e2038c
-version: 4
-date: '2020-11-18'
 author: David Dorsey, Patrick Bareiss, Splunk
-type: TTP
-datamodel: []
+datamodel:
+- Endpoint.Registry
+date: '2020-11-18'
 description: The search looks for modifications to registry keys that control the
   enforcement of Windows User Account Control (UAC).
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA*
-  Registry.registry_value_data="0x00000000" by Registry.dest, Registry.registry_key_name
-  Registry.user Registry.registry_path Registry.registry_value_data Registry.action
-  | `drop_dm_object_name(Registry)` | `disabling_remote_user_account_control_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response
   product, such as Carbon Black, or via other endpoint data sources, such as Sysmon.
   The data used for this search is typically generated via logs that report registry
   modifications.
+id: bbc644bc-37df-4e1a-9c88-ec9a53e2038c
 known_false_positives: This registry key may be modified via administrators to implement
   a change in system policy. This type of change should be a very rare occurrence.
+name: Disabling Remote User Account Control
 references: []
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path=*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLUA*
+  Registry.registry_value_data="0x00000000" by Registry.dest, Registry.registry_key_name
+  Registry.user Registry.registry_path Registry.registry_value_data Registry.action
+  | `drop_dm_object_name(Registry)` | `disabling_remote_user_account_control_filter`'
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -49,24 +48,26 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Registry.action
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_path
-  - Registry.registry_value_name
-  - Registry.dest
-  - Registry.registry_key_name
-  - Registry.user
-  - Registry.action
   risk_score: 42
   security_domain: endpoint
+type: TTP
+version: 4
diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml
index 02bf9ee4e6..fa06d3518b 100644
--- a/detections/endpoint/disabling_systemrestore_in_registry.yml
+++ b/detections/endpoint/disabling_systemrestore_in_registry.yml
@@ -1,15 +1,21 @@
-name: Disabling SystemRestore In Registry
-id: f4f837e2-91fb-11eb-8bf6-acde48001122
-version: 2
-date: '2022-01-28'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-28'
 description: The following search identifies the modification of registry related
   in disabling the system restore of a machine. This event or behavior are seen in
   some RAT malware to make the restore of the infected machine  difficult and keep
   their infection on the box.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: f4f837e2-91fb-11eb-8bf6-acde48001122
+known_false_positives: in some cases admin can disable systemrestore on a machine.
+name: Disabling SystemRestore In Registry
+references:
+- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR"
   OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig"
@@ -25,13 +31,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   registry_key_name] | table _time dest user parent_process_name parent_process process_name
   process_path process proc_guid registry_path registry_value_name registry_value_data
   registry_key_name | `disabling_systemrestore_in_registry_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: in some cases admin can disable systemrestore on a machine.
-references:
-- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -54,25 +53,36 @@ tags:
   - T1562
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.user
-  - Registry.dest
-  - Registry.registry_value_name
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml
index dea2692223..d0a089eda4 100644
--- a/detections/endpoint/disabling_task_manager.yml
+++ b/detections/endpoint/disabling_task_manager.yml
@@ -1,15 +1,22 @@
-name: Disabling Task Manager
-id: dac279bc-9202-11eb-b7fb-acde48001122
-version: 2
-date: '2022-01-28'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-28'
 description: This search is to identifies modification of registry to disable the
   task manager of windows operating system. this event or technique are commonly seen
   in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate
   their process.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: dac279bc-9202-11eb-b7fb-acde48001122
+known_false_positives: admin may disable this application for non technical user.
+name: Disabling Task Manager
+references:
+- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
+- https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr"
   Registry.registry_value_data = "0x00000001" by _time span=1h Registry.dest Registry.user
@@ -24,14 +31,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   registry_key_name] | table _time dest user parent_process_name parent_process process_name
   process_path process proc_guid registry_path registry_value_name registry_value_data
   registry_key_name | `disabling_task_manager_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: admin may disable this application for non technical user.
-references:
-- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
-- https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -53,25 +52,36 @@ tags:
   - T1562
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.user
-  - Registry.dest
-  - Registry.registry_value_name
   risk_score: 42
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
index 31e8145593..30ab349b7f 100644
--- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
+++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
@@ -1,17 +1,24 @@
-name: DLLHost with no Command Line Arguments with Network
-id: f1c07594-a141-11eb-8407-acde48001122
-version: 2
-date: '2021-10-13'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Ports
+- Endpoint.Processes
+date: '2021-10-13'
 description: The following analytic identifies DLLHost.exe with no command line arguments
   with a network connection. It is unusual for DLLHost.exe to execute with no command
   line arguments present. This particular behavior is common with malicious software,
   including Cobalt Strike. During investigation, triage any network connections and
   parallel processes. Identify any suspicious module loads related to credential dumping
   or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node.
+id: f1c07594-a141-11eb-8407-acde48001122
+known_false_positives: Although unlikely, some legitimate third party applications
+  may use a moved copy of dllhost, triggering a false positive.
+name: DLLHost with no Command Line Arguments with Network
+references:
+- https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile
+- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where Processes.process_name=dllhost.exe by _time span=1h  Processes.process_guid
   Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
@@ -21,14 +28,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename  dest as connection_to_CNC]
   | table _time dest parent_process_name process_name process_path process process_guid
   connection_to_CNC dest_port | `dllhost_with_no_command_line_arguments_with_network_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node.
-known_false_positives: Although unlikely, some legitimate third party applications
-  may use a moved copy of dllhost, triggering a false positive.
-references:
-- https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile
-- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
 tags:
   analytic_story:
   - Cobalt Strike
@@ -48,32 +47,41 @@ tags:
   - T1055
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_image
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Ports.dest
+  - Endpoint.Ports.dest_port
+  - Endpoint.Ports.process_guid
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
   - _time
-  - EventID
-  - process_name
-  - process_id
-  - parent_process_name
   - dest_port
+  - parent_process_name
+  - process_name
   - process_path
   risk_score: 49
   security_domain: endpoint
+type: TTP
+version: 2
diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml
index 739eb1ad54..b475af0b30 100644
--- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml
+++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml
@@ -1,17 +1,24 @@
-name: DNS Exfiltration Using Nslookup App
-id: 2452e632-9e0d-11eb-bacd-acde48001122
-version: 1
-date: '2021-04-15'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-04-15'
 description: this search is to detect potential DNS exfiltration using nslookup application.
   This technique are seen in couple of malware and APT group to exfiltrated collected
   data in a infected machine or infected network. This detection is looking for unique
   use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are
   commonly used by attacker and also the retry parameter which is designed to query
   C2 DNS multiple tries.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of nslookup.exe may be used.
+id: 2452e632-9e0d-11eb-bacd-acde48001122
+known_false_positives: admin nslookup usage
+name: DNS Exfiltration Using Nslookup App
+references:
+- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
+- https://www.varonis.com/blog/dns-tunneling/
+- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id values(Processes.parent_process) as parent_process
   count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
@@ -20,15 +27,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   OR Processes.process="*-retry=*" by Processes.dest Processes.user Processes.process_name  |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `dns_exfiltration_using_nslookup_app_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of nslookup.exe may be used.
-known_false_positives: admin nslookup usage
-references:
-- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
-- https://www.varonis.com/blog/dns-tunneling/
-- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
 tags:
   analytic_story:
   - Suspicious DNS Traffic
@@ -51,39 +49,36 @@ tags:
   - T1048
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 72
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/domain_account_discovery_with_dsquery.yml b/detections/endpoint/domain_account_discovery_with_dsquery.yml
index a529264fd2..f151b2f9bb 100644
--- a/detections/endpoint/domain_account_discovery_with_dsquery.yml
+++ b/detections/endpoint/domain_account_discovery_with_dsquery.yml
@@ -1,29 +1,27 @@
-name: Domain Account Discovery with Dsquery
-id: b1a8ce04-04c2-11ec-bea7-acde48001122
-version: 1
-date: '2021-08-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-24'
 description: This analytic looks for the execution of `dsquery.exe` with command-line
   arguments utilized to discover  domain users. The `user` argument returns a list
   of all users registered in the domain. Red Teams and adversaries alike engage in
   remote system discovery for situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: b1a8ce04-04c2-11ec-bea7-acde48001122
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Domain Account Discovery with Dsquery
+references:
+- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
+- https://attack.mitre.org/techniques/T1087/002/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name="dsquery.exe"
   AND Processes.process = "*user*" by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `domain_account_discovery_with_dsquery_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
-- https://attack.mitre.org/techniques/T1087/002/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -43,30 +41,32 @@ tags:
   - T1087
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  - Processes.parent_process_name
   risk_score: 25
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml
index d08b791f3f..396245decf 100644
--- a/detections/endpoint/domain_account_discovery_with_net_app.yml
+++ b/detections/endpoint/domain_account_discovery_with_net_app.yml
@@ -1,29 +1,27 @@
-name: Domain Account Discovery With Net App
-id: 98f6a534-04c2-11ec-96b2-acde48001122
-version: 1
-date: '2021-08-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-24'
 description: This analytic looks for the execution of `net.exe` or `net1.exe` with
   command-line arguments utilized to query for domain users. Red Teams and adversaries
   alike may use net.exe to enumerate domain users for situational awareness and Active
   Directory Discovery.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 98f6a534-04c2-11ec-96b2-acde48001122
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Domain Account Discovery With Net App
+references:
+- https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance
+- https://attack.mitre.org/techniques/T1087/002/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process
   = "* user*" AND Processes.process = "*/do*" by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `domain_account_discovery_with_net_app_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance
-- https://attack.mitre.org/techniques/T1087/002/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -43,32 +41,34 @@ tags:
   - T1087
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  - Processes.parent_process_name
   risk_score: 25
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml
index 5069bf4f2a..549e9cf1e6 100644
--- a/detections/endpoint/domain_account_discovery_with_wmic.yml
+++ b/detections/endpoint/domain_account_discovery_with_wmic.yml
@@ -1,15 +1,20 @@
-name: Domain Account Discovery with Wmic
-id: 383572e0-04c5-11ec-bdcc-acde48001122
-version: 1
-date: '2021-08-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-24'
 description: This analytic looks for the execution of `wmic.exe` with command-line
   arguments utilized to query for domain users. Red Teams and adversaries alike use
   wmic.exe to enumerate domain users for situational awareness and Active Directory
   Discovery.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 383572e0-04c5-11ec-bdcc-acde48001122
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Domain Account Discovery with Wmic
+references:
+- https://attack.mitre.org/techniques/T1087/002/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name="wmic.exe"
   AND Processes.process = "*/NAMESPACE:\\\\root\\directory\\ldap*" AND Processes.process
@@ -18,13 +23,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `domain_account_discovery_with_wmic_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1087/002/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -44,32 +42,34 @@ tags:
   - T1087
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  - Processes.parent_process_name
   risk_score: 25
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/domain_controller_discovery_with_nltest.yml b/detections/endpoint/domain_controller_discovery_with_nltest.yml
index f44aa2ab73..9f34c62180 100644
--- a/detections/endpoint/domain_controller_discovery_with_nltest.yml
+++ b/detections/endpoint/domain_controller_discovery_with_nltest.yml
@@ -1,28 +1,26 @@
-name: Domain Controller Discovery with Nltest
-id: 41243735-89a7-4c83-bcdd-570aa78f00a1
-version: 1
-date: '2021-08-30'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-30'
 description: This analytic looks for the execution of `nltest.exe` with command-line
   arguments utilized to discover remote systems. The arguments `/dclist:` and '/dsgetdc:',
   can be used to return a list of all domain controllers. Red Teams and adversaries
   alike may use nltest.exe to identify domain controllers in a Windows Domain for
   situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 41243735-89a7-4c83-bcdd-570aa78f00a1
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Domain Controller Discovery with Nltest
+references:
+- https://attack.mitre.org/techniques/T1018/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="nltest.exe")
   (Processes.process="*/dclist:*" OR Processes.process="*/dsgetdc:*") by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_controller_discovery_with_nltest_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1018/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -42,26 +40,24 @@ tags:
   - T1018
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 21
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/domain_controller_discovery_with_wmic.yml b/detections/endpoint/domain_controller_discovery_with_wmic.yml
index 9a3933b67c..867382bd4f 100644
--- a/detections/endpoint/domain_controller_discovery_with_wmic.yml
+++ b/detections/endpoint/domain_controller_discovery_with_wmic.yml
@@ -1,28 +1,26 @@
-name: Domain Controller Discovery with Wmic
-id: 64c7adaa-48ee-483c-b0d6-7175bc65e6cc
-version: 1
-date: '2021-09-01'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-01'
 description: This analytic looks for the execution of `wmic.exe` with command-line
   arguments utilized to discover remote systems. The arguments utilized in this command
   line return a list of all domain controllers in a Windows domain. Red Teams and
   adversaries alike use *.exe to identify remote systems for situational awareness
   and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 64c7adaa-48ee-483c-b0d6-7175bc65e6cc
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Domain Controller Discovery with Wmic
+references:
+- https://attack.mitre.org/techniques/T1018/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe")
   (Processes.process="" OR Processes.process="*DomainControllerAddress*") by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_controller_discovery_with_wmic_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1018/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -42,24 +40,22 @@ tags:
   - T1018
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 21
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/domain_group_discovery_with_dsquery.yml b/detections/endpoint/domain_group_discovery_with_dsquery.yml
index d0a5bb3640..8c91950022 100644
--- a/detections/endpoint/domain_group_discovery_with_dsquery.yml
+++ b/detections/endpoint/domain_group_discovery_with_dsquery.yml
@@ -1,27 +1,25 @@
-name: Domain Group Discovery With Dsquery
-id: f0c9d62f-a232-4edd-b17e-bc409fb133d4
-version: 1
-date: '2021-09-01'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-01'
 description: This analytic looks for the execution of `dsquery.exe` with command-line
   arguments utilized to query for domain groups. The argument `group`, returns a list
   of all domain groups. Red Teams and adversaries alike use may leverage dsquery.exe
   to enumerate domain groups for situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: f0c9d62f-a232-4edd-b17e-bc409fb133d4
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Domain Group Discovery With Dsquery
+references:
+- https://attack.mitre.org/techniques/T1069/002/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dsquery.exe")
   (Processes.process="*group*") by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `domain_group_discovery_with_dsquery_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1069/002/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -42,24 +40,22 @@ tags:
   - T1069.002
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/endpoint/domain_group_discovery_with_net.yml
index f591073b41..2fa8981b76 100644
--- a/detections/endpoint/domain_group_discovery_with_net.yml
+++ b/detections/endpoint/domain_group_discovery_with_net.yml
@@ -1,27 +1,25 @@
-name: Domain Group Discovery With Net
-id: f2f14ac7-fa81-471a-80d5-7eb65c3c7349
-version: 1
-date: '2021-08-25'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-25'
 description: This analytic looks for the execution of `net.exe` with command-line
   arguments utilized to query for domain groups. The argument `group /domain`, returns
   a list of all domain groups. Red Teams and adversaries alike use net.exe to enumerate
   domain groups for situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: f2f14ac7-fa81-471a-80d5-7eb65c3c7349
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Domain Group Discovery With Net
+references:
+- https://attack.mitre.org/techniques/T1069/002/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe"
   OR Processes.process_name="net1.exe") (Processes.process=*group* AND Processes.process=*/do*)
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_net_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1069/002/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -42,24 +40,22 @@ tags:
   - T1069.002
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/domain_group_discovery_with_wmic.yml b/detections/endpoint/domain_group_discovery_with_wmic.yml
index 80069157d4..7bf4334de0 100644
--- a/detections/endpoint/domain_group_discovery_with_wmic.yml
+++ b/detections/endpoint/domain_group_discovery_with_wmic.yml
@@ -1,15 +1,19 @@
-name: Domain Group Discovery With Wmic
-id: a87736a6-95cd-4728-8689-3c64d5026b3e
-version: 1
-date: '2021-08-25'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-25'
 description: This analytic looks for the execution of `wmic.exe` with command-line
   arguments utilized to query for domain groups. The arguments utilized in this command
   return a list of all domain groups. Red Teams and adversaries alike use wmic.exe
   to enumerate domain groups for situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: a87736a6-95cd-4728-8689-3c64d5026b3e
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Domain Group Discovery With Wmic
+references:
+- https://attack.mitre.org/techniques/T1069/002/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe")
   (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap* AND Processes.process=*ds_group*
@@ -17,12 +21,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `domain_group_discovery_with_wmic_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1069/002/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -43,24 +41,22 @@ tags:
   - T1069.002
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml
index a5b1c7c64f..e450861bfb 100644
--- a/detections/endpoint/download_files_using_telegram.yml
+++ b/detections/endpoint/download_files_using_telegram.yml
@@ -1,29 +1,26 @@
-name: Download Files Using Telegram
-id: 58194e28-ae5e-11eb-8912-acde48001122
-version: 1
-date: '2021-05-06'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-05-06'
 description: The following analytic will identify a suspicious download by the Telegram
   application on a Windows system. This behavior was identified on a honeypot where
   the adversary gained access, installed Telegram and followed through with downloading
   different network scanners (port, bruteforcer, masscan) to the system and later
   used to mapped the whole network and further move laterally.
-search: '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier"
-  |stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode
-  Image process_id TargetFilename Hash | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `download_files_using_telegram_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name and TargetFilename from your endpoints or Events that
   monitor filestream events which is happened when process download something. (EventCode
   15) If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon
   TA.
+id: 58194e28-ae5e-11eb-8912-acde48001122
 known_false_positives: normal download of file in telegram app. (if it was a common
   app in network)
+name: Download Files Using Telegram
 references:
 - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+search: '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier"
+  |stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode
+  Image process_id TargetFilename Hash | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `download_files_using_telegram_filter`'
 tags:
   analytic_story:
   - XMRig
@@ -43,13 +40,13 @@ tags:
   - T1105
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -64,3 +61,5 @@ tags:
   - Hash
   risk_score: 49
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml
index 0906ac0fba..845225e4e9 100644
--- a/detections/endpoint/drop_icedid_license_dat.yml
+++ b/detections/endpoint/drop_icedid_license_dat.yml
@@ -1,25 +1,22 @@
-name: Drop IcedID License dat
-id: b7a045fc-f14a-11eb-8e79-acde48001122
-version: 1
-date: '2021-07-30'
 author: Teoderick Contreras, Splunk
-type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-07-30'
 description: This search is to detect dropping a suspicious file named as "license.dat"
   in %appdata%. This behavior seen in latest IcedID malware that contain the actual
   core bot that will be injected in other process to do banking stealing.
-search: '`sysmon` EventCode= 11  TargetFilename = "*\\license.dat" AND (TargetFilename="*\\appdata\\*"
-  OR TargetFilename="*\\programdata\\*") |stats count min(_time) as firstTime max(_time)
-  as lastTime by TargetFilename EventCode process_id  process_name Computer | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `drop_icedid_license_dat_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
+id: b7a045fc-f14a-11eb-8e79-acde48001122
 known_false_positives: unknown
+name: Drop IcedID License dat
 references:
 - https://www.cisecurity.org/white-papers/security-primer-icedid/
+search: '`sysmon` EventCode= 11  TargetFilename = "*\\license.dat" AND (TargetFilename="*\\appdata\\*"
+  OR TargetFilename="*\\programdata\\*") |stats count min(_time) as firstTime max(_time)
+  as lastTime by TargetFilename EventCode process_id  process_name Computer | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `drop_icedid_license_dat_filter`'
 tags:
   analytic_story:
   - IcedID
@@ -39,13 +36,13 @@ tags:
   - T1204.002
   observable:
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: SourceImage
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -54,3 +51,5 @@ tags:
   - _time
   risk_score: 63
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml
index ae07891213..a5ba2b9738 100644
--- a/detections/endpoint/dsquery_domain_discovery.yml
+++ b/detections/endpoint/dsquery_domain_discovery.yml
@@ -1,11 +1,7 @@
-name: DSQuery Domain Discovery
-id: cc316032-924a-11eb-91a2-acde48001122
-version: 1
-date: '2021-03-31'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-03-31'
 description: 'The following analytic identifies "dsquery.exe" execution with arguments
   looking for `TrustedDomain` query directly on the command-line. This is typically
   indicative of an Administrator or adversary perform domain trust discovery. Note
@@ -27,22 +23,24 @@ description: 'The following analytic identifies "dsquery.exe" execution with arg
   In addition to trust discovery, review parallel processes for additional behaviors
   performed. Identify the parent process and capture any files (batch files, for example)
   being used.'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: cc316032-924a-11eb-91a2-acde48001122
+known_false_positives: Limited false positives. If there is a true false positive,
+  filter based on command-line or parent process.
+name: DSQuery Domain Discovery
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md
+- http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11)
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc754232(v=ws.11)
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dsquery.exe
   Processes.process=*trustedDomain* by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `dsquery_domain_discovery_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Limited false positives. If there is a true false positive,
-  filter based on command-line or parent process.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md
-- http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/
-- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732952(v=ws.11)
-- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc754232(v=ws.11)
 tags:
   analytic_story:
   - Domain Trust Discovery
@@ -63,35 +61,37 @@ tags:
   - T1482
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 72
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
index f0806cf1a4..8ee2267928 100644
--- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
+++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
@@ -1,26 +1,24 @@
-name: Dump LSASS via comsvcs DLL
-id: 8943b567-f14d-4ee8-a0bb-2121d4ce3184
-version: 2
-date: '2020-02-21'
 author: Patrick Bareiss, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-02-21'
 description: Detect the usage of comsvcs.dll for dumping the lsass process.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*comsvcs.dll*
-  Processes.process=*MiniDump* by Processes.user Processes.process_name Processes.original_file_name
-  Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `dump_lsass_via_comsvcs_dll_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: 8943b567-f14d-4ee8-a0bb-2121d4ce3184
 known_false_positives: None identified.
+name: Dump LSASS via comsvcs DLL
 references:
 - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
 - https://twitter.com/SBousseaden/status/1167417096374050817
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*comsvcs.dll*
+  Processes.process=*MiniDump* by Processes.user Processes.process_name Processes.original_file_name
+  Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `dump_lsass_via_comsvcs_dll_filter`'
 tags:
   analytic_story:
   - Credential Dumping
@@ -50,39 +48,35 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
index ac76cbe814..bb62f4d30e 100644
--- a/detections/endpoint/dump_lsass_via_procdump.yml
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -1,11 +1,7 @@
-name: Dump LSASS via procdump
-id: 3742ebfe-64c2-11eb-ae93-0242ac130002
-version: 2
-date: '2021-09-16'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: 'Detect procdump.exe dumping the lsass process. This query looks for
   both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump
   file with all process memory. Both are highly suspect and should be reviewed. This
@@ -16,21 +12,23 @@ description: 'Detect procdump.exe dumping the lsass process. This query looks fo
   Sysinternals utility has been ran, it is possible there will be a -accepteula on
   the command line. Review other endpoint data sources for cross process (injection)
   into lsass.exe.'
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_procdump` (Processes.process=*-ma*
-  OR Processes.process=*-mm*) Processes.process=*lsass* by Processes.user Processes.process_name
-  Processes.process Processes.original_file_name Processes.dest | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: 3742ebfe-64c2-11eb-ae93-0242ac130002
 known_false_positives: None identified.
+name: Dump LSASS via procdump
 references:
 - https://attack.mitre.org/techniques/T1003/001/
 - https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_procdump` (Processes.process=*-ma*
+  OR Processes.process=*-mm*) Processes.process=*lsass* by Processes.user Processes.process_name
+  Processes.process Processes.original_file_name Processes.dest | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `dump_lsass_via_procdump_filter`'
 tags:
   analytic_story:
   - Credential Dumping
@@ -59,35 +57,35 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/elevated_group_discovery_with_net.yml b/detections/endpoint/elevated_group_discovery_with_net.yml
index 5f4c9e0fb8..6dad251ddb 100644
--- a/detections/endpoint/elevated_group_discovery_with_net.yml
+++ b/detections/endpoint/elevated_group_discovery_with_net.yml
@@ -1,16 +1,22 @@
-name: Elevated Group Discovery With Net
-id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a
-version: 1
-date: '2021-08-25'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-25'
 description: This analytic looks for the execution of `net.exe` or `net1.exe`  with
   command-line arguments utilized to query for specific elevated domain groups. Red
   Teams and adversaries alike use net.exe to enumerate elevated domain groups for
   situational awareness and Active Directory Discovery to identify high privileged
   users.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Elevated Group Discovery With Net
+references:
+- https://attack.mitre.org/techniques/T1069/002/
+- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory
+- https://adsecurity.org/?p=3658
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe"
   OR Processes.process_name="net1.exe") (Processes.process="*group*" AND Processes.process="*/do*")
@@ -21,14 +27,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `elevated_group_discovery_with_net_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1069/002/
-- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory
-- https://adsecurity.org/?p=3658
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -49,26 +47,24 @@ tags:
   - T1069.002
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 21
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/elevated_group_discovery_with_wmic.yml b/detections/endpoint/elevated_group_discovery_with_wmic.yml
index bf92cb2add..aa32226456 100644
--- a/detections/endpoint/elevated_group_discovery_with_wmic.yml
+++ b/detections/endpoint/elevated_group_discovery_with_wmic.yml
@@ -1,15 +1,21 @@
-name: Elevated Group Discovery With Wmic
-id: 3f6bbf22-093e-4cb4-9641-83f47b8444b6
-version: 1
-date: '2021-08-25'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-25'
 description: This analytic looks for the execution of `wmic.exe` with command-line
   arguments utilized to query for specific domain groups. Red Teams and adversaries
   alike use net.exe to enumerate elevated domain groups for situational awareness
   and Active Directory Discovery to identify high privileged users.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 3f6bbf22-093e-4cb4-9641-83f47b8444b6
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Elevated Group Discovery With Wmic
+references:
+- https://attack.mitre.org/techniques/T1069/002/
+- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory
+- https://adsecurity.org/?p=3658
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe")
   (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap*) (Processes.process="*Domain
@@ -19,14 +25,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Admins*") by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `elevated_group_discovery_with_wmic_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1069/002/
-- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory
-- https://adsecurity.org/?p=3658
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -47,26 +45,24 @@ tags:
   - T1069.002
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 21
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml
index 3ad2ad5db9..974e0c7931 100644
--- a/detections/endpoint/enable_rdp_in_other_port_number.yml
+++ b/detections/endpoint/enable_rdp_in_other_port_number.yml
@@ -1,15 +1,21 @@
-name: Enable RDP In Other Port Number
-id: 99495452-b899-11eb-96dc-acde48001122
-version: 2
-date: '2022-01-28'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-28'
 description: This search is to detect a modification to registry to enable rdp to
   a machine with different port number. This technique was seen in some atttacker
   tries to do lateral movement and remote access to a compromised machine to gain
   control of it.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 99495452-b899-11eb-96dc-acde48001122
+known_false_positives: unknown
+name: Enable RDP In Other Port Number
+references:
+- https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal
   Server\\WinStations\\RDP-Tcp*" Registry.registry_value_name = "PortNumber" by _time
@@ -24,13 +30,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   registry_key_name] | table _time dest user parent_process_name parent_process process_name
   process_path process proc_guid registry_path registry_value_name registry_value_data
   registry_key_name | `enable_rdp_in_other_port_number_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: unknown
-references:
-- https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/
 tags:
   analytic_story:
   - Prohibited Traffic Allowed or Protocol Mismatch
@@ -49,24 +48,35 @@ tags:
   - T1021
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_path
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_value_name
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml
index cc55d2f898..3080b6c896 100644
--- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml
+++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml
@@ -1,16 +1,24 @@
-name: Enable WDigest UseLogonCredential Registry
-id: 0c7d8ffe-25b1-11ec-9f39-acde48001122
-version: 2
-date: '2022-01-28'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-28'
 description: This analytic is to detect a suspicious registry modification to enable
   plain text credential feature of windows. This technique was used by several malware
   and also by mimikatz to be able to dumpe the a plain text credential to the compromised
   or target host. This TTP is really a good indicator that someone wants to dump the
   crendential of the host so it must be a good pivot for credential dumping techniques.
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+id: 0c7d8ffe-25b1-11ec-9f39-acde48001122
+known_false_positives: unknown
+name: Enable WDigest UseLogonCredential Registry
+references:
+- https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html
 search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
   max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest\\*"
   Registry.registry_value_name = "UseLogonCredential" Registry.registry_value_data
@@ -26,15 +34,6 @@ search: '| tstats `security_content_summariesonly` count  min(_time) as firstTim
   _time dest user parent_process_name parent_process process_name process_path process
   proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `enable_wdigest_uselogoncredential_registry_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: unknown
-references:
-- https://www.csoonline.com/article/3438824/how-to-detect-and-halt-credential-theft-via-windows-wdigest.html
 tags:
   analytic_story:
   - Credential Dumping
@@ -54,26 +53,36 @@ tags:
   - T1003
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_value_name
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.registry_value_data
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml
index c560e7562a..94202a11c9 100644
--- a/detections/endpoint/enumerate_users_local_group_using_telegram.yml
+++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml
@@ -1,26 +1,23 @@
-name: Enumerate Users Local Group Using Telegram
-id: fcd74532-ae54-11eb-a5ab-acde48001122
-version: 1
-date: '2021-05-06'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-05-06'
 description: This analytic will detect a suspicious Telegram process enumerating all
   network users in a local group. This technique was seen in a Monero infected honeypot
   to mapped all the users on the compromised system. EventCode 4798 is generated when
   a process enumerates a user's security-enabled local groups on a computer or device.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the Task Schedule (Exa. Security Log EventCode 4798) endpoints. Tune and
+  filter known instances of process like logonUI used in your environment.
+id: fcd74532-ae54-11eb-a5ab-acde48001122
+known_false_positives: unknown
+name: Enumerate Users Local Group Using Telegram
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798
 search: '`wineventlog_security` EventCode=4798  Process_Name = "*\\telegram.exe" |
   stats count min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode
   Process_Name  Process_ID Account_Name Account_Domain Logon_ID Security_ID Message
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `enumerate_users_local_group_using_telegram_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the Task Schedule (Exa. Security Log EventCode 4798) endpoints. Tune and
-  filter known instances of process like logonUI used in your environment.
-known_false_positives: unknown
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
-- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4798
 tags:
   analytic_story:
   - XMRig
@@ -40,13 +37,13 @@ tags:
   - T1087
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: ComputerName
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -64,3 +61,5 @@ tags:
   - Message
   risk_score: 80
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/esentutl_sam_copy.yml b/detections/endpoint/esentutl_sam_copy.yml
index 3daea35709..bf51aeb00f 100644
--- a/detections/endpoint/esentutl_sam_copy.yml
+++ b/detections/endpoint/esentutl_sam_copy.yml
@@ -1,30 +1,28 @@
-name: Esentutl SAM Copy
-id: d372f928-ce4f-11eb-a762-acde48001122
-version: 1
-date: '2021-08-18'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-18'
 description: The following analytic identifies the process - `esentutl.exe` - being
   used to capture credentials stored in ntds.dit or the SAM file on disk. During triage,
   review parallel processes and determine if legitimate activity. Upon determination
   of illegitimate activity, take further action to isolate and contain the threat.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: d372f928-ce4f-11eb-a762-acde48001122
+known_false_positives: False positives should be limited. Filter as needed.
+name: Esentutl SAM Copy
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md
+- https://attack.mitre.org/software/S0404/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_esentutl` Processes.process
   IN ("*ntds*", "*SAM*") by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `esentutl_sam_copy_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives should be limited. Filter as needed.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md
-- https://attack.mitre.org/software/S0404/
 tags:
   analytic_story:
   - Credential Dumping
@@ -46,37 +44,36 @@ tags:
   - T1003
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml
index 041d54c3a3..684a9cb396 100644
--- a/detections/endpoint/etw_registry_disabled.yml
+++ b/detections/endpoint/etw_registry_disabled.yml
@@ -1,14 +1,22 @@
-name: ETW Registry Disabled
-id: 8ed523ac-276b-11ec-ac39-acde48001122
-version: 2
-date: '2022-01-28'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-28'
 description: This analytic is to detect a registry modification to disable ETW feature
   of windows. This technique is to evade EDR appliance to evade detections and hide
   its execution from audit logs.
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+id: 8ed523ac-276b-11ec-ac39-acde48001122
+known_false_positives: unknown
+name: ETW Registry Disabled
+references:
+- https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3
 search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
   max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SOFTWARE\\Microsoft\\.NETFramework*"
   Registry.registry_value_name = ETWEnabled Registry.registry_value_data=0x00000000
@@ -24,15 +32,6 @@ search: '| tstats `security_content_summariesonly` count  min(_time) as firstTim
   _time dest user parent_process_name parent_process process_name process_path process
   proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `etw_registry_disabled_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: unknown
-references:
-- https://gist.github.com/Cyb3rWard0g/a4a115fd3ab518a0e593525a379adee3
 tags:
   analytic_story:
   - Windows Persistence Techniques
@@ -54,26 +53,36 @@ tags:
   - T1562
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.registry_value_data
   risk_score: 90
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml
index 9669c84655..5250531bc6 100644
--- a/detections/endpoint/eventvwr_uac_bypass.yml
+++ b/detections/endpoint/eventvwr_uac_bypass.yml
@@ -1,17 +1,25 @@
-name: Eventvwr UAC Bypass
-id: 9cf8fe08-7ad8-11eb-9819-acde48001122
-version: 2
-date: '2022-01-28'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-28'
 description: The following search identifies Eventvwr bypass by identifying the registry
   modification into a specific path that eventvwr.msc looks to (but is not valid)
   upon execution. A successful attack will include a suspicious command to be executed
   upon eventvwr.msc loading. Upon triage, review the parallel processes that have
   executed. Identify any additional registry modifications on the endpoint that may
   look suspicious. Remediate as necessary.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node.
+id: 9cf8fe08-7ad8-11eb-9819-acde48001122
+known_false_positives: Some false positives may be present and will need to be filtered.
+name: Eventvwr UAC Bypass
+references:
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
+- https://attack.mitre.org/techniques/T1548/002
+- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
 search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
   as registry_key_name values(Registry.registry_path) as registry_path min(_time)
   as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where  Registry.registry_path="*mscfile\\shell\\open\\command\\*"
@@ -27,15 +35,6 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr
   _time dest user parent_process_name parent_process process_name process_path process
   proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `eventvwr_uac_bypass_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node.
-known_false_positives: Some false positives may be present and will need to be filtered.
-references:
-- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
-- https://attack.mitre.org/techniques/T1548/002
-- https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -59,25 +58,36 @@ tags:
   - T1548
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.user
-  - Registry.dest
-  - Registry.registry_value_name
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml
index b838d060fa..dd485311b4 100644
--- a/detections/endpoint/excel_spawning_powershell.yml
+++ b/detections/endpoint/excel_spawning_powershell.yml
@@ -1,11 +1,7 @@
-name: Excel Spawning PowerShell
-id: 42d40a22-9be3-11eb-8f08-acde48001122
-version: 1
-date: '2021-04-12'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-04-12'
 description: The following detection identifies Microsoft Excel spawning PowerShell.
   Typically, this is not common behavior and not default with Excel.exe. Excel.exe
   will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16`
@@ -13,22 +9,24 @@ description: The following detection identifies Microsoft Excel spawning PowerSh
   attachment and is actively used. Albeit, the command executed will most likely be
   encoded and captured via another detection. During triage, review parallel processes
   and identify any files that may have been written.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 42d40a22-9be3-11eb-8f08-acde48001122
+known_false_positives: False positives should be limited, but if any are present,
+  filter as needed.
+name: Excel Spawning PowerShell
+references:
+- https://redcanary.com/threat-detection-report/techniques/powershell/
+- https://attack.mitre.org/techniques/T1566/001/
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where Processes.parent_process_name="excel.exe" `process_powershell` by Processes.parent_process
   Processes.process_name Processes.user Processes.dest Processes.original_file_name
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
   | `excel_spawning_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives should be limited, but if any are present,
-  filter as needed.
-references:
-- https://redcanary.com/threat-detection-report/techniques/powershell/
-- https://attack.mitre.org/techniques/T1566/001/
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -49,38 +47,36 @@ tags:
   - T1003
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml
index e808a71e12..8527405d64 100644
--- a/detections/endpoint/excel_spawning_windows_script_host.yml
+++ b/detections/endpoint/excel_spawning_windows_script_host.yml
@@ -1,11 +1,7 @@
-name: Excel Spawning Windows Script Host
-id: 57fe880a-9be3-11eb-9bf3-acde48001122
-version: 1
-date: '2021-04-12'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-04-12'
 description: The following detection identifies Microsoft Excel spawning Windows Script
   Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and
   not default with Excel.exe. Excel.exe will generally be found in the following path
@@ -16,21 +12,23 @@ description: The following detection identifies Microsoft Excel spawning Windows
   be obfuscated and captured via another detection. During triage, review parallel
   processes and identify any files that may have been written. Review the reputation
   of the remote destination and block accordingly.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 57fe880a-9be3-11eb-9bf3-acde48001122
+known_false_positives: False positives should be limited, but if any are present,
+  filter as needed. In some instances, `cscript.exe` is used for legitimate business
+  practices.
+name: Excel Spawning Windows Script Host
+references:
+- https://app.any.run/tasks/8ecfbc29-03d0-421c-a5bf-3905d29192a2/
+- https://attack.mitre.org/techniques/T1566/001/
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where Processes.parent_process_name="excel.exe" Processes.process_name IN ("cscript.exe",
   "wscript.exe")  by Processes.parent_process Processes.process_name Processes.user
   Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
   | `excel_spawning_windows_script_host_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: False positives should be limited, but if any are present,
-  filter as needed. In some instances, `cscript.exe` is used for legitimate business
-  practices.
-references:
-- https://app.any.run/tasks/8ecfbc29-03d0-421c-a5bf-3905d29192a2/
-- https://attack.mitre.org/techniques/T1566/001/
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -51,32 +49,38 @@ tags:
   - T1003
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - process_name
-  - process_id
-  - parent_process_name
   - dest
+  - parent_process_name
+  - process_name
   - user
-  - parent_process_id
   risk_score: 80
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml
index 7726131774..adf7b50ef8 100644
--- a/detections/endpoint/excessive_attempt_to_disable_services.yml
+++ b/detections/endpoint/excessive_attempt_to_disable_services.yml
@@ -1,15 +1,20 @@
-name: Excessive Attempt To Disable Services
-id: 8fa2a0f0-acd9-11eb-8994-acde48001122
-version: 1
-date: '2021-05-04'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-05-04'
 description: This analytic will identify suspicious series of command-line to disable
   several services. This technique is seen where the adversary attempts to disable
   security app services or other malware services to complete the objective on the
   compromised system.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
+id: 8fa2a0f0-acd9-11eb-8994-acde48001122
+known_false_positives: unknown
+name: Excessive Attempt To Disable Services
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
   as lastTime  from datamodel=Endpoint.Processes where   Processes.process_name =
@@ -17,13 +22,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.parent_process_name Processes.dest Processes.user _time span=1m | where
   count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_attempt_to_disable_services_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
-known_false_positives: unknown
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   analytic_story:
   - XMRig
@@ -43,26 +41,28 @@ tags:
   - T1489
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.process_id
-  - Processes.process_name
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.user
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml
index 6802ab9d27..b43a1df740 100644
--- a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml
+++ b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml
@@ -1,29 +1,26 @@
-name: Excessive File Deletion In WinDefender Folder
-id: b5baa09a-7a05-11ec-8da4-acde48001122
-version: 1
-date: '2022-01-20'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2022-01-20'
 description: This analytic will identify excessive file deletion events in the Windows
   Defender folder. This technique was seen in the WhisperGate malware campaign in
   which adversaries abused Nirsofts advancedrun.exe to gain administrative privilege
   to then execute PowerShell commands to delete files within the Windows Defender
   application folder. This behavior is a good indicator the offending process is trying
   to corrupt a Windows Defender installation.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, TargetFilename, and ProcessID executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+id: b5baa09a-7a05-11ec-8da4-acde48001122
+known_false_positives: Windows Defender AV updates may cause this alert. Please update
+  the filter macros to remove false positives.
+name: Excessive File Deletion In WinDefender Folder
+references:
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 search: '`sysmon` EventCode=23 TargetFilename = "*\\ProgramData\\Microsoft\\Windows
   Defender*" | stats values(TargetFilename) as deleted_files min(_time) as firstTime
   max(_time) as lastTime count by user EventCode Image ProcessID Computer |where count
   >=50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `excessive_file_deletion_in_windefender_folder_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, TargetFilename, and ProcessID executions from your endpoints.
-  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: Windows Defender AV updates may cause this alert. Please update
-  the filter macros to remove false positives.
-references:
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - WhisperGate
@@ -48,17 +45,17 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: Computer
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: deleted_files
-    type: File Name
     role:
     - Target
+    type: File Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -73,3 +70,5 @@ tags:
   - ProcessID
   risk_score: 25
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml
index 986e23feaf..1c2721acc5 100644
--- a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml
+++ b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml
@@ -1,30 +1,28 @@
-name: Excessive number of distinct processes created in Windows Temp folder
-id: 23587b6a-c479-11eb-b671-acde48001122
-version: 2
-date: '2022-02-28'
 author: Michael Hart, Mauricio Velazco, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-02-28'
 description: This analytic will identify suspicious series of process executions.  We
   have observed that post exploit framework tools like Koadic and Meterpreter will
   launch an excessive number of processes with distinct file paths from Windows\Temp
   to execute actions on objective.  This behavior is extremely anomalous compared
   to typical application behaviors that use Windows\Temp.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the full process path in the process field of CIM's Process data model.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+  Tune and filter known instances where renamed sc.exe may be used.
+id: 23587b6a-c479-11eb-b671-acde48001122
+known_false_positives: Many benign applications will create processes from executables
+  in Windows\Temp, although unlikely to exceed the given threshold.  Filter as needed.
+name: Excessive number of distinct processes created in Windows Temp folder
+references:
+- https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   distinct_count(Processes.process) as distinct_process_count  min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path
   = "*\\Windows\\Temp\\*" by Processes.dest Processes.user  _time span=20m | where
   distinct_process_count > 37 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the full process path in the process field of CIM's Process data model.
-  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-  Tune and filter known instances where renamed sc.exe may be used.
-known_false_positives: Many benign applications will create processes from executables
-  in Windows\Temp, although unlikely to exceed the given threshold.  Filter as needed.
-references:
-- https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/
 tags:
   analytic_story:
   - Meterpreter
@@ -44,19 +42,22 @@ tags:
   - T1059
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_path
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.dest
-  - Processes.user
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_windows
+type: Anomaly
+version: 2
diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml
index bac83efcff..501f5fcf21 100644
--- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml
+++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml
@@ -1,17 +1,27 @@
-name: Excessive number of service control start as disabled
-id: 77592bec-d5cc-11eb-9e60-acde48001122
-version: 1
-date: '2021-06-25'
 author: Michael Hart, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-06-25'
 description: This detection targets behaviors observed when threat actors have used
   sc.exe to modify services. We observed malware in a honey pot spawning numerous
   sc.exe processes in a short period of time, presumably to impair defenses, possibly
   to block others from compromising the same machine.  This detection will alert when
   we see both an excessive number of sc.exe processes launched with specific commandline
   arguments to disable the start of certain services.
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must be ingesting
+  logs with both the process name and command line from your endpoints. The complete
+  process name with command-line arguments are mapped to the "process" field in the
+  Endpoint data model.
+id: 77592bec-d5cc-11eb-9e60-acde48001122
+known_false_positives: Legitimate programs and administrators will execute sc.exe
+  with the start disabled flag.  It is possible, but unlikely from the telemetry of
+  normal Windows operation we observed, that sc.exe will be called more than seven
+  times in a short period of time.
+name: Excessive number of service control start as disabled
+references:
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create
+- https://attack.mitre.org/techniques/T1562/001/
 search: '| tstats `security_content_summariesonly` distinct_count(Processes.process)
   as distinct_cmdlines values(Processes.process_id) as process_ids min(_time) as firstTime
   max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE Processes.process_name
@@ -19,18 +29,6 @@ search: '| tstats `security_content_summariesonly` distinct_count(Processes.proc
   Processes.parent_process Processes.process_name Processes.parent_process_id, _time
   span=30m | where distinct_cmdlines >= 8 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_number_of_service_control_start_as_disabled_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must be ingesting
-  logs with both the process name and command line from your endpoints. The complete
-  process name with command-line arguments are mapped to the "process" field in the
-  Endpoint data model.
-known_false_positives: Legitimate programs and administrators will execute sc.exe
-  with the start disabled flag.  It is possible, but unlikely from the telemetry of
-  normal Windows operation we observed, that sc.exe will be called more than seven
-  times in a short period of time.
-references:
-- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/sc-create
-- https://attack.mitre.org/techniques/T1562/001/
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -51,27 +49,29 @@ tags:
   - T1562
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml
index 4ddb7bef7a..f89bba2065 100644
--- a/detections/endpoint/excessive_number_of_taskhost_processes.yml
+++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml
@@ -1,17 +1,22 @@
-name: Excessive number of taskhost processes
-id: f443dac2-c7cf-11eb-ab51-acde48001122
-version: 1
-date: '2021-06-07'
 author: Michael Hart
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-06-07'
 description: This detection targets behaviors observed in post exploit kits like Meterpreter
   and Koadic that are run in memory.  We have observed that these tools must invoke
   an excessive number of taskhost.exe and taskhostex.exe processes to complete various
   actions (discovery, lateral movement, etc.).  It is extremely uncommon in the course
   of normal operations to see so many distinct taskhost and taskhostex processes running
   concurrently in a short time frame.
+how_to_implement: To successfully implement this search you need to be ingesting events
+  related to processes on the endpoints that include the name of the process and process
+  id into the `Endpoint` datamodel in the `Processes` node.
+id: f443dac2-c7cf-11eb-ab51-acde48001122
+known_false_positives: Administrators, administrative actions or certain applications
+  may run many instances of taskhost and taskhostex concurrently.  Filter as needed.
+name: Excessive number of taskhost processes
+references:
+- https://attack.mitre.org/software/S0250/
 search: '| tstats `security_content_summariesonly` values(Processes.process_id) as
   process_ids  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
   WHERE Processes.process_name = "taskhost.exe" OR Processes.process_name = "taskhostex.exe"
@@ -22,13 +27,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process_id)
   as taskhostex_count by _time, dest, firstTime, lastTime | where taskhost_count >
   10 and taskhostex_count > 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `excessive_number_of_taskhost_processes_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting events
-  related to processes on the endpoints that include the name of the process and process
-  id into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators, administrative actions or certain applications
-  may run many instances of taskhost and taskhostex concurrently.  Filter as needed.
-references:
-- https://attack.mitre.org/software/S0250/
 tags:
   analytic_story:
   - Meterpreter
@@ -48,24 +46,25 @@ tags:
   - T1033
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
   - _time
-  - Processes.process_id
-  - Processes.process_name
-  - Processes.dest
-  - Processes.user
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_windows
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml
index 6c46da14ca..8081aa0d76 100644
--- a/detections/endpoint/excessive_service_stop_attempt.yml
+++ b/detections/endpoint/excessive_service_stop_attempt.yml
@@ -1,15 +1,21 @@
-name: Excessive Service Stop Attempt
-id: ae8d3f4a-acd7-11eb-8846-acde48001122
-version: 2
-date: '2021-05-04'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-05-04'
 description: This analytic identifies suspicious series of attempt to kill multiple
   services on a system using either `net.exe` or `sc.exe`. This technique is use by
   adversaries to terminate security services or other related services to continue
   there objective and evade detections.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: ae8d3f4a-acd7-11eb-8846-acde48001122
+known_false_positives: unknown
+name: Excessive Service Stop Attempt
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
   as lastTime  from datamodel=Endpoint.Processes where `process_net` OR  Processes.process_name
@@ -18,14 +24,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.parent_process_name Processes.dest Processes.user _time span=1m | where
   count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_service_stop_attempt_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: unknown
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   analytic_story:
   - XMRig
@@ -46,31 +44,29 @@ tags:
   - T1489
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: Anomaly
+version: 2
diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml
index 4bac489fdd..ecc39a7c7b 100644
--- a/detections/endpoint/excessive_usage_of_cacls_app.yml
+++ b/detections/endpoint/excessive_usage_of_cacls_app.yml
@@ -1,15 +1,20 @@
-name: Excessive Usage Of Cacls App
-id: 0bdf6092-af17-11eb-939a-acde48001122
-version: 1
-date: '2021-05-07'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-05-07'
 description: The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe`
   or `icacls.exe` application to change file or folder permission. This behavior is
   commonly seen where the adversary attempts to impair some users from deleting or
   accessing its malware components or artifact from the compromised system.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 0bdf6092-af17-11eb-939a-acde48001122
+known_false_positives: Administrators or administrative scripts may use this application.
+  Filter as needed.
+name: Excessive Usage Of Cacls App
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id  values(Processes.process_name) as process_name
   count min(_time) as firstTime max(_time) as lastTime  from datamodel=Endpoint.Processes
@@ -17,13 +22,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   OR Processes.process_name = "XCACLS.exe" by Processes.parent_process_name Processes.parent_process
   Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_cacls_app_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or administrative scripts may use this application.
-  Filter as needed.
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   analytic_story:
   - XMRig
@@ -43,26 +41,29 @@ tags:
   - T1222
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.process_id
-  - Processes.process_name
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.user
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml
index 107c0ce90d..056d4fdf3a 100644
--- a/detections/endpoint/excessive_usage_of_net_app.yml
+++ b/detections/endpoint/excessive_usage_of_net_app.yml
@@ -1,29 +1,27 @@
-name: Excessive Usage Of Net App
-id: 45e52536-ae42-11eb-b5c6-acde48001122
-version: 2
-date: '2021-05-06'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-05-06'
 description: This analytic identifies excessive usage of `net.exe` or `net1.exe` within
   a bucket of time (1 minute). This behavior was seen in a Monero incident where the
   adversary attempts to create many users, delete and disable users as part of its
   malicious behavior.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 45e52536-ae42-11eb-b5c6-acde48001122
+known_false_positives: unknown. Filter as needed. Modify the time span as needed.
+name: Excessive Usage Of Net App
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
   as lastTime  from datamodel=Endpoint.Processes where `process_net` by Processes.process_name
   Processes.parent_process_name Processes.original_file_name Processes.dest Processes.user
   _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_usage_of_net_app_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: unknown. Filter as needed. Modify the time span as needed.
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   analytic_story:
   - XMRig
@@ -45,36 +43,34 @@ tags:
   - T1531
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: process_name
-    type: Process Name
     role:
     - Process
     - Attacker
+    type: Process Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 28
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: Anomaly
+version: 2
diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml
index 48b38da855..5d5910cc82 100644
--- a/detections/endpoint/excessive_usage_of_nslookup_app.yml
+++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml
@@ -1,32 +1,29 @@
-name: Excessive Usage of NSLOOKUP App
-id: 0a69fdaa-a2b8-11eb-b16d-acde48001122
-version: 1
-date: '2021-04-21'
 author: Teoderick Contreras, Stanislav Miskovic, Splunk
-type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-04-21'
 description: This search is to detect potential DNS exfiltration using nslookup application.
   This technique are seen in couple of malware and APT group to exfiltrated collected
   data in a infected machine or infected network. This detection is looking for unique
   use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are
   commonly used by attacker and also the retry parameter which is designed to query
   C2 DNS multiple tries.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of nslookup.exe may be used.
+id: 0a69fdaa-a2b8-11eb-b16d-acde48001122
+known_false_positives: unknown
+name: Excessive Usage of NSLOOKUP App
+references:
+- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
+- https://www.varonis.com/blog/dns-tunneling/
+- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
 search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" |  bucket _time span=15m
   | stats count as numNsLookup by Computer, _time |  eventstats avg(numNsLookup) as
   avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer |  eval
   upperThreshold=(avgNsLookup + stdNsLookup *3) |  eval isOutlier=if(avgNsLookup >
   20 and avgNsLookup >= upperThreshold, 1, 0) |  search isOutlier=1 | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances of nslookup.exe may be used.
-known_false_positives: unknown
-references:
-- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
-- https://www.varonis.com/blog/dns-tunneling/
-- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
 tags:
   analytic_story:
   - Suspicious DNS Traffic
@@ -50,9 +47,9 @@ tags:
   - T1048
   observable:
   - name: Computer
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -64,3 +61,5 @@ tags:
   - EventCode
   risk_score: 28
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml
index 62ea23123b..253a2851db 100644
--- a/detections/endpoint/excessive_usage_of_sc_service_utility.yml
+++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml
@@ -1,29 +1,26 @@
-name: Excessive Usage Of SC Service Utility
-id: cb6b339e-d4c6-11eb-a026-acde48001122
-version: 1
-date: '2021-06-24'
 author: Teoderick Contreras, Splunk
-type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-06-24'
 description: This search is to detect a suspicious excessive usage of sc.exe in a
   host machine. This technique was seen in several ransomware , xmrig and other malware
   to create, modify, delete or disable a service may related to security application
   or to gain privilege escalation.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used.
+id: cb6b339e-d4c6-11eb-a026-acde48001122
+known_false_positives: excessive execution of sc.exe is quite suspicious since it
+  can modify or execute app in high privilege permission.
+name: Excessive Usage Of SC Service Utility
+references:
+- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
 search: '`sysmon` EventCode = 1 process_name = "sc.exe" |  bucket _time span=15m |
   stats values(process) as process count as numScExe by Computer, _time |  eventstats
   avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots by Computer
   |  eval upperThreshold=(avgScExe + stdScExe *3) |  eval isOutlier=if(avgScExe >
   5 and avgScExe >= upperThreshold, 1, 0) |  search isOutlier=1 | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_usage_of_sc_service_utility_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used.
-known_false_positives: excessive execution of sc.exe is quite suspicious since it
-  can modify or execute app in high privilege permission.
-references:
-- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
 tags:
   analytic_story:
   - Ransomware
@@ -45,3 +42,5 @@ tags:
   - process_name
   - process
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml
index 8f76b5ab68..a8bc41e5a3 100644
--- a/detections/endpoint/excessive_usage_of_taskkill.yml
+++ b/detections/endpoint/excessive_usage_of_taskkill.yml
@@ -1,27 +1,25 @@
-name: Excessive Usage Of Taskkill
-id: fe5bca48-accb-11eb-a67c-acde48001122
-version: 1
-date: '2021-05-04'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-05-04'
 description: This analytic identifies excessive usage of `taskkill.exe` application.
   This application is commonly used by adversaries to evade detections by killing
   security product processes or even other processes to evade detection.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used.
+id: fe5bca48-accb-11eb-a67c-acde48001122
+known_false_positives: Unknown. Filter as needed.
+name: Excessive Usage Of Taskkill
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe"  by
   Processes.parent_process_name Processes.process_name Processes.dest Processes.user
   _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `excessive_usage_of_taskkill_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used.
-known_false_positives: Unknown. Filter as needed.
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   analytic_story:
   - XMRig
@@ -42,31 +40,33 @@ tags:
   - T1562
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: parent_process_name
-    type: Process Name
     role:
     - Parent Process
     - Attacker
+    type: Process Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.dest
-  - Processes.user
-  - Processes.process
-  - Processes.process_id
   risk_score: 28
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
index f3b5cf9ca5..c05436e6f1 100644
--- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
+++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
@@ -1,15 +1,21 @@
-name: Executables Or Script Creation In Suspicious Path
-id: a7e3f0f0-ae42-11eb-b245-acde48001122
-version: 1
-date: '2021-05-06'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2021-05-06'
 description: This analytic will identify suspicious executable or scripts (known file
   extensions) in list of suspicious file path in Windows. This technique is used by
   adversaries to evade detection. The suspicious file path are known paths used in
   the wild and are not common to have executable or scripts.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+id: a7e3f0f0-ae42-11eb-b245-acde48001122
+known_false_positives: Administrators may allow creation of script or exe in the paths
+  specified. Filter as needed.
+name: Executables Or Script Creation In Suspicious Path
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as
   file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
   where (Filesystem.file_name = *.exe OR Filesystem.file_name = *.dll OR Filesystem.file_name
@@ -25,14 +31,6 @@ search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) a
   by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `executables_or_script_creation_in_suspicious_path_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the Filesystem responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
-known_false_positives: Administrators may allow creation of script or exe in the paths
-  specified. Filter as needed.
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - XMRig
@@ -55,30 +53,32 @@ tags:
   - T1036
   observable:
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   - name: process_id
-    type: Process
     role:
     - Attacker
+    type: Process
   - name: file_name
-    type: File Name
     role:
     - Other
     - Attacker
+    type: File Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.process_id
+  - Endpoint.Filesystem.user
   - _time
-  - Filesystem.file_path
-  - Filesystem.file_create_time
-  - Filesystem.process_id
-  - Filesystem.file_name
-  - Filesystem.user
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml
index 9a8c8241a2..6be09cc80e 100644
--- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml
+++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml
@@ -1,27 +1,25 @@
-name: Execute Javascript With Jscript COM CLSID
-id: dc64d064-d346-11eb-8588-acde48001122
-version: 1
-date: '2021-06-22'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-06-22'
 description: This analytic will identify suspicious process of cscript.exe where it
   tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique
   was seen in ransomware (reddot ransomware) where it execute javascript with this
   com object with combination of amsi disabling technique.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+id: dc64d064-d346-11eb-8588-acde48001122
+known_false_positives: unknown
+name: Execute Javascript With Jscript COM CLSID
+references:
+- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cscript.exe"
   Processes.process="*-e:{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}*" by Processes.parent_process_name
   Processes.process_name Processes.process Processes.parent_process Processes.process_id
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `execute_javascript_with_jscript_com_clsid_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the Filesystem responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
-known_false_positives: unknown
-references:
-- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
 tags:
   analytic_story:
   - Ransomware
@@ -43,36 +41,38 @@ tags:
   - T1059.005
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: process_id
-    type: Process
     role:
     - Attacker
+    type: Process
   - name: parent_process_name
-    type: Process Name
     role:
     - Parent Process
     - Attacker
+    type: Process Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.parent_process
-  - Processes.process_id
-  - Processes.dest
-  - Processes.user
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml
index 42dcd578c5..52f04d085b 100644
--- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml
+++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml
@@ -1,26 +1,24 @@
-name: Execution of File with Multiple Extensions
-id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7
-version: 3
-date: '2020-11-18'
 author: Rico Valdez, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-11-18'
 description: This search looks for processes launched from files that have double
   extensions in the file name. This is typically done to obscure the "real" file extension
   and make it appear as though the file being accessed is a data file, as opposed
   to executable content.
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records process activity from your hosts to populate the endpoint data model
+  in the processes node.
+id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7
+known_false_positives: None identified.
+name: Execution of File with Multiple Extensions
+references: []
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process = *.doc.exe
   OR Processes.process = *.htm.exe OR Processes.process = *.html.exe OR Processes.process
   = *.txt.exe OR Processes.process = *.pdf.exe OR Processes.process = *.doc.exe by
   Processes.dest Processes.user Processes.process Processes.parent_process | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | `execution_of_file_with_multiple_extensions_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records process activity from your hosts to populate the endpoint data model
-  in the processes node.
-known_false_positives: None identified.
-references: []
 tags:
   analytic_story:
   - Windows File Extension and Association Abuse
@@ -50,29 +48,31 @@ tags:
   - PR.IP
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: process
-    type: Process
     role:
     - Parent Process
     - Attacker
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.process
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 3
diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml
index cb08f69826..98afb9907a 100644
--- a/detections/endpoint/extraction_of_registry_hives.yml
+++ b/detections/endpoint/extraction_of_registry_hives.yml
@@ -1,15 +1,21 @@
-name: Extraction of Registry Hives
-id: 8bbb7d58-b360-11eb-ba21-acde48001122
-version: 2
-date: '2021-09-09'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-09'
 description: The following analytic identifies the use of `reg.exe` exporting Windows
   Registry hives containing credentials. Adversaries may use this technique to export
   registry hives for offline credential access attacks. Typically found executed from
   a untrusted process or script. Upon execution, a file will be written to disk.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 8bbb7d58-b360-11eb-ba21-acde48001122
+known_false_positives: It is possible some agent based products will generate false
+  positives. Filter as needed.
+name: Extraction of Registry Hives
+references:
+- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_reg` (Processes.process=*save*
   OR Processes.process=*export*) AND (Processes.process="*\sam *" OR Processes.process="*\system
@@ -17,14 +23,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `extraction_of_registry_hives_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: It is possible some agent based products will generate false
-  positives. Filter as needed.
-references:
-- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md
 tags:
   analytic_story:
   - DarkSide Ransomware
@@ -47,36 +45,34 @@ tags:
   - T1003
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: parent_process_id
-    type: Process
     role:
     - Parent Process
     - Attacker
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml
index bd44cb5cf9..fd590bd51d 100644
--- a/detections/endpoint/file_with_samsam_extension.yml
+++ b/detections/endpoint/file_with_samsam_extension.yml
@@ -1,13 +1,18 @@
-name: File with Samsam Extension
-id: 02c6cfc2-ae66-4735-bfc7-6291da834cbf
-version: 1
-date: '2018-12-14'
 author: Rico Valdez, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2018-12-14'
 description: The search looks for file writes with extensions consistent with a SamSam
   ransomware attack.
+how_to_implement: You must be ingesting data that records file-system activity from
+  your hosts to populate the Endpoint file-system data-model node. If you are using
+  Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you
+  want to collect data.
+id: 02c6cfc2-ae66-4735-bfc7-6291da834cbf
+known_false_positives: Because these extensions are not typically used in normal operations,
+  you should investigate all results.
+name: File with Samsam Extension
+references: []
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path)
   as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)`
@@ -15,13 +20,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   field=file_name "(?<file_extension>\.[^\.]+)$" | search file_extension=.stubbin
   OR file_extension=.berkshire OR file_extension=.satoshi OR file_extension=.sophos
   OR file_extension=.keyxml | `file_with_samsam_extension_filter`'
-how_to_implement: You must be ingesting data that records file-system activity from
-  your hosts to populate the Endpoint file-system data-model node. If you are using
-  Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which you
-  want to collect data.
-known_false_positives: Because these extensions are not typically used in normal operations,
-  you should investigate all results.
-references: []
 tags:
   analytic_story:
   - SamSam Ransomware
@@ -45,29 +43,31 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: file_name
-    type: File Name
     role:
     - Other
     - Attacker
+    type: File Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.user
   - _time
-  - Filesystem.user
-  - Filesystem.dest
-  - Filesystem.file_path
-  - Filesystem.file_name
   risk_score: 90
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml
index d76c1302c7..3d0e579139 100644
--- a/detections/endpoint/firewall_allowed_program_enable.yml
+++ b/detections/endpoint/firewall_allowed_program_enable.yml
@@ -1,16 +1,24 @@
-name: Firewall Allowed Program Enable
-id: 9a8f63a8-43ac-11ec-904c-acde48001122
-version: 1
-date: '2021-11-12'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-12'
 description: This analytic detects a potential suspicious modification of firewall
   rule allowing to execute specific application. This technique was identified when
   an adversary and red teams to bypassed firewall file execution restriction in a
   targetted host. Take note that this event or command can run by administrator during
   testing or allowing legitimate tool or application.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 9a8f63a8-43ac-11ec-904c-acde48001122
+known_false_positives: A network operator or systems administrator may utilize an
+  automated or manual execution of this firewall rule that may generate false positives.
+  Filter as needed.
+name: Firewall Allowed Program Enable
+references:
+- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process = "*firewall*"
   Processes.process = "*allowedprogram*" Processes.process = "*add*" Processes.process
@@ -18,16 +26,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `firewall_allowed_program_enable_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: A network operator or systems administrator may utilize an
-  automated or manual execution of this firewall rule that may generate false positives.
-  Filter as needed.
-references:
-- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -48,24 +46,26 @@ tags:
   - T1562
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml
index a92768317f..50b6157e73 100644
--- a/detections/endpoint/fodhelper_uac_bypass.yml
+++ b/detections/endpoint/fodhelper_uac_bypass.yml
@@ -1,11 +1,7 @@
-name: FodHelper UAC Bypass
-id: 909f8fd8-7ac8-11eb-a1f3-acde48001122
-version: 1
-date: '2021-03-01'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-03-01'
 description: 'Fodhelper.exe has a known UAC bypass as it attempts to look for specific
   registry keys upon execution, that do not exist. Therefore, an attacker can write
   its malicious commands in these registry keys to be executed by fodhelper.exe with
@@ -20,20 +16,22 @@ description: 'Fodhelper.exe has a known UAC bypass as it attempts to look for sp
   Upon triage, fodhelper.exe will have a child process and read access will occur
   on the registry keys. Isolate the endpoint and review parallel processes for additional
   behavior.'
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=fodhelper.exe
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `fodhelper_uac_bypass_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 909f8fd8-7ac8-11eb-a1f3-acde48001122
 known_false_positives: Limited to no false positives are expected.
+name: FodHelper UAC Bypass
 references:
 - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md
 - https://github.com/gushmazuko/WinBypass/blob/master/FodhelperBypass.ps1
 - https://attack.mitre.org/techniques/T1548/002
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=fodhelper.exe
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `fodhelper_uac_bypass_filter`'
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -58,33 +56,35 @@ tags:
   - T1548
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: parent_process_name
-    type: Process Name
     role:
     - Parent Process
     - Attacker
+    type: Process Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 81
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/fsutil_zeroing_file.yml b/detections/endpoint/fsutil_zeroing_file.yml
index 53787bc8c5..18d8d09801 100644
--- a/detections/endpoint/fsutil_zeroing_file.yml
+++ b/detections/endpoint/fsutil_zeroing_file.yml
@@ -1,27 +1,25 @@
-name: Fsutil Zeroing File
-id: 4e5e024e-fabb-11eb-8b8f-acde48001122
-version: 1
-date: '2021-08-11'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-11'
 description: This search is to detect a suspicious fsutil process to zeroing a target
   file. This technique was seen in lockbit ransomware where it tries to zero out its
   malware path as part of its defense evasion after encrypting the compromised host.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 4e5e024e-fabb-11eb-8b8f-acde48001122
+known_false_positives: unknown
+name: Fsutil Zeroing File
+references:
+- https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fsutil.exe
   Processes.process="*setzerodata*" by Processes.user Processes.process_name Processes.parent_process_name
   Processes.dest  Processes.process Processes.parent_process | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `fsutil_zeroing_file_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: unknown
-references:
-- https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/
 tags:
   analytic_story:
   - Ransomware
@@ -40,22 +38,24 @@ tags:
   - T1070
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.user
-  - Processes.process_name
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.process
-  - Processes.parent_process
   risk_score: 54
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
index b41274ac38..cdfdee700b 100644
--- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
+++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
@@ -1,15 +1,22 @@
-name: Get ADDefaultDomainPasswordPolicy with Powershell
-id: 36e46ebe-065a-11ec-b4c7-acde48001122
-version: 1
-date: '2021-08-26'
 author: Teoderick Contreras, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-26'
 description: This analytic looks for the execution of `powershell.exe` executing the
   Get-ADDefaultDomainPasswordPolicy commandlet used to obtain the password policy
   in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate
   domain policies for situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+id: 36e46ebe-065a-11ec-b4c7-acde48001122
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Get ADDefaultDomainPasswordPolicy with Powershell
+references:
+- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+- https://attack.mitre.org/techniques/T1201/
+- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
   OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADDefaultDomainPasswordPolicy*"
@@ -17,15 +24,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_addefaultdomainpasswordpolicy_with_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
-- https://attack.mitre.org/techniques/T1201/
-- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -44,30 +42,32 @@ tags:
   - T1201
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  - Processes.parent_process_name
   risk_score: 9
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml
index d7d92a915a..f3f803cf81 100644
--- a/detections/endpoint/get_aduser_with_powershell.yml
+++ b/detections/endpoint/get_aduser_with_powershell.yml
@@ -1,15 +1,22 @@
-name: Get ADUser with PowerShell
-id: 0b6ee3f4-04e3-11ec-a87d-acde48001122
-version: 1
-date: '2021-08-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-24'
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to enumerate domain users. The `Get-AdUser' commandlet returns
   a list of all domain users. Red Teams and adversaries alike may use this commandlet
   to identify remote systems for situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 0b6ee3f4-04e3-11ec-a87d-acde48001122
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Get ADUser with PowerShell
+references:
+- https://www.blackhillsinfosec.com/red-blue-purple/
+- https://attack.mitre.org/techniques/T1087/002/
+- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
   OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUser*"
@@ -17,15 +24,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://www.blackhillsinfosec.com/red-blue-purple/
-- https://attack.mitre.org/techniques/T1087/002/
-- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -45,30 +43,32 @@ tags:
   - T1087
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  - Processes.parent_process_name
   risk_score: 25
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
index ff29d907d3..69ebb003ac 100644
--- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
+++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
@@ -1,15 +1,22 @@
-name: Get ADUserResultantPasswordPolicy with Powershell
-id: 8b5ef342-065a-11ec-b0fc-acde48001122
-version: 1
-date: '2021-08-26'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-26'
 description: This analytic looks for the execution of `powershell.exe` executing the
   Get ADUserResultantPasswordPolicy commandlet used to obtain the password policy
   in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate
   domain policies for situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+id: 8b5ef342-065a-11ec-b0fc-acde48001122
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Get ADUserResultantPasswordPolicy with Powershell
+references:
+- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+- https://attack.mitre.org/techniques/T1201/
+- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
   OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUserResultantPasswordPolicy*"
@@ -17,15 +24,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_aduserresultantpasswordpolicy_with_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
-- https://attack.mitre.org/techniques/T1201/
-- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -44,32 +42,34 @@ tags:
   - T1201
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  - Processes.parent_process_name
   risk_score: 25
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml
index a47bfa8f2e..25960f6a3f 100644
--- a/detections/endpoint/get_domainpolicy_with_powershell.yml
+++ b/detections/endpoint/get_domainpolicy_with_powershell.yml
@@ -1,15 +1,22 @@
-name: Get DomainPolicy with Powershell
-id: b8f9947e-065a-11ec-aafb-acde48001122
-version: 1
-date: '2021-08-26'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-26'
 description: This analytic looks for the execution of `powershell.exe` executing the
   `Get-DomainPolicy` commandlet used to obtain the password policy in a Windows domain.
   Red Teams and adversaries alike may use PowerShell to enumerate domain policies
   for situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+id: b8f9947e-065a-11ec-aafb-acde48001122
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Get DomainPolicy with Powershell
+references:
+- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/
+- https://attack.mitre.org/techniques/T1201/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
   OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainPolicy*"
@@ -17,15 +24,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_domainpolicy_with_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
-- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/
-- https://attack.mitre.org/techniques/T1201/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -44,32 +42,34 @@ tags:
   - T1201
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  - Processes.parent_process_name
   risk_score: 30
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/get_domaintrust_with_powershell.yml b/detections/endpoint/get_domaintrust_with_powershell.yml
index 549a7639fb..ee5811fe56 100644
--- a/detections/endpoint/get_domaintrust_with_powershell.yml
+++ b/detections/endpoint/get_domaintrust_with_powershell.yml
@@ -1,31 +1,29 @@
-name: Get-DomainTrust with PowerShell
-id: 4fa7f846-054a-11ec-a836-acde48001122
-version: 1
-date: '2021-08-24'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-24'
 description: This analytic identifies Get-DomainTrust from PowerView in order to gather
   domain trust information. Typically, this is utilized within a script being executed
   and used to enumerate the domain trust information. This grants the adversary an
   understanding of how large or small the domain is. During triage, review parallel
   processes using an EDR product or 4688 events. It will be important to understand
   the timeline of events around this activity.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process=*get-domaintrust*
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: 4fa7f846-054a-11ec-a836-acde48001122
 known_false_positives: Limited false positives as this requires an active Administrator
   or adversary to bring in, import, and execute.
+name: Get-DomainTrust with PowerShell
 references:
 - http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process=*get-domaintrust*
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_filter`'
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -45,31 +43,29 @@ tags:
   - T1482
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 12
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
index 8ad1cbdf75..f790e1fc22 100644
--- a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
@@ -1,10 +1,6 @@
-name: Get-DomainTrust with PowerShell Script Block
-id: 89275e7e-0548-11ec-bf75-acde48001122
-version: 1
-date: '2021-08-24'
 author: Michael Haag, Splunk
-type: TTP
 datamodel: []
+date: '2021-08-24'
 description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify suspicious PowerShell execution. Script Block Logging captures the command
   sent to PowerShell, the full command to be executed. Upon enabling, logs will output
@@ -17,20 +13,22 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message = "*get-foresttrust*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by Message ComputerName User EventCode | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+id: 89275e7e-0548-11ec-bf75-acde48001122
 known_false_positives: It is possible certain system management frameworks utilize
   this command to gather trust information.
+name: Get-DomainTrust with PowerShell Script Block
 references:
 - http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/
 - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+search: '`powershell` EventCode=4104 Message = "*get-foresttrust*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by Message ComputerName User EventCode | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter`'
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -50,28 +48,28 @@ tags:
   - T1482
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: ComputerName
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
+  - ComputerName
   - EventCode
   - Message
-  - Path
-  - OpCode
-  - ComputerName
   - User
+  - _time
   risk_score: 12
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml
index 2977e9943a..0916c187a8 100644
--- a/detections/endpoint/get_domainuser_with_powershell.yml
+++ b/detections/endpoint/get_domainuser_with_powershell.yml
@@ -1,16 +1,21 @@
-name: Get DomainUser with PowerShell
-id: 9a5a41d6-04e7-11ec-923c-acde48001122
-version: 1
-date: '2021-08-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-24'
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to enumerate domain users. `Get-DomainUser` is part of PowerView,
   a PowerShell tool used to perform enumeration on Windows domains. Red Teams and
   adversaries alike may leverage PowerView to enumerate domain users for situational
   awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 9a5a41d6-04e7-11ec-923c-acde48001122
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Get DomainUser with PowerShell
+references:
+- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
   OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainUser*"
@@ -18,13 +23,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_domainuser_with_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -44,32 +42,34 @@ tags:
   - T1087
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  - Processes.parent_process_name
   risk_score: 25
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/get_foresttrust_with_powershell.yml b/detections/endpoint/get_foresttrust_with_powershell.yml
index 3a7aed21ae..df787fa565 100644
--- a/detections/endpoint/get_foresttrust_with_powershell.yml
+++ b/detections/endpoint/get_foresttrust_with_powershell.yml
@@ -1,32 +1,30 @@
-name: Get-ForestTrust with PowerShell
-id: 584f4884-0bf1-11ec-a5ec-acde48001122
-version: 1
-date: '2021-09-02'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-02'
 description: This analytic identifies Get-ForestTrust from PowerSploit in order to
   gather domain trust information. Typically, this is utilized within a script being
   executed and used to enumerate the domain trust information. This grants the adversary
   an understanding of how large or small the domain is. During triage, review parallel
   processes using an EDR product or 4688 events. It will be important to understand
   the timeline of events around this activity.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 584f4884-0bf1-11ec-a5ec-acde48001122
+known_false_positives: Limited false positives as this requires an active Administrator
+  or adversary to bring in, import, and execute.
+name: Get-ForestTrust with PowerShell
+references:
+- https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
   OR Processes.process_name=cmd.exe Processes.process=*get-foresttrust* by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_foresttrust_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives as this requires an active Administrator
-  or adversary to bring in, import, and execute.
-references:
-- https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -46,31 +44,29 @@ tags:
   - T1482
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 12
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
index d04a74656a..c38d2e153c 100644
--- a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
+++ b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
@@ -1,10 +1,6 @@
-name: Get-ForestTrust with PowerShell Script Block
-id: 70fac80e-0bf1-11ec-9ba0-acde48001122
-version: 1
-date: '2021-09-02'
 author: Michael Haag, Splunk
-type: TTP
 datamodel: []
+date: '2021-09-02'
 description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify suspicious PowerShell execution. Script Block Logging captures the command
   sent to PowerShell, the full command to be executed. Upon enabling, logs will output
@@ -17,15 +13,17 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message = "*get-foresttrust*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by  Message OpCode ComputerName User EventCode
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_foresttrust_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+id: 70fac80e-0bf1-11ec-9ba0-acde48001122
 known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+name: Get-ForestTrust with PowerShell Script Block
 references:
 - https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/
+search: '`powershell` EventCode=4104 Message = "*get-foresttrust*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by  Message OpCode ComputerName User EventCode
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_foresttrust_with_powershell_script_block_filter`'
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -45,24 +43,25 @@ tags:
   - T1482
   observable:
   - name: User
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: ComputerName
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
+  - ComputerName
   - EventCode
   - Message
-  - Path
   - OpCode
-  - ComputerName
   - User
+  - _time
   risk_score: 12
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/get_wmiobject_group_discovery.yml b/detections/endpoint/get_wmiobject_group_discovery.yml
index b162b59416..263e8bf92d 100644
--- a/detections/endpoint/get_wmiobject_group_discovery.yml
+++ b/detections/endpoint/get_wmiobject_group_discovery.yml
@@ -1,32 +1,30 @@
-name: Get WMIObject Group Discovery
-id: 5434f670-155d-11ec-8cca-acde48001122
-version: 1
-date: '2021-09-14'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-14'
 description: The following hunting analytic identifies the use of `Get-WMIObject Win32_Group`
   being used with PowerShell to identify local groups on the endpoint. \ Typically,
   by itself, is not malicious but may raise suspicion based on time of day, endpoint
   and username. \ During triage, review parallel processes and identify any further
   suspicious behavior.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=powershell.exe
-  OR processes.process_name=cmd.exe) (Processes.process="*Get-WMIObject*" AND Processes.process="*Win32_Group*")
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`  |
-  `get_wmiobject_group_discovery_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: 5434f670-155d-11ec-8cca-acde48001122
 known_false_positives: False positives may be present. Tune as needed.
+name: Get WMIObject Group Discovery
 references:
 - https://attack.mitre.org/techniques/T1069/001/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=powershell.exe
+  OR Processes.process_name=cmd.exe) (Processes.process="*Get-WMIObject*" AND Processes.process="*Win32_Group*")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`  |
+  `get_wmiobject_group_discovery_filter`'
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -47,29 +45,28 @@ tags:
   - T1069.001
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/getadcomputer_with_powershell.yml b/detections/endpoint/getadcomputer_with_powershell.yml
index 76b9ac8495..00060fa6a0 100644
--- a/detections/endpoint/getadcomputer_with_powershell.yml
+++ b/detections/endpoint/getadcomputer_with_powershell.yml
@@ -1,27 +1,25 @@
-name: GetAdComputer with PowerShell
-id: c5a31f80-5888-4d81-9f78-1cc65026316e
-version: 1
-date: '2021-09-07'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-07'
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to discover remote systems. The `Get-AdComputer' commandlet returns
   a list of all domain computers. Red Teams and adversaries alike may use this commandlet
   to identify remote systems for situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: c5a31f80-5888-4d81-9f78-1cc65026316e
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: GetAdComputer with PowerShell
+references:
+- https://attack.mitre.org/techniques/T1018/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
   (Processes.process=*Get-AdComputer*) by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `getadcomputer_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1018/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -41,24 +39,22 @@ tags:
   - T1018
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/getadgroup_with_powershell.yml b/detections/endpoint/getadgroup_with_powershell.yml
index db1c10b8d6..4beb80ab12 100644
--- a/detections/endpoint/getadgroup_with_powershell.yml
+++ b/detections/endpoint/getadgroup_with_powershell.yml
@@ -1,29 +1,27 @@
-name: GetAdGroup with PowerShell
-id: 872e3063-0fc4-4e68-b2f3-f2b99184a708
-version: 1
-date: '2021-08-25'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-25'
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to query for domain groups. The `Get-AdGroup` commandlnet is
   used to return a list of all groups available in a Windows Domain. Red Teams and
   adversaries alike may leverage this commandlet to enumerate domain groups for situational
   awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 872e3063-0fc4-4e68-b2f3-f2b99184a708
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: GetAdGroup with PowerShell
+references:
+- https://attack.mitre.org/techniques/T1069/002/
+- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
   (Processes.process=*Get-AdGroup*) by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `getadgroup_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1069/002/
-- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -44,24 +42,22 @@ tags:
   - T1069.002
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/getcurrent_user_with_powershell.yml b/detections/endpoint/getcurrent_user_with_powershell.yml
index 01e7598eea..8f9a460594 100644
--- a/detections/endpoint/getcurrent_user_with_powershell.yml
+++ b/detections/endpoint/getcurrent_user_with_powershell.yml
@@ -1,28 +1,26 @@
-name: GetCurrent User with PowerShell
-id: 7eb9c3d5-c98c-4088-acc5-8240bad15379
-version: 1
-date: '2021-09-13'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-13'
 description: This analytic looks for the execution of `powerhsell.exe` with command-line
   arguments that execute the `GetCurrent` method of the WindowsIdentity .NET class.
   This method returns an object that represents the current Windows user. Red Teams
   and adversaries may leverage this method to identify the logged user on a compromised
   endpoint for situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 7eb9c3d5-c98c-4088-acc5-8240bad15379
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: GetCurrent User with PowerShell
+references:
+- https://attack.mitre.org/techniques/T1033/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
   (Processes.process=*System.Security.Principal.WindowsIdentity* OR Processes.process=*GetCurrent()*)
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getcurrent_user_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1033/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -42,25 +40,23 @@ tags:
   - T1033
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
index d1892d1e2a..44a50c4b45 100644
--- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
+++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
@@ -1,27 +1,25 @@
-name: GetCurrent User with PowerShell Script Block
-id: 80879283-c30f-44f7-8471-d1381f6d437a
-version: 1
-date: '2021-09-13'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel: []
+date: '2021-09-13'
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `GetCurrent` method of the WindowsIdentity .NET
   class. This method returns an object that represents the current Windows user. Red
   Teams and adversaries may leverage this method to identify the logged user on a
   compromised endpoint for situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+id: 80879283-c30f-44f7-8471-d1381f6d437a
+known_false_positives: Administrators or power users may use this PowerShell commandlet
+  for troubleshooting.
+name: GetCurrent User with PowerShell Script Block
+references:
+- https://attack.mitre.org/techniques/T1033/
+- https://docs.microsoft.com/en-us/dotnet/api/system.security.principal.windowsidentity.getcurrent?view=net-5.0
 search: '`powershell` EventCode=4104 (Message = "*[System.Security.Principal.WindowsIdentity]*"
   AND Message = "*GetCurrent()*") | stats count min(_time) as firstTime max(_time)
   as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `getcurrent_user_with_powershell_script_block_filter`'
-how_to_implement: To successfully implement this analytic, you will need to enable
-  PowerShell Script Block Logging on some or all endpoints. Additional setup here
-  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Administrators or power users may use this PowerShell commandlet
-  for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1033/
-- https://docs.microsoft.com/en-us/dotnet/api/system.security.principal.windowsidentity.getcurrent?view=net-5.0
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -41,20 +39,20 @@ tags:
   - T1033
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - Path
-  - Message
-  - OpCode
   - ComputerName
-  - User
   - EventCode
+  - Message
+  - User
+  - _time
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/getdomaincomputer_with_powershell.yml b/detections/endpoint/getdomaincomputer_with_powershell.yml
index 4da1c3199e..a8e2f726c8 100644
--- a/detections/endpoint/getdomaincomputer_with_powershell.yml
+++ b/detections/endpoint/getdomaincomputer_with_powershell.yml
@@ -1,28 +1,26 @@
-name: GetDomainComputer with PowerShell
-id: ed550c19-712e-43f6-bd19-6f58f61b3a5e
-version: 1
-date: '2021-09-07'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-07'
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to discover remote systems. `Get-DomainComputer` is part of PowerView,
   a PowerShell tool used to perform enumeration on Windows domains. Red Teams and
   adversaries alike may leverage PowerView to enumerate domain groups for situational
   awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: ed550c19-712e-43f6-bd19-6f58f61b3a5e
+known_false_positives: Administrators or power users may use PowerView for troubleshooting.
+name: GetDomainComputer with PowerShell
+references:
+- https://attack.mitre.org/techniques/T1018/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
   (Processes.process=*Get-DomainComputer*) by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `getdomaincomputer_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use PowerView for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1018/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -42,26 +40,24 @@ tags:
   - T1018
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 24
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/getdomaincontroller_with_powershell.yml b/detections/endpoint/getdomaincontroller_with_powershell.yml
index fedfa7eaf9..826bd7cb8b 100644
--- a/detections/endpoint/getdomaincontroller_with_powershell.yml
+++ b/detections/endpoint/getdomaincontroller_with_powershell.yml
@@ -1,29 +1,27 @@
-name: GetDomainController with PowerShell
-id: 868ee0e4-52ab-484a-833a-6d85b7c028d0
-version: 1
-date: '2021-09-07'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-07'
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to discover remote systems. `Get-DomainController` is part of
   PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red
   Teams and adversaries alike may leverage PowerView to enumerate domain groups for
   situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 868ee0e4-52ab-484a-833a-6d85b7c028d0
+known_false_positives: Administrators or power users may use PowerView for troubleshooting.
+name: GetDomainController with PowerShell
+references:
+- https://attack.mitre.org/techniques/T1018/
+- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
   (Processes.process=*Get-DomainController*) by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `getdomaincontroller_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use PowerView for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1018/
-- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -43,24 +41,22 @@ tags:
   - T1018
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 24
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml
index e3797d79ed..c896660e23 100644
--- a/detections/endpoint/getdomaingroup_with_powershell.yml
+++ b/detections/endpoint/getdomaingroup_with_powershell.yml
@@ -1,29 +1,27 @@
-name: GetDomainGroup with PowerShell
-id: 93c94be3-bead-4a60-860f-77ca3fe59903
-version: 1
-date: '2021-08-25'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-25'
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView,
   a PowerShell tool used to perform enumeration on Windows domains. Red Teams and
   adversaries alike may leverage PowerView to enumerate domain groups for situational
   awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 93c94be3-bead-4a60-860f-77ca3fe59903
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: GetDomainGroup with PowerShell
+references:
+- https://attack.mitre.org/techniques/T1069/002/
+- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
   (Processes.process=*Get-DomainGroup*) by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `getdomaingroup_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1069/002/
-- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -44,26 +42,24 @@ tags:
   - T1069.002
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 15
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml
index 020615cadd..2c80be18c9 100644
--- a/detections/endpoint/getlocaluser_with_powershell.yml
+++ b/detections/endpoint/getlocaluser_with_powershell.yml
@@ -1,28 +1,26 @@
-name: GetLocalUser with PowerShell
-id: 85fae8fa-0427-11ec-8b78-acde48001122
-version: 1
-date: '2021-08-23'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-23'
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to query for local users. The `Get-LocalUser` commandlet is used
   to return a list of all local users. Red Teams and adversaries may leverage this
   commandlet to enumerate users for situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 85fae8fa-0427-11ec-8b78-acde48001122
+known_false_positives: Administrators or power users may use this PowerShell commandlet
+  for troubleshooting.
+name: GetLocalUser with PowerShell
+references:
+- https://attack.mitre.org/techniques/T1087/001/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
   (Processes.process=*Get-LocalUser*) by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `getlocaluser_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this PowerShell commandlet
-  for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1087/001/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -42,14 +40,23 @@ tags:
   - T1087.001
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/getnettcpconnection_with_powershell.yml b/detections/endpoint/getnettcpconnection_with_powershell.yml
index 4dc7f09e60..a5a0b28b97 100644
--- a/detections/endpoint/getnettcpconnection_with_powershell.yml
+++ b/detections/endpoint/getnettcpconnection_with_powershell.yml
@@ -1,28 +1,26 @@
-name: GetNetTcpconnection with PowerShell
-id: e02af35c-1de5-4afe-b4be-f45aba57272b
-version: 1
-date: '2021-08-25'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-25'
 description: This analytic looks for the execution of `powershell.exe` with command-line
   utilized to get a listing of network connections on a compromised system. The `Get-NetTcpConnection`
   commandlet lists the current TCP connections. Red Teams and adversaries alike may
   use this commandlet for situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: e02af35c-1de5-4afe-b4be-f45aba57272b
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: GetNetTcpconnection with PowerShell
+references:
+- https://attack.mitre.org/techniques/T1049/
+- https://docs.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection?view=windowsserver2019-ps
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
   (Processes.process=*Get-NetTcpConnection*) by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `getnettcpconnection_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1049/
-- https://docs.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection?view=windowsserver2019-ps
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -42,24 +40,22 @@ tags:
   - T1049
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml
index 71659ca87e..0a4f844372 100644
--- a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml
+++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml
@@ -1,16 +1,20 @@
-name: GetWmiObject Ds Computer with PowerShell
-id: 7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3
-version: 1
-date: '2021-09-07'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-07'
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to discover remote systems. The `Get-WmiObject` commandlet combined
   with the `DS_Computer` parameter can be used to return a list of all domain computers.
   Red Teams and adversaries alike may leverage WMI in this case, using PowerShell,
   to enumerate domain groups for situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 7141122c-3bc2-4aaa-ab3b-7a85a0bbefc3
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: GetWmiObject Ds Computer with PowerShell
+references:
+- https://attack.mitre.org/techniques/T1018/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
   (Processes.process=*Get-WmiObject* AND Processes.process="*namespace root\\directory\\ldap*"
@@ -18,12 +22,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `getwmiobject_ds_computer_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1018/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -43,26 +41,24 @@ tags:
   - T1018
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 21
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml
index 37f46c9956..bbcd5d43bd 100644
--- a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml
+++ b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml
@@ -1,17 +1,22 @@
-name: GetWmiObject Ds Group with PowerShell
-id: df275a44-4527-443b-b884-7600e066e3eb
-version: 1
-date: '2021-08-25'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-25'
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined
   with the `-class ds_group` parameter can be used to return the full list of groups
   in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case,
   using PowerShell, to enumerate domain groups for situational awareness and Active
   Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: df275a44-4527-443b-b884-7600e066e3eb
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: GetWmiObject Ds Group with PowerShell
+references:
+- https://attack.mitre.org/techniques/T1069/002/
+- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
   (Processes.process=*Get-WmiObject* AND Processes.process="*namespace root\\directory\\ldap*"
@@ -19,13 +24,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `getwmiobject_ds_group_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1069/002/
-- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -46,26 +44,24 @@ tags:
   - T1069.002
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 15
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml
index 9b10a7f427..e0707db491 100644
--- a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml
+++ b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml
@@ -1,17 +1,22 @@
-name: GetWmiObject DS User with PowerShell
-id: 22d3b118-04df-11ec-8fa3-acde48001122
-version: 1
-date: '2021-08-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-24'
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to query for domain users. The `Get-WmiObject` commandlet combined
   with the `-class ds_user` parameter can be used to return the full list of users
   in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case,
   using PowerShell, to enumerate domain users for situational awareness and Active
   Directory Discovery.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 22d3b118-04df-11ec-8fa3-acde48001122
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: GetWmiObject DS User with PowerShell
+references:
+- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
   OR Processes.process_name="powershell*") AND Processes.process = "*get-wmiobject*"
@@ -20,13 +25,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -46,32 +44,34 @@ tags:
   - T1087
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  - Processes.parent_process_name
   risk_score: 25
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml
index f8d752fb4a..640195a685 100644
--- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml
+++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml
@@ -1,29 +1,27 @@
-name: GetWmiObject User Account with PowerShell
-id: b44f6ac6-0429-11ec-87e9-acde48001122
-version: 1
-date: '2021-08-23'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-23'
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to query local users. The `Get-WmiObject` commandlet combined
   with the `Win32_UserAccount` parameter is used to return a list of all local users.
   Red Teams and adversaries may leverage this commandlet to enumerate users for situational
   awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: b44f6ac6-0429-11ec-87e9-acde48001122
+known_false_positives: Administrators or power users may use this PowerShell commandlet
+  for troubleshooting.
+name: GetWmiObject User Account with PowerShell
+references:
+- https://attack.mitre.org/techniques/T1087/001/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
   (Processes.process=*Get-WmiObject* AND Processes.process=*Win32_UserAccount*) by
   Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_user_account_with_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this PowerShell commandlet
-  for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1087/001/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -43,14 +41,23 @@ tags:
   - T1087.001
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml
index f009546893..328ca5a6fb 100644
--- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml
+++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml
@@ -1,11 +1,8 @@
-name: GPUpdate with no Command Line Arguments with Network
-id: 2c853856-a140-11eb-a5b5-acde48001122
-version: 1
-date: '2021-04-19'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Ports
+- Endpoint.Processes
+date: '2021-04-19'
 description: The following analytic identifies gpupdate.exe with no command line arguments
   and with a network connection. It is unusual for gpupdate.exe to execute with no
   command line arguments present. This particular behavior is common with malicious
@@ -13,6 +10,16 @@ description: The following analytic identifies gpupdate.exe with no command line
   and parallel processes. Identify any suspicious module loads related to credential
   dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and
   C:\Windows\syswow64.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 2c853856-a140-11eb-a5b5-acde48001122
+known_false_positives: Limited false positives may be present in small environments.
+  Tuning may be required based on parent process.
+name: GPUpdate with no Command Line Arguments with Network
+references:
+- https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile
+- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where Processes.process_name=gpupdate.exe by _time span=1h  Processes.process_guid
   Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
@@ -22,14 +29,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename  dest as connection_to_CNC]
   | table _time dest parent_process_name process_name process_path process process_guid
   connection_to_CNC dest_port | `gpupdate_with_no_command_line_arguments_with_network_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Limited false positives may be present in small environments.
-  Tuning may be required based on parent process.
-references:
-- https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile
-- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
 tags:
   analytic_story:
   - Cobalt Strike
@@ -51,33 +50,42 @@ tags:
   - T1055
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: parent_process_name
-    type: Process Name
     role:
     - Parent Process
     - Attacker
+    type: Process Name
   - name: connection_to_CNC
-    type: IP Address
     role:
     - Other
+    type: IP Address
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Ports.dest
+  - Endpoint.Ports.dest_port
+  - Endpoint.Ports.process_guid
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
   - _time
-  - EventID
-  - process_name
-  - process_id
-  - parent_process_name
   - dest_port
+  - parent_process_name
+  - process_name
   - process_path
   risk_score: 81
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml
index eac5da28f8..c8a96f5cc9 100644
--- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml
+++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml
@@ -1,16 +1,24 @@
-name: Hide User Account From Sign-In Screen
-id: 834ba832-ad89-11eb-937d-acde48001122
-version: 2
-date: '2022-01-28'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-28'
 description: This analytic identifies a suspicious registry modification to hide a
   user account on the Windows Login screen. This technique was seen in some tradecraft
   where the adversary will create a hidden user account with Admin privileges in login
   screen to avoid noticing by the user that they already compromise and to persist
   on that said machine.
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+id: 834ba832-ad89-11eb-937d-acde48001122
+known_false_positives: Unknown. Filter as needed.
+name: Hide User Account From Sign-In Screen
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
   max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows
   NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist*" AND Registry.registry_value_data
@@ -26,15 +34,6 @@ search: '| tstats `security_content_summariesonly` count  min(_time) as firstTim
   _time dest user parent_process_name parent_process process_name process_path process
   proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `hide_user_account_from_sign_in_screen_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: Unknown. Filter as needed.
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   analytic_story:
   - XMRig
@@ -56,28 +55,40 @@ tags:
   - T1562
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: registry_value_name
-    type: Other
     role:
     - Attacker
+    type: Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.registry_value_name
-  - Registry.dest Registry.user
   risk_score: 72
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml
index 8d475b0572..9054f5cea9 100644
--- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml
+++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml
@@ -1,28 +1,26 @@
-name: Hiding Files And Directories With Attrib exe
-id: c77162d3-f93c-45cc-80c8-22f6b5264g9f
-version: 4
-date: '2020-07-21'
 author: Bhavin Patel, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-07-21'
 description: Attackers leverage an existing Windows binary, attrib.exe, to mark specific
   as hidden by using specific flags so that the victim does not see the file.  The
   search looks for specific command-line arguments to detect the use of attrib.exe
   to hide files.
-search: '| tstats `security_content_summariesonly` count min(_time) values(Processes.process)
-  as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=attrib.exe
-  (Processes.process=*+h*) by Processes.parent_process Processes.process_name Processes.user
-  Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`|
-  `hiding_files_and_directories_with_attrib_exe_filter` '
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.
   The command-line arguments are mapped to the "process" field in the Endpoint data
   model.
+id: c77162d3-f93c-45cc-80c8-22f6b5264g9f
 known_false_positives: 'Some applications and users may legitimately use attrib.exe
   to interact with the files. '
+name: Hiding Files And Directories With Attrib exe
 references: []
+search: '| tstats `security_content_summariesonly` count min(_time) values(Processes.process)
+  as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=attrib.exe
+  (Processes.process=*+h*) by Processes.parent_process Processes.process_name Processes.user
+  Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`|
+  `hiding_files_and_directories_with_attrib_exe_filter` '
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -49,30 +47,32 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: parent_process
-    type: Other
     role:
     - Attacker
     - Parent Process
+    type: Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.process_name
-  - Processes.parent_process
-  - Processes.user
-  - Processes.dest
   risk_score: 72
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 4
diff --git a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml
index 6b7b613d2b..78fb22a0db 100644
--- a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml
+++ b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml
@@ -1,17 +1,21 @@
-name: High Frequency Copy Of Files In Network Share
-id: 40925f12-4709-11ec-bb43-acde48001122
-version: 1
-date: '2021-11-16'
 author: Teoderick Contreras, Splunk
-type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-11-16'
 description: This analytic is to detect a suspicious high frequency copying/moving
   of files in network share as part of information sabotage. This anomaly event can
   be a good indicator of insider trying to sabotage data by transfering classified
   or internal files within network share to exfitrate it after or to lure evidence
   of insider attack to other user. This behavior may catch several noise if network
   share is a common place for classified or internal document processing.
+how_to_implement: o successfully implement this search, you need to be ingesting Windows
+  Security Event Logs with 5145 EventCode enabled. The Windows TA is also required.
+  Also enable the object Audit access success/failure in your group policy.
+id: 40925f12-4709-11ec-bb43-acde48001122
+known_false_positives: this behavior may seen in normal transfer of file within network
+  if network share is common place for sharing documents.
+name: High Frequency Copy Of Files In Network Share
+references:
+- https://attack.mitre.org/techniques/T1537/
 search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.doc","*.docx","*.xls","*.xlsx","*.ppt","*.pptx","*.log","*.txt","*.db","*.7z","*.zip","*.rar","*.tar","*.gz","*.jpg","*.gif","*.png","*.bmp","*.pdf","*.rtf","*.key")
   Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask=
   "0x2" |  bucket _time span=5m | stats values(Relative_Target_Name) as valRelativeTargetName,
@@ -22,13 +26,6 @@ search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.doc",
   _time, EventCode, user |  eval upperThreshold=(avgShareName + stdShareName *3) |  eval
   isOutlier=if(avgShareName > 20 and avgShareName >= upperThreshold, 1, 0) |  search
   isOutlier=1 | `high_frequency_copy_of_files_in_network_share_filter`'
-how_to_implement: o successfully implement this search, you need to be ingesting Windows
-  Security Event Logs with 5145 EventCode enabled. The Windows TA is also required.
-  Also enable the object Audit access success/failure in your group policy.
-known_false_positives: this behavior may seen in normal transfer of file within network
-  if network share is common place for sharing documents.
-references:
-- https://attack.mitre.org/techniques/T1537/
 tags:
   analytic_story:
   - Information Sabotage
@@ -48,9 +45,9 @@ tags:
   - T1537
   observable:
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -67,3 +64,5 @@ tags:
   - Source_Address
   risk_score: 9
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/high_process_termination_frequency.yml b/detections/endpoint/high_process_termination_frequency.yml
index 7c46bf863c..63b625dd35 100644
--- a/detections/endpoint/high_process_termination_frequency.yml
+++ b/detections/endpoint/high_process_termination_frequency.yml
@@ -1,26 +1,23 @@
-name: High Process Termination Frequency
-id: 17cd75b2-8666-11eb-9ab4-acde48001122
-version: 1
-date: '2021-03-16'
 author: Teoderick Contreras
-type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-03-16'
 description: This analytics are designed to indentify a high frequency of process
   termination on a machine which is a common behavior of ransomware malware before
   encrypting files. This technique is designed to avoid an exception error while accessing
   (docs, images, database and etc..) in the infected machine for encryption.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the Image (process full path of terminated process) from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+id: 17cd75b2-8666-11eb-9ab4-acde48001122
+known_false_positives: admin or user tool that can terminate multiple process.
+name: High Process Termination Frequency
+references:
+- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
+- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
 search: '`sysmon` EventCode=5 |bin _time span=3s |stats values(Image) as proc_terminated
   min(_time) as firstTime max(_time) as lastTime  count by Computer EventCode ProcessID
   | where count >= 15 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `high_process_termination_frequency_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the Image (process full path of terminated process) from your endpoints.
-  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: admin or user tool that can terminate multiple process.
-references:
-- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
-- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
 tags:
   analytic_story:
   - Clop Ransomware
@@ -40,13 +37,13 @@ tags:
   - T1486
   observable:
   - name: Computer
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: proc_terminated
-    type: Process
     role:
     - Target
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -59,3 +56,5 @@ tags:
   - ProcessID
   risk_score: 72
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/hunting_for_log4shell.yml b/detections/endpoint/hunting_for_log4shell.yml
index 21de6d3f2e..0a76964d36 100644
--- a/detections/endpoint/hunting_for_log4shell.yml
+++ b/detections/endpoint/hunting_for_log4shell.yml
@@ -1,11 +1,7 @@
-name: Hunting for Log4Shell
-id: 158b68fa-5d1a-11ec-aac8-acde48001122
-version: 1
-date: '2021-12-14'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel:
-- Web
+- Web.Web
+date: '2021-12-14'
 description: 'The following hunting query assists with quickly assessing CVE-2021-44228,
   or Log4Shell, activity mapped to the Web Datamodel. This is a combination query
   attempting to identify, score and dashboard. Because the Log4Shell vulnerability
@@ -43,6 +39,22 @@ description: 'The following hunting query assists with quickly assessing CVE-202
 
   Finally, a simple table is created to show the scoring and the _raw field. Sort
   based on score or columns of interest.'
+how_to_implement: Out of the box, the Web datamodel is required to be pre-filled.
+  However, tested was performed against raw httpd access logs. Change the first line
+  to any dataset to pass the regex's against.
+id: 158b68fa-5d1a-11ec-aac8-acde48001122
+known_false_positives: It is highly possible you will find false positives, however,
+  the base score is set to 2 for _any_ jndi found in raw logs. tune and change as
+  needed, include any filtering.
+name: Hunting for Log4Shell
+references:
+- https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72
+- https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b#gistcomment-3994449
+- https://regex101.com/r/OSrm0q/1/
+- https://github.com/Neo23x0/signature-base/blob/master/yara/expl_log4j_cve_2021_44228.yar
+- https://news.sophos.com/en-us/2021/12/12/log4shell-hell-anatomy-of-an-exploit-outbreak/
+- https://gist.github.com/MHaggis/1899b8554f38c8692a9fb0ceba60b44c
+- https://twitter.com/sasi2103/status/1469764719850442760?s=20
 search: '| from datamodel Web.Web | eval jndi=if(match(_raw, "(\{|%7B)[jJnNdDiI]{4}:"),4,0)
   | eval jndi_fastmatch=if(match(_raw, "[jJnNdDiI]{4}"),2,0) | eval jndi_proto=if(match(_raw,"(?i)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http|https):"),5,0)
   | eval all_match = if(match(_raw, "(?i)(%(25){0,}20|\s)*(%(25){0,}24|\$)(%(25){0,}20|\s)*(%(25){0,}7B|{)(%(25){0,}20|\s)*(%(25){0,}(6A|4A)|J)(%(25){0,}(6E|4E)|N)(%(25){0,}(64|44)|D)(%(25){0,}(69|49)|I)(%(25){0,}20|\s)*(%(25){0,}3A|:)[\w\%]+(%(25){1,}3A|:)(%(25){1,}2F|\/)[^\n]+"),5,0)
@@ -56,20 +68,6 @@ search: '| from datamodel Web.Web | eval jndi=if(match(_raw, "(\{|%7B)[jJnNdDiI]
   jndi, jndi_proto, env_var, uridetect, all_match, jndi_fastmatch, keywords, obf,
   lookups | where Score > 2 | stats values(Score) by  jndi, jndi_proto, env_var, uridetect,
   all_match, jndi_fastmatch, keywords, lookups, obf, _raw | `hunting_for_log4shell_filter`'
-how_to_implement: Out of the box, the Web datamodel is required to be pre-filled.
-  However, tested was performed against raw httpd access logs. Change the first line
-  to any dataset to pass the regex's against.
-known_false_positives: It is highly possible you will find false positives, however,
-  the base score is set to 2 for _any_ jndi found in raw logs. tune and change as
-  needed, include any filtering.
-references:
-- https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72
-- https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b#gistcomment-3994449
-- https://regex101.com/r/OSrm0q/1/
-- https://github.com/Neo23x0/signature-base/blob/master/yara/expl_log4j_cve_2021_44228.yar
-- https://news.sophos.com/en-us/2021/12/12/log4shell-hell-anatomy-of-an-exploit-outbreak/
-- https://gist.github.com/MHaggis/1899b8554f38c8692a9fb0ceba60b44c
-- https://twitter.com/sasi2103/status/1469764719850442760?s=20
 tags:
   analytic_story:
   - Log4Shell CVE-2021-44228
@@ -90,29 +88,24 @@ tags:
   - T1190
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: http_method
-    type: Other
     role:
     - other
+    type: Other
   - name: src
-    type: Other
     role:
     - other
+    type: Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - Web.http_method
-  - Web.url
-  - Web.url_length
-  - Web.src
-  - Web.dest
-  - Web.http_user_agent
   - _raw
   risk_score: 40
   security_domain: network
+type: Hunting
+version: 1
diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml
index b83fcbeec1..88e4555eb7 100644
--- a/detections/endpoint/icacls_deny_command.yml
+++ b/detections/endpoint/icacls_deny_command.yml
@@ -1,15 +1,21 @@
-name: Icacls Deny Command
-id: cf8d753e-a8fe-11eb-8f58-acde48001122
-version: 1
-date: '2021-04-29'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-04-29'
 description: This analytic identifies a potential adversary that changes the security
   permission of a specific file or directory. This technique is commonly seen in APT
   tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent
   access to their component files.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
+id: cf8d753e-a8fe-11eb-8f58-acde48001122
+known_false_positives: Unknown. It is possible some administrative scripts use ICacls.
+  Filter as needed.
+name: Icacls Deny Command
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe"
@@ -17,14 +23,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   AND Processes.process = "*/deny*" by Processes.parent_process_name Processes.process_name
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `icacls_deny_command_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
-known_false_positives: Unknown. It is possible some administrative scripts use ICacls.
-  Filter as needed.
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   analytic_story:
   - XMRig
@@ -44,26 +42,28 @@ tags:
   - T1222
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.dest
-  - Processes.user
-  - Processes.process_id
-  - Processes.process
   risk_score: 72
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml
index c7d56e34d4..fcd631ae73 100644
--- a/detections/endpoint/icacls_grant_command.yml
+++ b/detections/endpoint/icacls_grant_command.yml
@@ -1,15 +1,20 @@
-name: ICACLS Grant Command
-id: b1b1e316-accc-11eb-a9b4-acde48001122
-version: 1
-date: '2021-05-04'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-05-04'
 description: This analytic identifies potential adversaries that modify the security
   permission of a specific file or directory. This technique is commonly seen in APT
   tradecraft and coinminer scripts to evade detections and restrict access to their
   component files.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
+id: b1b1e316-accc-11eb-a9b4-acde48001122
+known_false_positives: Unknown. Filter as needed.
+name: ICACLS Grant Command
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "icacls.exe"
@@ -17,13 +22,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   AND Processes.process = "*/grant*" by Processes.parent_process_name Processes.process_name
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `icacls_grant_command_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
-known_false_positives: Unknown. Filter as needed.
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   analytic_story:
   - XMRig
@@ -44,26 +42,28 @@ tags:
   - T1222
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.dest
-  - Processes.user
-  - Processes.process_id
-  - Processes.process
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml
index 06a6670bcf..302f7f5c92 100644
--- a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml
+++ b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml
@@ -1,25 +1,22 @@
-name: IcedID Exfiltrated Archived File Creation
-id: 0db4da70-f14b-11eb-8043-acde48001122
-version: 1
-date: '2021-07-30'
 author: Teoderick Contreras, Splunk
-type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-07-30'
 description: This search is to detect a suspicious file creation namely passff.tar
   and cookie.tar. This files are possible archived of stolen browser information like
   history and cookies in a compromised machine with IcedID.
-search: '`sysmon` EventCode= 11  (TargetFilename = "*\\passff.tar" OR TargetFilename
-  = "*\\cookie.tar") |stats count min(_time) as firstTime max(_time) as lastTime by
-  TargetFilename EventCode process_id  process_name Computer | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `icedid_exfiltrated_archived_file_creation_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
+id: 0db4da70-f14b-11eb-8043-acde48001122
 known_false_positives: unknown
+name: IcedID Exfiltrated Archived File Creation
 references:
 - https://www.cisecurity.org/white-papers/security-primer-icedid/
+search: '`sysmon` EventCode= 11  (TargetFilename = "*\\passff.tar" OR TargetFilename
+  = "*\\cookie.tar") |stats count min(_time) as firstTime max(_time) as lastTime by
+  TargetFilename EventCode process_id  process_name Computer | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `icedid_exfiltrated_archived_file_creation_filter`'
 tags:
   analytic_story:
   - IcedID
@@ -39,13 +36,13 @@ tags:
   - T1560
   observable:
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: SourceImage
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -59,3 +56,5 @@ tags:
   - Computer
   risk_score: 72
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
index 0668bed541..e1ef2ef3a7 100644
--- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
+++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml
@@ -1,11 +1,7 @@
-name: Impacket Lateral Movement Commandline Parameters
-id: 8ce07472-496f-11ec-ab3b-3e22fbd008af
-version: 2
-date: '2022-01-18'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-01-18'
 description: This analytic looks for the presence of suspicious commandline parameters
   typically present when using Impacket tools. Impacket is a collection of python
   classes meant to be used with Microsoft network protocols. There are multiple scripts
@@ -14,18 +10,14 @@ description: This analytic looks for the presence of suspicious commandline para
   scripts leverage administrative shares and hardcoded parameters that can be used
   as a signature to detect its use. Red Teams and adversaries alike may leverage Impackets
   tools for lateral movement and remote code execution.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*/c* \\\\127.0.0.1\\*"
-  OR Processes.process= "*/c* 2>&1") by Processes.dest Processes.user Processes.parent_process_name
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `impacket_lateral_movement_commandline_parameters_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints.
+id: 8ce07472-496f-11ec-ab3b-3e22fbd008af
 known_false_positives: Although uncommon, Administrators may leverage Impackets tools
   to start a process on remote systems for system administration or automation use
   cases.
+name: Impacket Lateral Movement Commandline Parameters
 references:
 - https://attack.mitre.org/techniques/T1021/002/
 - https://attack.mitre.org/techniques/T1021/003/
@@ -35,6 +27,12 @@ references:
 - https://github.com/SecureAuthCorp/impacket
 - https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*/c* \\\\127.0.0.1\\*"
+  OR Processes.process= "*/c* 2>&1") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `impacket_lateral_movement_commandline_parameters_filter`'
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -59,27 +57,25 @@ tags:
   - T1543.003
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/java_class_file_download_by_java_user_agent.yml b/detections/endpoint/java_class_file_download_by_java_user_agent.yml
index 03c7bc0dbf..c23575c82f 100644
--- a/detections/endpoint/java_class_file_download_by_java_user_agent.yml
+++ b/detections/endpoint/java_class_file_download_by_java_user_agent.yml
@@ -1,26 +1,24 @@
-name: Java Class File download by Java User Agent
-id: 8281ce42-5c50-11ec-82d2-acde48001122
-version: 1
-date: '2021-12-13'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Web
+- Web.Web
+date: '2021-12-13'
 description: The following analytic identifies a Java user agent performing a GET
   request for a .class file from the remote site. This is potentially indicative of
   exploitation of the Java application and may be related to current event CVE-2021-44228
   (Log4Shell).
-search: '| tstats count from datamodel=Web.Web where Web.http_user_agent="*Java*" Web.http_method="GET"
-  Web.url="*.class*" by Web.http_user_agent Web.http_method, Web.url,Web.url_length
-  Web.src, Web.dest | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `java_class_file_download_by_java_user_agent_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   web or proxy logs, or ensure it is being filled by a proxy like device, into the
   Web Datamodel. For additional filtering, allow list private IP space or restrict
   by known good.
+id: 8281ce42-5c50-11ec-82d2-acde48001122
 known_false_positives: Filtering may be required in some instances, filter as needed.
+name: Java Class File download by Java User Agent
 references:
 - https://arstechnica.com/information-technology/2021/12/as-log4shell-wreaks-havoc-payroll-service-reports-ransomware-attack/
+search: '| tstats count from datamodel=Web.Web where Web.http_user_agent="*Java*"
+  Web.http_method="GET" Web.url="*.class*" by Web.http_user_agent Web.http_method,
+  Web.url,Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `java_class_file_download_by_java_user_agent_filter`'
 tags:
   analytic_story:
   - Log4Shell CVE-2021-44228
@@ -42,28 +40,29 @@ tags:
   - T1190
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: http_user_agent
-    type: Other
     role:
     - other
-  - name: http_method
     type: Other
+  - name: http_method
     role:
     - Other
+    type: Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - Web.http_method
-  - Web.url
-  - Web.url_length
-  - Web.src
-  - Web.dest
-  - Web.http_user_agent
+  - Web.Web.dest
+  - Web.Web.http_method
+  - Web.Web.http_user_agent
+  - Web.Web.src
+  - Web.Web.url
+  - Web.Web.url_length
   risk_score: 40
   security_domain: network
+type: TTP
+version: 1
diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml
index ab7430fa8c..2ed8a2d5bf 100644
--- a/detections/endpoint/jscript_execution_using_cscript_app.yml
+++ b/detections/endpoint/jscript_execution_using_cscript_app.yml
@@ -1,16 +1,22 @@
-name: Jscript Execution Using Cscript App
-id: 002f1e24-146e-11ec-a470-acde48001122
-version: 1
-date: '2021-09-13'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-13'
 description: This search is to detect a execution of jscript using cscript process.
   Commonly when a user run jscript file it was executed by wscript.exe application.
   This technique was seen in FIN7 js implant to execute its malicious script using
   cscript process. This behavior is uncommon and a good artifacts to check further
   anomalies within the network
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 002f1e24-146e-11ec-a470-acde48001122
+known_false_positives: unknown
+name: Jscript Execution Using Cscript App
+references:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
   = "cscript.exe" AND Processes.parent_process = "*//e:jscript*") OR (Processes.process_name
@@ -18,14 +24,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.process_id Processes.process
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `jscript_execution_using_cscript_app_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: unknown
-references:
-- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
-- https://attack.mitre.org/groups/G0046/
 tags:
   analytic_story:
   - FIN7
@@ -47,27 +45,29 @@ tags:
   - T1059.007
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process_id
-  - Processes.process
-  - Processes.dest
-  - Processes.user
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
index 80d788cf75..1fa8cf67ed 100644
--- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
+++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
@@ -1,10 +1,6 @@
-name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl
-id: 0cb847ee-9423-11ec-b2df-acde48001122
-version: 1
-date: '2022-02-22'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel: []
+date: '2022-02-22'
 description: The following analytic leverages Windows Security Event 4738, `A user
   account was changed`, to identify a change performed on a domain user object that
   disables Kerberos Pre-Authentication. Disabling the Pre Authentication flag in the
@@ -12,17 +8,19 @@ description: The following analytic leverages Windows Security Event 4738, `A us
   attack against the user's password offline leveraging the ASP REP Roasting technique.
   Red Teams and adversaries alike who have obtained privileges in an Active Directory
   network may use this technique as a backdoor or a way to escalate privileges.
-search: ' `wineventlog_security` EventCode=4738 MSADChangedAttributes="*Don''t Require
-  Preauth'' - Enabled*" | table EventCode, Account_Name, Security_ID, MSADChangedAttributes
-  | `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Domain Controller events. The Advanced Security Audit policy setting `User Account
   Management` within `Account Management` needs to be enabled.
+id: 0cb847ee-9423-11ec-b2df-acde48001122
 known_false_positives: Unknown.
+name: Kerberos Pre-Authentication Flag Disabled in UserAccountControl
 references:
 - https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
 - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
 - https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
+search: ' `wineventlog_security` EventCode=4738 MSADChangedAttributes="*Don''t Require
+  Preauth'' - Enabled*" | table EventCode, Account_Name, Security_ID, MSADChangedAttributes
+  | `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter`'
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
@@ -43,18 +41,19 @@ tags:
   - T1558.004
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - EventCode
   - Account_Name
-  - Security_ID
+  - EventCode
   - MSADChangedAttributes
+  - Security_ID
   risk_score: 45
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml
index fa8b448f0f..3b9e16ffc4 100644
--- a/detections/endpoint/known_services_killed_by_ransomware.yml
+++ b/detections/endpoint/known_services_killed_by_ransomware.yml
@@ -1,28 +1,25 @@
-name: Known Services Killed by Ransomware
-id: 3070f8e0-c528-11eb-b2a0-acde48001122
-version: 1
-date: '2021-06-04'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-06-04'
 description: This search detects a suspicioous termination of known services killed
   by ransomware before encrypting files in a compromised machine. This technique is
   commonly seen in most of ransomware now a days to avoid exception error while accessing
   the targetted files it wants to encrypts because of the open handle of those services
   to the targetted file.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the 7036 EventCode ScManager in System audit Logs from your endpoints.
+id: 3070f8e0-c528-11eb-b2a0-acde48001122
+known_false_positives: Admin activities or installing related updates may do a sudden
+  stop to list of services we monitor.
+name: Known Services Killed by Ransomware
+references:
+- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
+- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
 search: '`wineventlog_system` EventCode=7036 Message IN ("*Volume Shadow Copy*","*VSS*",
   "*backup*", "*sophos*", "*sql*", "*memtas*", "*mepocs*", "*veeam*", "*svc$*") Message="*service
   entered the stopped state*" | stats count min(_time) as firstTime max(_time) as
   lastTime by EventCode Message dest Type | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `known_services_killed_by_ransomware_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the 7036 EventCode ScManager in System audit Logs from your endpoints.
-known_false_positives: Admin activities or installing related updates may do a sudden
-  stop to list of services we monitor.
-references:
-- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
-- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
 tags:
   analytic_story:
   - Ransomware
@@ -42,13 +39,13 @@ tags:
   - T1490
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: Message
-    type: Other
     role:
     - Other
+    type: Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -61,3 +58,5 @@ tags:
   - Type
   risk_score: 72
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml
index 37bbd7ea38..062e4908f9 100644
--- a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml
+++ b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml
@@ -1,11 +1,7 @@
-name: Linux Add Files In Known Crontab Directories
-id: 023f3452-5f27-11ec-bf00-acde48001122
-version: 1
-date: '2021-12-17'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2021-12-17'
 description: The following analytic identifies a suspicious file creation in known
   cron table directories. This event is commonly abuse by malware, adversaries and
   red teamers to persist on the target or compromised host. crontab or cronjob is
@@ -13,20 +9,22 @@ description: The following analytic identifies a suspicious file creation in kno
   script on the known crontab directories to run it base on its schedule. This Anomaly
   query is a good indicator to look further what file is added and who added the file
   if to consider it legitimate file.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the file name, file path, and process_guid executions from your endpoints.
+  If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+id: 023f3452-5f27-11ec-bf00-acde48001122
+known_false_positives: Administrator or network operator can create file in crontab
+  folders for automation purposes. Please update the filter macros to remove false
+  positives.
+name: Linux Add Files In Known Crontab Directories
+references:
+- https://www.sandflysecurity.com/blog/detecting-cronrat-malware-on-linux-instantly/
+- https://www.cyberciti.biz/faq/how-do-i-add-jobs-to-cron-under-linux-or-unix-oses/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/cron*",
   "*/var/spool/cron/*") by Filesystem.dest Filesystem.file_create_time Filesystem.file_name
   Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)`
   | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_add_files_in_known_crontab_directories_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the file name, file path, and process_guid executions from your endpoints.
-  If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
-known_false_positives: Administrator or network operator can create file in crontab
-  folders for automation purposes. Please update the filter macros to remove false
-  positives.
-references:
-- https://www.sandflysecurity.com/blog/detecting-cronrat-malware-on-linux-instantly/
-- https://www.cyberciti.biz/faq/how-do-i-add-jobs-to-cron-under-linux-or-unix-oses/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -54,19 +52,21 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.process_guid
   - _time
-  - Filesystem.dest
-  - Filesystem.file_create_time
-  - Filesystem.file_name
-  - Filesystem.process_guid
-  - Filesystem.file_path
   risk_score: 25
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_add_user_account.yml b/detections/endpoint/linux_add_user_account.yml
index a0c781c9f9..8f6110725e 100644
--- a/detections/endpoint/linux_add_user_account.yml
+++ b/detections/endpoint/linux_add_user_account.yml
@@ -1,30 +1,28 @@
-name: Linux Add User Account
-id: 51fbcaf2-6259-11ec-b0f3-acde48001122
-version: 1
-date: '2021-12-21'
 author: Teoderick Contreras, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-21'
 description: This analytic looks for commands to create user accounts on the linux
   platform. This technique is commonly abuse by adversaries, malware author and red
   teamers to persist on the targeted or compromised host by creating new user with
   an elevated privilege. This Hunting query may catch normal creation of user by administrator
   so filter is needed.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: 51fbcaf2-6259-11ec-b0f3-acde48001122
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+name: Linux Add User Account
+references:
+- https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes
   where Processes.process_name IN ("useradd", "adduser") OR Processes.process IN ("*useradd
   *", "*adduser *") by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_add_user_account_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -52,21 +50,23 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 25
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/linux_at_allow_config_file_creation.yml b/detections/endpoint/linux_at_allow_config_file_creation.yml
index 44c01c5905..b82104d196 100644
--- a/detections/endpoint/linux_at_allow_config_file_creation.yml
+++ b/detections/endpoint/linux_at_allow_config_file_creation.yml
@@ -1,11 +1,7 @@
-name: Linux At Allow Config File Creation
-id: 977b3082-5f3d-11ec-b954-acde48001122
-version: 1
-date: '2021-12-17'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2021-12-17'
 description: The following analytic identifies a suspicious file creation of /etc/at.allow
   or /etc/at.deny. These 2 files are commonly abused by malware, adversaries or red
   teamers to persist on the targeted or compromised host. These config files can restrict
@@ -14,18 +10,20 @@ description: The following analytic identifies a suspicious file creation of /et
   file to execute "at" to schedule it malicious code. This anomaly detection can be
   a good indicator to investigate further the entry in created config file and who
   created it to verify if it is a false positive.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the file name, file path, and process_guid executions from your endpoints.
+  If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+id: 977b3082-5f3d-11ec-b954-acde48001122
+known_false_positives: Administrator or network operator can create this file for
+  automation purposes. Please update the filter macros to remove false positives.
+name: Linux At Allow Config File Creation
+references:
+- https://linuxize.com/post/at-command-in-linux/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/at.allow",
   "*/etc/at.deny") by Filesystem.dest Filesystem.file_create_time Filesystem.file_name
   Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)`
   | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_at_allow_config_file_creation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the file name, file path, and process_guid executions from your endpoints.
-  If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
-known_false_positives: Administrator or network operator can create this file for
-  automation purposes. Please update the filter macros to remove false positives.
-references:
-- https://linuxize.com/post/at-command-in-linux/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -53,19 +51,21 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.process_guid
   - _time
-  - Filesystem.dest
-  - Filesystem.file_create_time
-  - Filesystem.file_name
-  - Filesystem.process_guid
-  - Filesystem.file_path
   risk_score: 25
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml
index 6558da85bd..40ffa91f52 100644
--- a/detections/endpoint/linux_at_application_execution.yml
+++ b/detections/endpoint/linux_at_application_execution.yml
@@ -1,32 +1,30 @@
-name: Linux At Application Execution
-id: bf0a378e-5f3c-11ec-a6de-acde48001122
-version: 1
-date: '2021-12-17'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-17'
 description: The following analytic identifies a suspicious process creation of At
   application. This process can be used by malware, adversaries and red teamers to
   create persistence entry to the targeted or compromised host with their malicious
   code. This anomaly detection can be a good indicator to investigate the event before
   and after this process execution, when it was executed and what schedule task it
   will execute.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: bf0a378e-5f3c-11ec-a6de-acde48001122
+known_false_positives: Administrator or network operator can use this application
+  for automation purposes. Please update the filter macros to remove false positives.
+name: Linux At Application Execution
+references:
+- https://attack.mitre.org/techniques/T1053/001/
+- https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes
   where  Processes.process_name IN ("at", "atd") OR Processes.parent_process_name
   IN ("at", "atd") by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_at_application_execution_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can use this application
-  for automation purposes. Please update the filter macros to remove false positives.
-references:
-- https://attack.mitre.org/techniques/T1053/001/
-- https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -54,21 +52,23 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 9
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_change_file_owner_to_root.yml b/detections/endpoint/linux_change_file_owner_to_root.yml
index bee64e143f..0fc23f397a 100644
--- a/detections/endpoint/linux_change_file_owner_to_root.yml
+++ b/detections/endpoint/linux_change_file_owner_to_root.yml
@@ -1,32 +1,30 @@
-name: Linux Change File Owner To Root
-id: c1400ea2-6257-11ec-ad49-acde48001122
-version: 1
-date: '2021-12-21'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-21'
 description: This analytic looks for a commandline that change the file owner to root
   using chown utility tool. This technique is commonly abuse by adversaries, malware
   author and red teamers to escalate privilege to the targeted or compromised host
   by changing the owner of their malicious file to root. This event is not so common
   in corporate network except from the administrator doing normal task that needs
   high privilege.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: c1400ea2-6257-11ec-ad49-acde48001122
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+name: Linux Change File Owner To Root
+references:
+- https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users
+- https://askubuntu.com/questions/617850/changing-from-user-to-superuser
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = chown
   OR Processes.process = "*chown *") AND Processes.process = "* root *" by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_change_file_owner_to_root_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users
-- https://askubuntu.com/questions/617850/changing-from-user-to-superuser
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -54,21 +52,24 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml
index bf83c6c1ee..3453845546 100644
--- a/detections/endpoint/linux_common_process_for_elevation_control.yml
+++ b/detections/endpoint/linux_common_process_for_elevation_control.yml
@@ -1,17 +1,26 @@
-name: Linux Common Process For Elevation Control
-id: 66ab15c0-63d0-11ec-9e70-acde48001122
-version: 1
-date: '2021-12-23'
 author: Teoderick Contreras, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-23'
 description: This analytic is to look for possible elevation control access using
   a common known process in linux platform to change the attribute and file ownership.
   This technique is commonly abused by adversaries, malware author and red teamers
   to gain persistence or privilege escalation on the target or compromised host. Tis
   common process is used to modify file attribute, file ownership or SUID. This tools
   can be used in legitimate purposes so filter is needed.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: 66ab15c0-63d0-11ec-9e70-acde48001122
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+name: Linux Common Process For Elevation Control
+references:
+- https://attack.mitre.org/techniques/T1548/001/
+- https://github.com/Neo23x0/auditd/blob/master/audit.rules#L285-L297
+- https://github.com/bfuzzy1/auditd-attack/blob/master/auditd-attack/auditd-attack.rules#L269-L270
+- https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/privilege_escalation/T1548.001_ElevationControl_CommonProcesses.xml
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("chmod",
   "chown", "fchmod", "fchmodat", "fchown", "fchownat", "fremovexattr", "fsetxattr",
@@ -23,17 +32,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_common_process_for_elevation_control_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://attack.mitre.org/techniques/T1548/001/
-- https://github.com/Neo23x0/auditd/blob/master/audit.rules#L285-L297
-- https://github.com/bfuzzy1/auditd-attack/blob/master/auditd-attack/auditd-attack.rules#L269-L270
-- https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/privilege_escalation/T1548.001_ElevationControl_CommonProcesses.xml
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -61,21 +59,24 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 9
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/linux_dd_file_overwrite.yml b/detections/endpoint/linux_dd_file_overwrite.yml
index 77ed4d3d15..7d2c5db110 100644
--- a/detections/endpoint/linux_dd_file_overwrite.yml
+++ b/detections/endpoint/linux_dd_file_overwrite.yml
@@ -1,31 +1,29 @@
-name: Linux DD File Overwrite
-id: 9b6aae5e-8d85-11ec-b2ae-acde48001122
-version: 1
-date: '2022-02-14'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-02-14'
 description: This analytic is to look for dd command to overwrite file. This technique
   was abused by adversaries or threat actor to destroy files or data on specific system
   or in a large number of host within network to interrupt host avilability, services
   and many more. This is also used to destroy data where it make the file irrecoverable
   by forensic techniques through overwriting files, data or local and remote drives.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: 9b6aae5e-8d85-11ec-b2ae-acde48001122
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+name: Linux DD File Overwrite
+references:
+- https://gtfobins.github.io/gtfobins/dd/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "dd"
   AND Processes.process = "*of=*" by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_dd_file_overwrite_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://gtfobins.github.io/gtfobins/dd/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
 tags:
   analytic_story:
   - Data Destruction
@@ -49,21 +47,24 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/linux_doas_conf_file_creation.yml b/detections/endpoint/linux_doas_conf_file_creation.yml
index 1a0d7dce2b..51361744fa 100644
--- a/detections/endpoint/linux_doas_conf_file_creation.yml
+++ b/detections/endpoint/linux_doas_conf_file_creation.yml
@@ -1,11 +1,7 @@
-name: Linux Doas Conf File Creation
-id: f6343e86-6e09-11ec-9376-acde48001122
-version: 1
-date: '2022-01-05'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2022-01-05'
 description: This analytic is to detect the creation of doas.conf file in linux host
   platform. This configuration file can be use by doas utility tool to allow or permit
   standard users to perform tasks as root, the same way sudo does. This tool is developed
@@ -13,20 +9,22 @@ description: This analytic is to detect the creation of doas.conf file in linux
   attacker or malware to gain elevated privileges to the targeted or compromised host.
   On the other hand this can also be executed by administrator for a certain task
   that needs admin rights. In this case filter is needed.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: f6343e86-6e09-11ec-9376-acde48001122
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+name: Linux Doas Conf File Creation
+references:
+- https://wiki.gentoo.org/wiki/Doas
+- https://www.makeuseof.com/how-to-install-and-use-doas/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/doas.conf")
   by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid
   Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)`
   | `security_content_ctime(firstTime)` | `linux_doas_conf_file_creation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://wiki.gentoo.org/wiki/Doas
-- https://www.makeuseof.com/how-to-install-and-use-doas/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -54,19 +52,21 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.process_guid
   - _time
-  - Filesystem.dest
-  - Filesystem.file_create_time
-  - Filesystem.file_name
-  - Filesystem.process_guid
-  - Filesystem.file_path
   risk_score: 49
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_doas_tool_execution.yml b/detections/endpoint/linux_doas_tool_execution.yml
index 0997182fa7..8405f025cc 100644
--- a/detections/endpoint/linux_doas_tool_execution.yml
+++ b/detections/endpoint/linux_doas_tool_execution.yml
@@ -1,11 +1,7 @@
-name: Linux Doas Tool Execution
-id: d5a62490-6e09-11ec-884e-acde48001122
-version: 1
-date: '2022-01-05'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-01-05'
 description: This analytic is to detect the doas tool execution in linux host platform.
   This utility tool allow standard users to perform tasks as root, the same way sudo
   does. This tool is developed as a minimalistic alternative to sudo application.
@@ -13,21 +9,23 @@ description: This analytic is to detect the doas tool execution in linux host pl
   to the targeted or compromised host. On the other hand this can also be executed
   by administrator for a certain task that needs admin rights. In this case filter
   is needed.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: d5a62490-6e09-11ec-884e-acde48001122
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+name: Linux Doas Tool Execution
+references:
+- https://wiki.gentoo.org/wiki/Doas
+- https://www.makeuseof.com/how-to-install-and-use-doas/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "doas"
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_doas_tool_execution_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://wiki.gentoo.org/wiki/Doas
-- https://www.makeuseof.com/how-to-install-and-use-doas/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -55,21 +53,24 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_edit_cron_table_parameter.yml b/detections/endpoint/linux_edit_cron_table_parameter.yml
index 17d993daf8..272b0bcc5f 100644
--- a/detections/endpoint/linux_edit_cron_table_parameter.yml
+++ b/detections/endpoint/linux_edit_cron_table_parameter.yml
@@ -1,30 +1,28 @@
-name: Linux Edit Cron Table Parameter
-id: 0d370304-5f26-11ec-a4bb-acde48001122
-version: 1
-date: '2021-12-17'
 author: Teoderick Contreras, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-17'
 description: The following analytic identifies a suspicious cronjobs modification
   using crontab edit parameter. This commandline parameter can be abuse by malware
   author, adversaries, and red red teamers to add cronjob entry to their malicious
   code to execute to the schedule they want. This event can also be executed by administrator
   or normal user for automation purposes so filter is needed.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: 0d370304-5f26-11ec-a4bb-acde48001122
+known_false_positives: Administrator or network operator can use this application
+  for automation purposes. Please update the filter macros to remove false positives.
+name: Linux Edit Cron Table Parameter
+references:
+- https://attack.mitre.org/techniques/T1053/003/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = crontab
   Processes.process = "*crontab *" Processes.process = "* -e*" by Processes.dest Processes.user
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_edit_cron_table_parameter_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can use this application
-  for automation purposes. Please update the filter macros to remove false positives.
-references:
-- https://attack.mitre.org/techniques/T1053/003/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -52,21 +50,23 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 9
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml
index c8e48e229c..e150de803d 100644
--- a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml
+++ b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml
@@ -1,11 +1,7 @@
-name: Linux File Created In Kernel Driver Directory
-id: b85bbeec-6326-11ec-9311-acde48001122
-version: 1
-date: '2021-12-22'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2021-12-22'
 description: This analytic looks for suspicious file creation in kernel/driver directory
   in linux platform. This directory is known folder for all linux kernel module available
   within the system. so creation of file in this directory is a good indicator that
@@ -14,20 +10,22 @@ description: This analytic looks for suspicious file creation in kernel/driver d
   their malicious code such us in kernel level. Even this event is not so common administrator
   or legitimate 3rd party tool may install driver or linux kernel module as part of
   its installation.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the file name, file path, and process_guid executions from your endpoints.
+  If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+id: b85bbeec-6326-11ec-9311-acde48001122
+known_false_positives: Administrator or network operator can create file in this folders
+  for automation purposes. Please update the filter macros to remove false positives.
+name: Linux File Created In Kernel Driver Directory
+references:
+- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/
+- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup
+- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/kernel/drivers/*")
   by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path
   | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `linux_file_created_in_kernel_driver_directory_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the file name, file path, and process_guid executions from your endpoints.
-  If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
-known_false_positives: Administrator or network operator can create file in this folders
-  for automation purposes. Please update the filter macros to remove false positives.
-references:
-- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/
-- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup
-- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -55,19 +53,20 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.process_guid
   - _time
-  - Filesystem.dest
-  - Filesystem.file_create_time
-  - Filesystem.file_name
-  - Filesystem.process_guid
-  - Filesystem.file_path
   risk_score: 72
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml
index 28b9fee84d..282f9630fd 100644
--- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml
+++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml
@@ -1,29 +1,27 @@
-name: Linux File Creation In Init Boot Directory
-id: 97d9cfb2-61ad-11ec-bb2d-acde48001122
-version: 1
-date: '2021-12-20'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2021-12-20'
 description: This analytic looks for suspicious file creation on init system directories
   for automatic execution of script or file upon boot up. This technique is commonly
   abuse by adversaries, malware author and red teamer to persist on the targeted or
   compromised host. This behavior can be executed or use by an administrator or network
   operator to add script files or binary files as part of a task or automation. filter
   is needed.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the file name, file path, and process_guid executions from your endpoints.
+  If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase
+id: 97d9cfb2-61ad-11ec-bb2d-acde48001122
+known_false_positives: Administrator or network operator can create file in this folders
+  for automation purposes. Please update the filter macros to remove false positives.
+name: Linux File Creation In Init Boot Directory
+references:
+- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/init.d/*",
   "*/etc/rc.d/*", "*/sbin/init.d/*", "*/etc/rc.local*") by Filesystem.dest Filesystem.file_name
   Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)`
   | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `linux_file_creation_in_init_boot_directory_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the file name, file path, and process_guid executions from your endpoints.
-  If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase
-known_false_positives: Administrator or network operator can create file in this folders
-  for automation purposes. Please update the filter macros to remove false positives.
-references:
-- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -51,19 +49,20 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.process_guid
   - _time
-  - Filesystem.dest
-  - Filesystem.file_create_time
-  - Filesystem.file_name
-  - Filesystem.process_guid
-  - Filesystem.file_path
   risk_score: 49
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_file_creation_in_profile_directory.yml b/detections/endpoint/linux_file_creation_in_profile_directory.yml
index 7ad259ac67..c085cd64e8 100644
--- a/detections/endpoint/linux_file_creation_in_profile_directory.yml
+++ b/detections/endpoint/linux_file_creation_in_profile_directory.yml
@@ -1,31 +1,29 @@
-name: Linux File Creation In Profile Directory
-id: 46ba0082-61af-11ec-9826-acde48001122
-version: 1
-date: '2021-12-20'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2021-12-20'
 description: This analytic looks for suspicious file creation in /etc/profile.d directory
   to automatically execute scripts by shell upon boot up of a linux machine. This
   technique is commonly abused by adversaries, malware and red teamers as a persistence
   mechanism to the targeted or compromised host. This Anomaly detection is a good
   indicator that someone wants to run a code after boot up which can be done also
   by the administrator or network operator for automation purposes.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the file name, file path, and process_guid executions from your endpoints.
+  If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+id: 46ba0082-61af-11ec-9826-acde48001122
+known_false_positives: Administrator or network operator can create file in profile.d
+  folders for automation purposes. Please update the filter macros to remove false
+  positives.
+name: Linux File Creation In Profile Directory
+references:
+- https://attack.mitre.org/techniques/T1546/004/
+- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/etc/profile.d/*")
   by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid
   Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)`
   | `security_content_ctime(firstTime)` | `linux_file_creation_in_profile_directory_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the file name, file path, and process_guid executions from your endpoints.
-  If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
-known_false_positives: Administrator or network operator can create file in profile.d
-  folders for automation purposes. Please update the filter macros to remove false
-  positives.
-references:
-- https://attack.mitre.org/techniques/T1546/004/
-- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -53,19 +51,21 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.process_guid
   - _time
-  - Filesystem.dest
-  - Filesystem.file_create_time
-  - Filesystem.file_name
-  - Filesystem.process_guid
-  - Filesystem.file_path
   risk_score: 56
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml
index 9efacdd220..cf65f7de5d 100644
--- a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml
+++ b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml
@@ -1,32 +1,30 @@
-name: Linux Insert Kernel Module Using Insmod Utility
-id: 18b5a1a0-6326-11ec-943a-acde48001122
-version: 1
-date: '2021-12-22'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-22'
 description: This analytic looks for inserting of linux kernel module using insmod
   utility function. This event can detect a installation of rootkit or malicious kernel
   module to gain elevated privileges to their malicious code and bypassed detections.
   This Anomaly detection is a good indicator that someone installing kernel module
   in a linux host either admin or adversaries. filter is needed in this scenario
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: 18b5a1a0-6326-11ec-943a-acde48001122
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+name: Linux Insert Kernel Module Using Insmod Utility
+references:
+- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/
+- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup
+- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("kmod",
   "sudo") AND Processes.process = *insmod* by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_insert_kernel_module_using_insmod_utility_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/
-- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup
-- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -53,21 +51,24 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
index 9825cd8934..5f6a4b36f5 100644
--- a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
+++ b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml
@@ -1,32 +1,30 @@
-name: Linux Install Kernel Module Using Modprobe Utility
-id: 387b278a-6326-11ec-aa2c-acde48001122
-version: 1
-date: '2021-12-22'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-22'
 description: This analytic looks for possible installing a linux kernel module using
   modprobe utility function. This event can detect a installation of rootkit or malicious
   kernel module to gain elevated privileges to their malicious code and bypassed detections.
   This Anomaly detection is a good indicator that someone installing kernel module
   in a linux host either admin or adversaries. filter is needed in this scenario
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: 387b278a-6326-11ec-aa2c-acde48001122
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+name: Linux Install Kernel Module Using Modprobe Utility
+references:
+- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/
+- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup
+- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("kmod",
   "sudo") AND Processes.process = *modprobe* by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_install_kernel_module_using_modprobe_utility_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/
-- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup
-- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -54,21 +52,24 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_java_spawning_shell.yml b/detections/endpoint/linux_java_spawning_shell.yml
index 8730e4e55f..0354e2b526 100644
--- a/detections/endpoint/linux_java_spawning_shell.yml
+++ b/detections/endpoint/linux_java_spawning_shell.yml
@@ -1,33 +1,31 @@
-name: Linux Java Spawning Shell
-id: 7b09db8a-5c20-11ec-9945-acde48001122
-version: 1
-date: '2021-12-13'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-13'
 description: The following analytic identifies the process name of Java, Apache, or
   Tomcat spawning a Linux shell. This is potentially indicative of exploitation of
   the Java application and may be related to current event CVE-2021-44228 (Log4Shell).
   The shells included in the macro are "sh", "ksh", "zsh", "bash", "dash", "rbash",
   "fish", "csh', "tcsh', "ion", "eshell". Upon triage, review parallel processes and
   command-line arguments to determine legitimacy.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is
+  occurring correctly. Ensure EDR product is mapping OS Linux to the datamodel properly.
+  Add any additional java process names for your environment to the analytic as needed.
+id: 7b09db8a-5c20-11ec-9945-acde48001122
+known_false_positives: Filtering may be required on internal developer build systems
+  or classify assets as web facing and restrict the analytic based on asset type.
+name: Linux Java Spawning Shell
+references:
+- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
+- https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=java
   OR Processes.parent_process_name=apache OR Processes.parent_process_name=tomcat
   `linux_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_java_spawning_shell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is
-  occurring correctly. Ensure EDR product is mapping OS Linux to the datamodel properly.
-  Add any additional java process names for your environment to the analytic as needed.
-known_false_positives: Filtering may be required on internal developer build systems
-  or classify assets as web facing and restrict the analytic based on asset type.
-references:
-- https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
-- https://gist.github.com/olafhartong/916ebc673ba066537740164f7e7e1d72
 tags:
   analytic_story:
   - Log4Shell CVE-2021-44228
@@ -48,33 +46,31 @@ tags:
   - T1190
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 40
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
index f3c9be8b15..faf4691477 100644
--- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
+++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
@@ -1,11 +1,7 @@
-name: Linux NOPASSWD Entry In Sudoers File
-id: ab1e0d52-624a-11ec-8e0b-acde48001122
-version: 1
-date: '2021-12-21'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-21'
 description: This analytic is to look for suspicious command lines that may add entry
   to /etc/sudoers with NOPASSWD attribute in linux platform. This technique is commonly
   abuse by adversaries, malware author and red teamers to gain elevated privilege
@@ -13,21 +9,23 @@ description: This analytic is to look for suspicious command lines that may add
   commands users can execute on the machines and can also control whether user need
   a password to execute particular commands. This file is composed of aliases (basically
   variables) and user specifications.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: ab1e0d52-624a-11ec-8e0b-acde48001122
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+name: Linux NOPASSWD Entry In Sudoers File
+references:
+- https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands
+- https://help.ubuntu.com/community/Sudoers
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process = "*NOPASSWD:*"
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_nopasswd_entry_in_sudoers_file_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands
-- https://help.ubuntu.com/community/Sudoers
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -55,21 +53,24 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_pkexec_privilege_escalation.yml b/detections/endpoint/linux_pkexec_privilege_escalation.yml
index aa16b886ed..060869e664 100644
--- a/detections/endpoint/linux_pkexec_privilege_escalation.yml
+++ b/detections/endpoint/linux_pkexec_privilege_escalation.yml
@@ -1,20 +1,11 @@
-name: Linux pkexec Privilege Escalation
-id: 03e22c1c-8086-11ec-ac2e-acde48001122
-version: 1
-date: '2022-01-28'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-01-28'
 description: The following analytic identifies `pkexec` spawning with no command-line
   arguments. A vulnerability in Polkit's pkexec component identified as CVE-2021-4034
   (PwnKit) which is present in the default configuration of all major Linux distributions
   and can be exploited to gain full root privileges on the system.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where Processes.process_name=pkexec by _time Processes.dest Processes.process_id
-  Processes.parent_process_name Processes.process_name Processes.process Processes.process_path
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | regex process="(^.{1}$)" | `linux_pkexec_privilege_escalation_filter`'
 how_to_implement: Depending on the EDR product in use, there are multiple ways to
   "null" the command-line field, Processes.process. Two that may be useful `process="(^.{0}$)"`
   or `| where isnull(process)`. To generate data for this behavior, Sysmon for Linux
@@ -23,12 +14,19 @@ how_to_implement: Depending on the EDR product in use, there are multiple ways t
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: 03e22c1c-8086-11ec-ac2e-acde48001122
 known_false_positives: False positives may be present, filter as needed.
+name: Linux pkexec Privilege Escalation
 references:
 - https://www.reddit.com/r/crowdstrike/comments/sdfeig/20220126_cool_query_friday_hunting_pwnkit_local/
 - https://linux.die.net/man/1/pkexec
 - https://www.bleepingcomputer.com/news/security/linux-system-service-bug-gives-root-on-all-major-distros-exploit-released/
 - https://access.redhat.com/security/security-updates/#/?q=polkit&p=1&sort=portal_publication_date%20desc&rows=10&portal_advisory_type=Security%20Advisory&documentKind=PortalProduct
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=pkexec by _time Processes.dest Processes.process_id
+  Processes.parent_process_name Processes.process_name Processes.process Processes.process_path
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | regex process="(^.{1}$)" | `linux_pkexec_privilege_escalation_filter`'
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -50,37 +48,34 @@ tags:
   - T1068
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
index 22818a0ab6..e8547c2aa8 100644
--- a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
+++ b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml
@@ -1,32 +1,30 @@
-name: Linux Possible Access Or Modification Of sshd Config File
-id: 7a85eb24-72da-11ec-ac76-acde48001122
-version: 1
-date: '2022-01-11'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-01-11'
 description: This analytic is to look for suspicious process command-line that might
   be accessing or modifying sshd_config. This file is the ssh configuration file that
   might be modify by threat actors or adversaries to redirect port connection, allow
   user using authorized key generated during attack. This anomaly detection might
   catch noise from administrator auditing or modifying ssh configuration file. In
   this scenario filter is needed
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: 7a85eb24-72da-11ec-ac76-acde48001122
+known_false_positives: Administrator or network operator can use this commandline
+  for automation purposes. Please update the filter macros to remove false positives.
+name: Linux Possible Access Or Modification Of sshd Config File
+references:
+- https://www.hackingarticles.in/ssh-penetration-testing-port-22/
+- https://attack.mitre.org/techniques/T1098/004/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("cat",
   "nano*","vim*", "vi*")  AND Processes.process IN("*/etc/ssh/sshd_config") by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_or_modification_of_sshd_config_file_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can use this commandline
-  for automation purposes. Please update the filter macros to remove false positives.
-references:
-- https://www.hackingarticles.in/ssh-penetration-testing-port-22/
-- https://attack.mitre.org/techniques/T1098/004/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -54,21 +52,23 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml
index 3b695cc0f6..dac9995c77 100644
--- a/detections/endpoint/linux_possible_access_to_credential_files.yml
+++ b/detections/endpoint/linux_possible_access_to_credential_files.yml
@@ -1,11 +1,7 @@
-name: Linux Possible Access To Credential Files
-id: 16107e0e-71fc-11ec-b862-acde48001122
-version: 1
-date: '2022-01-10'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-01-10'
 description: This analytic is to detect a possible attempt to dump or access the content
   of /etc/passwd and /etc/shadow to enable offline credential cracking. "etc/passwd"
   store user information within linux OS while "etc/shadow" contain the user passwords
@@ -13,21 +9,23 @@ description: This analytic is to detect a possible attempt to dump or access the
   and/or privilege escalation. This anomaly detection can be a good indicator of possible
   credential dumping technique but it might catch some normal administrator automation
   scripts or during credential auditing. In this scenario filter is needed.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: 16107e0e-71fc-11ec-b862-acde48001122
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+name: Linux Possible Access To Credential Files
+references:
+- https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd
+- https://attack.mitre.org/techniques/T1003/008/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("cat",
   "nano*","vim*", "vi*")  AND Processes.process IN("*/etc/shadow*", "*/etc/passwd*")
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_to_credential_files_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd
-- https://attack.mitre.org/techniques/T1003/008/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -55,21 +53,23 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml
index 4d287e68ca..00d0c806c3 100644
--- a/detections/endpoint/linux_possible_access_to_sudoers_file.yml
+++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml
@@ -1,31 +1,29 @@
-name: Linux Possible Access To Sudoers File
-id: 4479539c-71fc-11ec-b2e2-acde48001122
-version: 1
-date: '2022-01-10'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-01-10'
 description: This analytic is to detect a possible access or modification of /etc/sudoers
   file. "/etc/sudoers" file controls who can run what command as what users on what
   machine and can also control whether a specific user need a password for particular
   commands.  adversaries and threat actors abuse this file to gain persistence and/or
   privilege escalation during attack on targeted host.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: 4479539c-71fc-11ec-b2e2-acde48001122
+known_false_positives: administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+name: Linux Possible Access To Sudoers File
+references:
+- https://attack.mitre.org/techniques/T1548/003/
+- https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN("cat",
   "nano*","vim*", "vi*")  AND Processes.process IN("*/etc/sudoers*") by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_possible_access_to_sudoers_file_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: administrator or network operator can execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://attack.mitre.org/techniques/T1548/003/
-- https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -53,21 +51,23 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml
index 4eb48d7d79..fb4b27757d 100644
--- a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml
+++ b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml
@@ -1,11 +1,7 @@
-name: Linux Possible Append Command To At Allow Config File
-id: 7bc20606-5f40-11ec-a586-acde48001122
-version: 1
-date: '2021-12-17'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-17'
 description: This analytic looks for suspicious commandline that may use to append
   user entry to /etc/at.allow or /etc/at.deny. These 2 files are commonly abused by
   malware, adversaries or red teamers to persist on the targeted or compromised host.
@@ -14,21 +10,23 @@ description: This analytic looks for suspicious commandline that may use to appe
   username to that config file to execute at to schedule it malicious code. This anomaly
   detection can be a good indicator to investigate further the entry in created config
   file and who created it to verify if it is a false positive.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: 7bc20606-5f40-11ec-a586-acde48001122
+known_false_positives: Administrator or network operator can use this commandline
+  for automation purposes. Please update the filter macros to remove false positives.
+name: Linux Possible Append Command To At Allow Config File
+references:
+- https://linuxize.com/post/at-command-in-linux/
+- https://attack.mitre.org/techniques/T1053/001/
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes
   where Processes.process = "*echo*" AND Processes.process IN("*/etc/at.allow", "*/etc/at.deny")
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_possible_append_command_to_at_allow_config_file_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can use this commandline
-  for automation purposes. Please update the filter macros to remove false positives.
-references:
-- https://linuxize.com/post/at-command-in-linux/
-- https://attack.mitre.org/techniques/T1053/001/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -55,21 +53,23 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 9
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
index e3ec58909f..8f3d070d76 100644
--- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
+++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml
@@ -1,11 +1,7 @@
-name: Linux Possible Append Command To Profile Config File
-id: 9c94732a-61af-11ec-91e3-acde48001122
-version: 1
-date: '2021-12-20'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-20'
 description: This analytic looks for suspicious command-lines that can be possibly
   used to modify user profile files to automatically execute scripts/executables by
   shell upon reboot of the machine. This technique is commonly abused by adversaries,
@@ -13,6 +9,17 @@ description: This analytic looks for suspicious command-lines that can be possib
   host. This Anomaly detection is a good indicator that someone wants to run code
   after reboot which can be done also by the administrator or network operator for
   automation purposes.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: 9c94732a-61af-11ec-91e3-acde48001122
+known_false_positives: Administrator or network operator can use this commandline
+  for automation purposes. Please update the filter macros to remove false positives.
+name: Linux Possible Append Command To Profile Config File
+references:
+- https://unix.stackexchange.com/questions/129143/what-is-the-purpose-of-bashrc-and-how-does-it-work
+- https://attack.mitre.org/techniques/T1546/004/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process = "*echo*"
   AND Processes.process IN("*~/.bashrc", "*~/.bash_profile", "*/etc/profile", "~/.bash_login",
@@ -20,15 +27,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_possible_append_command_to_profile_config_file_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can use this commandline
-  for automation purposes. Please update the filter macros to remove false positives.
-references:
-- https://unix.stackexchange.com/questions/129143/what-is-the-purpose-of-bashrc-and-how-does-it-work
-- https://attack.mitre.org/techniques/T1546/004/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -55,21 +53,24 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
index 4c56681b14..5cbd85a80c 100644
--- a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
+++ b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
@@ -1,31 +1,29 @@
-name: Linux Possible Append Cronjob Entry on Existing Cronjob File
-id: b5b91200-5f27-11ec-bb4e-acde48001122
-version: 1
-date: '2021-12-17'
 author: Teoderick Contreras, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-17'
 description: This analytic looks for possible suspicious commandline that may use
   to append a code to any existing cronjob files for persistence or privilege escalation.
   This technique is commonly abused by malware, adversaries and red teamers to automatically
   execute their code within a existing or sometimes in normal cronjob script file.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: b5b91200-5f27-11ec-bb4e-acde48001122
+known_false_positives: Administrator or network operator can use this commandline
+  for automation purposes. Please update the filter macros to remove false positives.
+name: Linux Possible Append Cronjob Entry on Existing Cronjob File
+references:
+- https://attack.mitre.org/techniques/T1053/003/
+- https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability
+- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes
   where Processes.process = "*echo*" AND Processes.process IN("*/etc/cron*", "*/var/spool/cron/*",
   "*/etc/anacrontab*") by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can use this commandline
-  for automation purposes. Please update the filter macros to remove false positives.
-references:
-- https://attack.mitre.org/techniques/T1053/003/
-- https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability
-- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -52,21 +50,23 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 49
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml
index 4866c6a3a8..4b04b034dc 100644
--- a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml
+++ b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml
@@ -1,15 +1,21 @@
-name: Linux Possible Cronjob Modification With Editor
-id: dcc89bde-5f24-11ec-87ca-acde48001122
-version: 1
-date: '2021-12-17'
 author: Teoderick Contreras, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-17'
 description: This analytic looks for possible modification of cronjobs file using
   editor. This event is can be seen in normal user but can also be a good hunting
   indicator for unwanted user modifying cronjobs for possible persistence or privilege
   escalation.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: dcc89bde-5f24-11ec-87ca-acde48001122
+known_false_positives: Administrator or network operator can use this commandline
+  for automation purposes. Please update the filter macros to remove false positives.
+name: Linux Possible Cronjob Modification With Editor
+references:
+- https://attack.mitre.org/techniques/T1053/003/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN("nano","vim.basic")
   OR Processes.process IN ("*nano *", "*vi *", "*vim *")) AND Processes.process IN("*/etc/cron*",
@@ -17,14 +23,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_possible_cronjob_modification_with_editor_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can use this commandline
-  for automation purposes. Please update the filter macros to remove false positives.
-references:
-- https://attack.mitre.org/techniques/T1053/003/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -52,21 +50,23 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 6
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/linux_possible_ssh_key_file_creation.yml b/detections/endpoint/linux_possible_ssh_key_file_creation.yml
index 6945aed5fc..96eee9e541 100644
--- a/detections/endpoint/linux_possible_ssh_key_file_creation.yml
+++ b/detections/endpoint/linux_possible_ssh_key_file_creation.yml
@@ -1,30 +1,28 @@
-name: Linux Possible Ssh Key File Creation
-id: c04ef40c-72da-11ec-8eac-acde48001122
-version: 1
-date: '2022-01-11'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2022-01-11'
 description: This analytic is to look for possible ssh key file creation on ~/.ssh/
   folder. This technique is commonly abused by threat actors and adversaries to gain
   persistence and privilege escalation to the targeted host. by creating ssh private
   and public key and passing the public key to the attacker server. threat actor can
   access remotely the machine using openssh daemon service.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the file name, file path, and process_guid executions from your endpoints.
+  If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+id: c04ef40c-72da-11ec-8eac-acde48001122
+known_false_positives: Administrator or network operator can create file in ~/.ssh
+  folders for automation purposes. Please update the filter macros to remove false
+  positives.
+name: Linux Possible Ssh Key File Creation
+references:
+- https://www.hackingarticles.in/ssh-penetration-testing-port-22/
+- https://attack.mitre.org/techniques/T1098/004/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*/.ssh*")
   by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path
   | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `linux_possible_ssh_key_file_creation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the file name, file path, and process_guid executions from your endpoints.
-  If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
-known_false_positives: Administrator or network operator can create file in ~/.ssh
-  folders for automation purposes. Please update the filter macros to remove false
-  positives.
-references:
-- https://www.hackingarticles.in/ssh-penetration-testing-port-22/
-- https://attack.mitre.org/techniques/T1098/004/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -52,19 +50,20 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.process_guid
   - _time
-  - Filesystem.dest
-  - Filesystem.file_create_time
-  - Filesystem.file_name
-  - Filesystem.process_guid
-  - Filesystem.file_path
   risk_score: 36
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml
index 97c79b0d14..1e5a61451b 100644
--- a/detections/endpoint/linux_preload_hijack_library_calls.yml
+++ b/detections/endpoint/linux_preload_hijack_library_calls.yml
@@ -1,30 +1,28 @@
-name: Linux Preload Hijack Library Calls
-id: cbe2ca30-631e-11ec-8670-acde48001122
-version: 1
-date: '2021-12-22'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-22'
 description: This analytic is to detect a suspicious command that may hijack a library
   function in linux platform. This technique is commonly abuse by adversaries, malware
   author and red teamers to gain privileges and persist on the machine. This detection
   pertains to loading a dll to hijack or hook a library function of specific program
   using LD_PRELOAD command.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase
+id: cbe2ca30-631e-11ec-8670-acde48001122
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+name: Linux Preload Hijack Library Calls
+references:
+- https://compilepeace.medium.com/memory-malware-part-0x2-writing-userland-rootkits-via-ld-preload-30121c8343d5
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process = "*LD_PRELOAD*"
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_preload_hijack_library_calls_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase
-known_false_positives: Administrator or network operator can execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://compilepeace.medium.com/memory-malware-part-0x2-writing-userland-rootkits-via-ld-preload-30121c8343d5
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -52,21 +50,24 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 64
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml
index 999fecc6a8..b5dbb3cc4f 100644
--- a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml
+++ b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml
@@ -1,11 +1,7 @@
-name: Linux Service File Created In Systemd Directory
-id: c7495048-61b6-11ec-9a37-acde48001122
-version: 1
-date: '2021-12-20'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2021-12-20'
 description: This analytic looks for suspicious file creation in systemd timer directory
   in linux platform. systemd is a system and service manager for Linux distributions.
   From the Windows perspective, this process fulfills the duties of wininit.exe and
@@ -13,6 +9,19 @@ description: This analytic looks for suspicious file creation in systemd timer d
   it initializes a Linux system and starts relevant services that are defined in service
   unit files. Adversaries, malware and red teamers may abuse this this feature by
   stashing systemd service file to persist on the targetted or compromised host.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the file name, file path, and process_guid executions from your endpoints.
+  If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+id: c7495048-61b6-11ec-9a37-acde48001122
+known_false_positives: Administrator or network operator can create file in systemd
+  folders for automation purposes. Please update the filter macros to remove false
+  positives.
+name: Linux Service File Created In Systemd Directory
+references:
+- https://attack.mitre.org/techniques/T1053/006/
+- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
+- https://redcanary.com/blog/attck-t1501-understanding-systemd-service-persistence/
+- https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name = *.service
   Filesystem.file_path IN ("*/etc/systemd/system*", "*/lib/systemd/system*", "*/usr/lib/systemd/system*",
@@ -21,17 +30,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path
   | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `linux_service_file_created_in_systemd_directory_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the file name, file path, and process_guid executions from your endpoints.
-  If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
-known_false_positives: Administrator or network operator can create file in systemd
-  folders for automation purposes. Please update the filter macros to remove false
-  positives.
-references:
-- https://attack.mitre.org/techniques/T1053/006/
-- https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
-- https://redcanary.com/blog/attck-t1501-understanding-systemd-service-persistence/
-- https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -59,19 +57,21 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.process_guid
   - _time
-  - Filesystem.dest
-  - Filesystem.file_create_time
-  - Filesystem.file_name
-  - Filesystem.process_guid
-  - Filesystem.file_path
   risk_score: 64
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml
index f8791b39ec..135390166a 100644
--- a/detections/endpoint/linux_service_restarted.yml
+++ b/detections/endpoint/linux_service_restarted.yml
@@ -1,11 +1,7 @@
-name: Linux Service Restarted
-id: 084275ba-61b8-11ec-8d64-acde48001122
-version: 1
-date: '2021-12-20'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-20'
 description: This analytic looks for restarted or re-enable services in linux platform.
   This technique can be executed or performed using systemctl or service tool application.
   Adversaries may create or modify Windows services to repeatedly execute malicious
@@ -15,6 +11,16 @@ description: This analytic looks for restarted or re-enable services in linux pl
   task or automation, in this scenario it is suggested to look for the service path
   of the actual script or executable that register as service and who created the
   service for further verification.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and commandline executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: 084275ba-61b8-11ec-8d64-acde48001122
+known_false_positives: Administrator or network operator can use this commandline
+  for automation purposes. Please update the filter macros to remove false positives.
+name: Linux Service Restarted
+references:
+- https://attack.mitre.org/techniques/T1543/003/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("systemctl",
   "service") OR Processes.process IN ("*systemctl *", "*service *")) Processes.process
@@ -22,14 +28,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_service_restarted_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and commandline executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can use this commandline
-  for automation purposes. Please update the filter macros to remove false positives.
-references:
-- https://attack.mitre.org/techniques/T1543/003/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -57,21 +55,24 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_service_started_or_enabled.yml b/detections/endpoint/linux_service_started_or_enabled.yml
index f49665180d..61b68254b6 100644
--- a/detections/endpoint/linux_service_started_or_enabled.yml
+++ b/detections/endpoint/linux_service_started_or_enabled.yml
@@ -1,11 +1,7 @@
-name: Linux Service Started Or Enabled
-id: e0428212-61b7-11ec-88a3-acde48001122
-version: 1
-date: '2021-12-20'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-20'
 description: This analytic looks for created or enable services in linux platform.
   This technique can be executed or performed using systemctl or service tool application.
   Adversaries may create or modify Windows services to repeatedly execute malicious
@@ -15,6 +11,16 @@ description: This analytic looks for created or enable services in linux platfor
   task or automation, in this scenario it is suggested to look for the service path
   of the actual script or executable that register as service and who created the
   service for further verification.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: e0428212-61b7-11ec-88a3-acde48001122
+known_false_positives: Administrator or network operator can use this commandline
+  for automation purposes. Please update the filter macros to remove false positives.
+name: Linux Service Started Or Enabled
+references:
+- https://attack.mitre.org/techniques/T1543/003/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("systemctl",
   "service") OR Processes.process IN ("*systemctl *", "*service *")) Processes.process
@@ -22,14 +28,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_service_started_or_enabled_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can use this commandline
-  for automation purposes. Please update the filter macros to remove false positives.
-references:
-- https://attack.mitre.org/techniques/T1543/003/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -57,21 +55,24 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml
index 9c0993d9d1..7e552a417d 100644
--- a/detections/endpoint/linux_setuid_using_chmod_utility.yml
+++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml
@@ -1,11 +1,7 @@
-name: Linux Setuid Using Chmod Utility
-id: bf0304b6-6250-11ec-9d7c-acde48001122
-version: 1
-date: '2021-12-21'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-21'
 description: This analytic looks for suspicious chmod utility execution to enable
   SUID bit. This allows a user to temporarily gain root access, usually in order to
   run a program. For example, only the root account is allowed to change the password
@@ -15,6 +11,16 @@ description: This analytic looks for suspicious chmod utility execution to enabl
   is the SGID, or set group id bit. It is similar to the SUID bit, except it can temporarily
   change group membership, usually to execute a program. The SGID bit is set if an
   s or an S appears in the group section of permissions.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: bf0304b6-6250-11ec-9d7c-acde48001122
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+name: Linux Setuid Using Chmod Utility
+references:
+- https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes WHERE (Processes.process_name = chmod
   OR Processes.process = "*chmod *") AND Processes.process IN("* g+s *", "* u+s *",
@@ -22,14 +28,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `linux_setuid_using_chmod_utility_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -57,21 +55,24 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_setuid_using_setcap_utility.yml b/detections/endpoint/linux_setuid_using_setcap_utility.yml
index a9b84716e8..ed28f448d8 100644
--- a/detections/endpoint/linux_setuid_using_setcap_utility.yml
+++ b/detections/endpoint/linux_setuid_using_setcap_utility.yml
@@ -1,11 +1,7 @@
-name: Linux Setuid Using Setcap Utility
-id: 9d96022e-6250-11ec-9a19-acde48001122
-version: 1
-date: '2021-12-21'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-21'
 description: This analytic looks for suspicious setcap utility execution to enable
   SUID bit. This allows a user to temporarily gain root access, usually in order to
   run a program. For example, only the root account is allowed to change the password
@@ -15,6 +11,16 @@ description: This analytic looks for suspicious setcap utility execution to enab
   is the SGID, or set group id bit. It is similar to the SUID bit, except it can temporarily
   change group membership, usually to execute a program. The SGID bit is set if an
   s or an S appears in the group section of permissions.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: 9d96022e-6250-11ec-9a19-acde48001122
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+name: Linux Setuid Using Setcap Utility
+references:
+- https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = setcap
   OR Processes.process = "*setcap *") AND Processes.process IN ("* cap_setuid=ep *",
@@ -23,14 +29,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_setuid_using_setcap_utility_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -58,21 +56,24 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_sudo_or_su_execution.yml b/detections/endpoint/linux_sudo_or_su_execution.yml
index fb739d3abf..fc7ce52a4c 100644
--- a/detections/endpoint/linux_sudo_or_su_execution.yml
+++ b/detections/endpoint/linux_sudo_or_su_execution.yml
@@ -1,11 +1,7 @@
-name: Linux Sudo OR Su Execution
-id: 4b00f134-6d6a-11ec-a90c-acde48001122
-version: 1
-date: '2022-01-04'
 author: Teoderick Contreras, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-01-04'
 description: This analytic is to detect the execution of sudo or su command in linux
   operating system. The "sudo" command allows a system administrator to delegate authority
   to give certain users (or groups of users) the ability to run some (or all) commands
@@ -14,20 +10,22 @@ description: This analytic is to detect the execution of sudo or su command in l
   teamers to elevate privileges to the targeted host. This command can be executed
   by administrator for legitimate purposes or to execute process that need admin privileges,
   In this scenario filter is needed.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. If you are
+  using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
+id: 4b00f134-6d6a-11ec-a90c-acde48001122
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+name: Linux Sudo OR Su Execution
+references:
+- https://attack.mitre.org/techniques/T1548/003/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("sudo",
   "su") OR Processes.parent_process_name IN ("sudo", "su") by Processes.dest Processes.user
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_sudo_or_su_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. If you are
-  using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
-known_false_positives: Administrator or network operator can execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://attack.mitre.org/techniques/T1548/003/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -55,21 +53,24 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 9
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
index 1df4b0d961..f6880c6933 100644
--- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml
+++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml
@@ -1,11 +1,7 @@
-name: Linux Sudoers Tmp File Creation
-id: be254a5c-63e7-11ec-89da-acde48001122
-version: 1
-date: '2021-12-23'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2021-12-23'
 description: This analytic is to looks for file creation of sudoers.tmp file cause
   by editing /etc/sudoers using visudo or editor in linux platform. This technique
   may abuse by adversaries, malware author and red teamers to gain elevated privilege
@@ -13,19 +9,21 @@ description: This analytic is to looks for file creation of sudoers.tmp file cau
   as what users on what machines and can also control special things such as whether
   you need a password for particular commands. The file is composed of aliases (basically
   variables) and user specifications (which control who can run what).
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: be254a5c-63e7-11ec-89da-acde48001122
+known_false_positives: administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+name: Linux Sudoers Tmp File Creation
+references:
+- https://forum.ubuntuusers.de/topic/sudo-visudo-gibt-etc-sudoers-tmp/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*sudoers.tmp*")
   by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path
   | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `linux_sudoers_tmp_file_creation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: administrator or network operator can execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://forum.ubuntuusers.de/topic/sudo-visudo-gibt-etc-sudoers-tmp/
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -53,19 +51,20 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.process_guid
   - _time
-  - Filesystem.dest
-  - Filesystem.file_create_time
-  - Filesystem.file_name
-  - Filesystem.process_guid
-  - Filesystem.file_path
   risk_score: 72
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_system_network_discovery.yml b/detections/endpoint/linux_system_network_discovery.yml
index 11f21bf5ff..1172230074 100644
--- a/detections/endpoint/linux_system_network_discovery.yml
+++ b/detections/endpoint/linux_system_network_discovery.yml
@@ -1,16 +1,22 @@
-name: Linux System Network Discovery
-id: 535cb214-8b47-11ec-a2c7-acde48001122
-version: 1
-date: '2022-02-11'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-02-11'
 description: This analytic is to look for possible enumeration of local network configuration.
   This technique is commonly used as part of recon of adversaries or threat actor
   to know some network information for its next or further attack. This anomaly detections
   may capture normal event made by administrator during auditing or testing network
   connection of specific host or network to network.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: 535cb214-8b47-11ec-a2c7-acde48001122
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+name: Linux System Network Discovery
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name_list values(Processes.process) as process_list values(Processes.process_id)
   as process_id_list values(Processes.parent_process_id) as parent_process_id_list
@@ -19,14 +25,6 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   IN ("arp", "ifconfig", "ip", "netstat", "firewall-cmd", "ufw", "iptables", "ss",
   "route") by _time span=30m Processes.dest Processes.user | where process_name_count
   >=4 | `drop_dm_object_name(Processes)`| `linux_system_network_discovery_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1016/T1016.md
 tags:
   analytic_story:
   - Network Discovery
@@ -50,21 +48,23 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 9
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/linux_visudo_utility_execution.yml b/detections/endpoint/linux_visudo_utility_execution.yml
index 4acdf38f55..1edbd45f3d 100644
--- a/detections/endpoint/linux_visudo_utility_execution.yml
+++ b/detections/endpoint/linux_visudo_utility_execution.yml
@@ -1,11 +1,7 @@
-name: Linux Visudo Utility Execution
-id: 08c41040-624c-11ec-a71f-acde48001122
-version: 1
-date: '2021-12-21'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-21'
 description: This analytic is to looks for suspicious commandline that add entry to
   /etc/sudoers by using visudo utility tool in linux platform. This technique may
   abuse by adversaries, malware author and red teamers to gain elevated privilege
@@ -13,20 +9,22 @@ description: This analytic is to looks for suspicious commandline that add entry
   as what users on what machines and can also control special things such as whether
   you need a password for particular commands. The file is composed of aliases (basically
   variables) and user specifications (which control who can run what).
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
+  Splunkbase.
+id: 08c41040-624c-11ec-a71f-acde48001122
+known_false_positives: Administrator or network operator can execute this command.
+  Please update the filter macros to remove false positives.
+name: Linux Visudo Utility Execution
+references:
+- https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = visudo
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_visudo_utility_execution_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
-  Splunkbase.
-known_false_positives: Administrator or network operator can execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands
 tags:
   analytic_story:
   - Linux Privilege Escalation
@@ -54,21 +52,24 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 16
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml
index 8367b6300c..9a471222f2 100644
--- a/detections/endpoint/loading_of_dynwrapx_module.yml
+++ b/detections/endpoint/loading_of_dynwrapx_module.yml
@@ -1,11 +1,6 @@
-name: Loading Of Dynwrapx Module
-id: eac5e8ba-4857-11ec-9371-acde48001122
-version: 1
-date: '2021-11-18'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-11-18'
 description: DynamicWrapperX is an ActiveX component that can be used in a script
   to call Windows API functions, but it requires the dynwrapx.dll to be installed
   and registered. With that, registering or loading dynwrapx.dll to a host is highly
@@ -14,26 +9,28 @@ description: DynamicWrapperX is an ActiveX component that can be used in a scrip
   for any suspicious modifications meant to load dynwrapx.dll. Identify any suspicious
   module loads of dynwrapx.dll. This detection will return and identify the processes
   that invoke vbs/wscript/cscript.
-search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName
-  = "dynwrapx.dll" OR  Product = "DynamicWrapperX") | stats count min(_time) as firstTime
-  max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name
-  Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `loading_of_dynwrapx_module_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on processes that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem`
   node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
   latest TA for the endpoint product.
+id: eac5e8ba-4857-11ec-9371-acde48001122
 known_false_positives: False positives should be limited, however it is possible to
   filter by Processes.process_name and specific processes (ex. wscript.exe). Filter
   as needed. This may need modification based on EDR telemetry and how it brings in
   registry data. For example, removal of (Default).
+name: Loading Of Dynwrapx Module
 references:
 - https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/
 - https://www.script-coding.com/dynwrapx_eng.html
 - https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
 - https://tria.ge/210929-ap75vsddan
 - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
+search: '`sysmon` EventCode=7 (ImageLoaded = "*\\dynwrapx.dll" OR OriginalFileName
+  = "dynwrapx.dll" OR  Product = "DynamicWrapperX") | stats count min(_time) as firstTime
+  max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name
+  Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `loading_of_dynwrapx_module_filter`'
 tags:
   analytic_story:
   - Remcos
@@ -53,9 +50,9 @@ tags:
   - T1055.001
   observable:
   - name: Computer
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -73,3 +70,5 @@ tags:
   - ProcessId
   risk_score: 80
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml
index d2220dfca8..07683f5f77 100644
--- a/detections/endpoint/local_account_discovery_with_net.yml
+++ b/detections/endpoint/local_account_discovery_with_net.yml
@@ -1,27 +1,25 @@
-name: Local Account Discovery with Net
-id: 5d0d4830-0133-11ec-bae3-acde48001122
-version: 2
-date: '2021-09-16'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: This analytic looks for the execution of `net.exe` or `net1.exe` with
   command-line arguments utilized to query for local users. The two arguments `user`
   and 'users', return a list of all local users. Red Teams and adversaries alike use
   net.exe to enumerate users for situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 5d0d4830-0133-11ec-bae3-acde48001122
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Local Account Discovery with Net
+references:
+- https://attack.mitre.org/techniques/T1087/001/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_net` (Processes.process=*user
   OR Processes.process=*users) by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `local_account_discovery_with_net_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1087/001/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -41,14 +39,23 @@ tags:
   - T1087.001
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 2
diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml
index d2dd2876a8..618816a4ed 100644
--- a/detections/endpoint/local_account_discovery_with_wmic.yml
+++ b/detections/endpoint/local_account_discovery_with_wmic.yml
@@ -1,26 +1,24 @@
-name: Local Account Discovery With Wmic
-id: 4902d7aa-0134-11ec-9d65-acde48001122
-version: 2
-date: '2021-09-16'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: This analytic looks for the execution of `wmic.exe` with command-line
   arguments utilized to query for local users. The argument `useraccount` is used
   to leverage WMI to return a list of all local users. Red Teams and adversaries alike
   use net.exe to enumerate users for situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 4902d7aa-0134-11ec-9d65-acde48001122
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Local Account Discovery With Wmic
+references:
+- https://attack.mitre.org/techniques/T1087/001/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process=*useraccount*)
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_wmic_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1087/001/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -40,14 +38,23 @@ tags:
   - T1087.001
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 2
diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml
index cce4592702..48e913c7f7 100644
--- a/detections/endpoint/logon_script_event_trigger_execution.yml
+++ b/detections/endpoint/logon_script_event_trigger_execution.yml
@@ -1,29 +1,27 @@
-name: Logon Script Event Trigger Execution
-id: 4c38c264-1f74-11ec-b5fa-acde48001122
-version: 1
-date: '2021-09-27'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Registry
+date: '2021-09-27'
 description: This search is to detect a suspicious modification of registry entry
   to persist and gain privilege escalation upon booting up of compromised host. This
   technique was seen in several APT and malware where it modify UserInitMprLogonScript
   registry entry to its malicious payload to be executed upon boot up of the machine.
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
-  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
-  IN ("*\\Environment\\UserInitMprLogonScript") by Registry.dest  Registry.user Registry.registry_path
-  Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)`
-  | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `logon_script_event_trigger_execution_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response
   product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
   used for this search is typically generated via logs that report reads and writes
   to the registry.
+id: 4c38c264-1f74-11ec-b5fa-acde48001122
 known_false_positives: unknown
+name: Logon Script Event Trigger Execution
 references:
 - https://attack.mitre.org/techniques/T1037/001
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
+  IN ("*\\Environment\\UserInitMprLogonScript") by Registry.dest  Registry.user Registry.registry_path
+  Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `logon_script_event_trigger_execution_filter`'
 tags:
   analytic_story:
   - Windows Persistence Techniques
@@ -44,25 +42,27 @@ tags:
   - T1037.001
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml
index 028bb99c8b..a19a43b45b 100644
--- a/detections/endpoint/mailsniper_invoke_functions.yml
+++ b/detections/endpoint/mailsniper_invoke_functions.yml
@@ -1,14 +1,17 @@
-name: Mailsniper Invoke functions
-id: a36972c8-b894-11eb-9f78-acde48001122
-version: 1
-date: '2021-05-19'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-05-19'
 description: This search is to detect known mailsniper.ps1 functions executed in a
   machine. This technique was seen in some attacker to harvest some sensitive e-mail
   in a compromised exchange server.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the powershell logs  from your endpoints. make sure you enable needed
+  registry to monitor this event.
+id: a36972c8-b894-11eb-9f78-acde48001122
+known_false_positives: unknown
+name: Mailsniper Invoke functions
+references:
+- https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/
 search: '`powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*",
   "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*",
   "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*",
@@ -16,12 +19,6 @@ search: '`powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*"
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
   ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `mailsniper_invoke_functions_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the powershell logs  from your endpoints. make sure you enable needed
-  registry to monitor this event.
-known_false_positives: unknown
-references:
-- https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/
 tags:
   analytic_story:
   - Data Exfiltration
@@ -42,13 +39,13 @@ tags:
   - T1114.001
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -61,3 +58,5 @@ tags:
   - User
   risk_score: 72
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/malicious_inprocserver32_modification.yml b/detections/endpoint/malicious_inprocserver32_modification.yml
index 21c9bc00db..2ab8e87400 100644
--- a/detections/endpoint/malicious_inprocserver32_modification.yml
+++ b/detections/endpoint/malicious_inprocserver32_modification.yml
@@ -1,11 +1,8 @@
-name: Malicious InProcServer32 Modification
-id: 127c8d08-25ff-11ec-9223-acde48001122
-version: 1
-date: '2021-10-05'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2021-10-05'
 description: The following analytic identifies a process modifying the registry with
   a known malicious CLSID under InProcServer32. Most COM classes are registered with
   the operating system and are identified by a GUID that represents the Class Identifier
@@ -18,6 +15,21 @@ description: The following analytic identifies a process modifying the registry
   of events. Analyze the value and look for file modifications. Being this is looking
   for inprocserver32, a DLL found in the value will most likely be loaded by a parallel
   process.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 127c8d08-25ff-11ec-9223-acde48001122
+known_false_positives: False positives should be limited, filter as needed. In our
+  test case, Remcos used regsvr32.exe to modify the registry. It may be required,
+  dependent upon the EDR tool producing registry events, to remove (Default) from
+  the command-line.
+name: Malicious InProcServer32 Modification
+references:
+- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
+- https://tria.ge/210929-ap75vsddan
+- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid
   Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats
@@ -29,19 +41,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   process process_guid user] | stats count min(_time) as firstTime max(_time) as lastTime
   by dest, process_name registry_path registry_key_name registry_value_name user |
   `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_inprocserver32_modification_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives should be limited, filter as needed. In our
-  test case, Remcos used regsvr32.exe to modify the registry. It may be required,
-  dependent upon the EDR tool producing registry events, to remove (Default) from
-  the command-line.
-references:
-- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
-- https://tria.ge/210929-ap75vsddan
-- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
 tags:
   analytic_story:
   - Suspicious Regsvr32 Activity
@@ -63,24 +62,37 @@ tags:
   - T1112
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
   - dest
   - process_name
-  - registry_path
   - registry_key_name
+  - registry_path
   - registry_value_name
   - user
   risk_score: 80
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml
index 391afadbf2..e452371e10 100644
--- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml
+++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml
@@ -1,28 +1,25 @@
-name: Malicious Powershell Executed As A Service
-id: 8e204dfd-cae0-4ea8-a61d-e972a1ff2ff8
-version: 1
-date: '2021-04-07'
 author: Ryan Becwar
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-04-07'
 description: This detection is to identify the abuse the Windows SC.exe to execute
   malicious commands or payloads via PowerShell.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows System logs with the Service name, Service File Name Service Start type,
+  and Service Type from your endpoints.
+id: 8e204dfd-cae0-4ea8-a61d-e972a1ff2ff8
+known_false_positives: Creating a hidden powershell service is rare and could key
+  off of those instances.
+name: Malicious Powershell Executed As A Service
+references:
+- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf
+- http://az4n6.blogspot.com/2017/
+- https://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier
 search: ' `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name)
   | regex l_Service_File_Name="powershell[.\s]|powershell_ise[.\s]|pwsh[.\s]|psexec[.\s]"
   | regex l_Service_File_Name="-nop[rofile\s]+|-w[indowstyle]*\s+hid[den]*|-noe[xit\s]+|-enc[odedcommand\s]+"
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name
   Service_Name Service_Start_Type Service_Type Service_Account user | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `malicious_powershell_executed_as_a_service_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  Windows System logs with the Service name, Service File Name Service Start type,
-  and Service Type from your endpoints.
-known_false_positives: Creating a hidden powershell service is rare and could key
-  off of those instances.
-references:
-- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf
-- http://az4n6.blogspot.com/2017/
-- https://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier
 tags:
   analytic_story:
   - Malicious Powershell
@@ -43,13 +40,13 @@ tags:
   - T1569.002
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -65,3 +62,5 @@ tags:
   - user
   risk_score: 72
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml
index 0b1bb8f3ea..63e51e9712 100644
--- a/detections/endpoint/malicious_powershell_process___encoded_command.yml
+++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml
@@ -1,11 +1,7 @@
-name: Malicious PowerShell Process - Encoded Command
-id: c4db14d9-7909-48b4-a054-aa14d89dbb19
-version: 7
-date: '2022-01-18'
 author: David Dorsey, Michael Haag, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-01-18'
 description: 'The following analytic identifies the use of the EncodedCommand PowerShell
   parameter. This is typically used by Administrators to run complex scripts, but
   commonly used by adversaries to hide their code. \
@@ -20,24 +16,26 @@ description: 'The following analytic identifies the use of the EncodedCommand Po
   on admin scripts in use. \
 
   Alternatively, may use regex per matching here https://regexr.com/662ov.'
-search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\
-  \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\
-  \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\
-  \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
-  \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
-  |\u2014|\u2015]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\\s+[^-]\") | `malicious_powershell_process___encoded_command_filter`"
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: c4db14d9-7909-48b4-a054-aa14d89dbb19
 known_false_positives: System administrators may use this option, but it's not common.
+name: Malicious PowerShell Process - Encoded Command
 references:
 - https://regexr.com/662ov
 - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
 - https://ss64.com/ps/powershell.html
 - https://twitter.com/M_haggis/status/1440758396534214658?s=20
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\
+  \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\
+  \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\
+  \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
+  \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
+  |\u2014|\u2015]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\\s+[^-]\") | `malicious_powershell_process___encoded_command_filter`"
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -70,20 +68,23 @@ tags:
   - PR.IP
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.process_id
   risk_score: 35
   security_domain: endpoint
+type: Hunting
+version: 7
diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
index 23a31dc47e..2aa5aecc69 100644
--- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
+++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml
@@ -1,30 +1,28 @@
-name: Malicious PowerShell Process - Execution Policy Bypass
-id: 9be56c82-b1cc-4318-87eb-d138afaaca39
-version: 5
-date: '2020-07-21'
 author: Rico Valdez, Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-07-21'
 description: This search looks for PowerShell processes started with parameters used
   to bypass the local execution policy for scripts. These parameters are often observed
   in attacks leveraging PowerShell scripts as they override the default PowerShell
   execution policy.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 9be56c82-b1cc-4318-87eb-d138afaaca39
+known_false_positives: There may be legitimate reasons to bypass the PowerShell execution
+  policy. The PowerShell script being run with this parameter should be validated
+  to ensure that it is legitimate.
+name: Malicious PowerShell Process - Execution Policy Bypass
+references: []
 search: '| tstats `security_content_summariesonly` values(Processes.process_id) as
   process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process)
   as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where `process_powershell` (Processes.process="* -ex*" OR Processes.process="* bypass
   *") by Processes.process_id, Processes.user, Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_process___execution_policy_bypass_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: There may be legitimate reasons to bypass the PowerShell execution
-  policy. The PowerShell script being run with this parameter should be validated
-  to ensure that it is legitimate.
-references: []
 tags:
   analytic_story:
   - DHS Report TA18-074A
@@ -57,27 +55,23 @@ tags:
   - PR.IP
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 5
diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
index 1fa77cee67..d0eb456c34 100644
--- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
+++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml
@@ -1,13 +1,19 @@
-name: Malicious PowerShell Process With Obfuscation Techniques
-id: cde75cf6-3c7a-4dd6-af01-27cdb4511fd4
-version: 5
-date: '2021-01-19'
 author: David Dorsey, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-01-19'
 description: This search looks for PowerShell processes launched with arguments that
   have characters indicative of obfuscation on the command-line.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: cde75cf6-3c7a-4dd6-af01-27cdb4511fd4
+known_false_positives: These characters might be legitimately on the command-line,
+  but it is not common.
+name: Malicious PowerShell Process With Obfuscation Techniques
+references: []
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell`
@@ -16,14 +22,6 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   `security_content_ctime(lastTime)`| eval num_obfuscation = (mvcount(split(process,"`"))-1)
   + (mvcount(split(process, "^"))-1) + (mvcount(split(process, "''"))-1) | `malicious_powershell_process_with_obfuscation_techniques_filter`
   | search num_obfuscation > 10 '
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: These characters might be legitimately on the command-line,
-  but it is not common.
-references: []
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -55,27 +53,25 @@ tags:
   - PR.IP
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 5
diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml
index bda911cd5a..ec00b812e2 100644
--- a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml
+++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml
@@ -1,32 +1,30 @@
-name: Mimikatz PassTheTicket CommandLine Parameters
-id: 13bbd574-83ac-11ec-99d4-acde48001122
-version: 1
-date: '2022-02-01'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-02-01'
 description: The following analytic looks for the use of Mimikatz command line parameters
   leveraged to execute pass the ticket attacks. Red teams and adversaries alike may
   use the pass the ticket technique using stolen Kerberos tickets to move laterally
   within an environment, bypassing normal system access controls. Defenders should
   be aware that adversaries may customize the source code of Mimikatz and modify the
   command line parameters. This would effectively bypass this analytic.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 13bbd574-83ac-11ec-99d4-acde48001122
+known_false_positives: Although highly unlikely, legitimate applications may use the
+  same command line parameters as Mimikatz.
+name: Mimikatz PassTheTicket CommandLine Parameters
+references:
+- https://github.com/gentilkiwi/mimikatz
+- https://attack.mitre.org/techniques/T1550/003/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*sekurlsa::tickets
   /export*" OR Processes.process = "*kerberos::ptt*") by Processes.dest Processes.user
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mimikatz_passtheticket_commandline_parameters_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: Although highly unlikely, legitimate applications may use the
-  same command line parameters as Mimikatz.
-references:
-- https://github.com/gentilkiwi/mimikatz
-- https://attack.mitre.org/techniques/T1550/003/
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
@@ -46,30 +44,32 @@ tags:
   - T1550.003
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  - Processes.parent_process_name
   risk_score: 36
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml
index aab3e5935e..533abd93ed 100644
--- a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml
@@ -1,11 +1,7 @@
-name: Mmc LOLBAS Execution Process Spawn
-id: f6601940-4c74-11ec-b9b7-3e22fbd008af
-version: 1
-date: '2021-11-23'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-23'
 description: The following analytic identifies `mmc.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing the DCOM protocol
   and the MMC20 COM object, the executed command is spawned as a child processs of
@@ -13,6 +9,17 @@ description: The following analytic identifies `mmc.exe` spawning a LOLBAS execu
   by threat actors to perform tasks like executing malicious code. Looking for child
   processes of mmc.exe that are part of the LOLBAS project can help defenders identify
   lateral movement activity.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+id: f6601940-4c74-11ec-b9b7-3e22fbd008af
+known_false_positives: Legitimate applications may trigger this behavior, filter as
+  needed.
+name: Mmc LOLBAS Execution Process Spawn
+references:
+- https://attack.mitre.org/techniques/T1021/003/
+- https://www.cybereason.com/blog/dcom-lateral-movement-techniques
+- https://lolbas-project.github.io/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=mmc.exe)
   (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe",
@@ -29,15 +36,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mmc_lolbas_execution_process_spawn_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
-known_false_positives: Legitimate applications may trigger this behavior, filter as
-  needed.
-references:
-- https://attack.mitre.org/techniques/T1021/003/
-- https://www.cybereason.com/blog/dcom-lateral-movement-techniques
-- https://lolbas-project.github.io/
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -57,27 +55,26 @@ tags:
   - T1021.003
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml
index abbc9ace22..ebb503c09e 100644
--- a/detections/endpoint/modification_of_wallpaper.yml
+++ b/detections/endpoint/modification_of_wallpaper.yml
@@ -1,28 +1,25 @@
-name: Modification Of Wallpaper
-id: accb0712-c381-11eb-8e5b-acde48001122
-version: 1
-date: '2021-06-02'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-06-02'
 description: This analytic identifies suspicious modification of registry to deface
   or change the wallpaper of a compromised machines as part of its payload. This technique
   was commonly seen in ransomware like REVIL where it create a bitmap file contain
   a note that the machine was compromised and make it as a wallpaper.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the Image, TargetObject registry key, registry Details from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+id: accb0712-c381-11eb-8e5b-acde48001122
+known_false_positives: 3rd party tool may used to changed the wallpaper of the machine
+name: Modification Of Wallpaper
+references:
+- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
+- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
 search: '`sysmon` EventCode =13  (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper"
   AND Image != "*\\explorer.exe") OR (TargetObject= "*\\Control Panel\\Desktop\\Wallpaper"
   AND Details = "*\\temp\\*") | stats count min(_time) as firstTime max(_time) as
   lastTime by EventCode Image TargetObject Details  Computer process_guid process_id
   user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `modification_of_wallpaper_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the Image, TargetObject registry key, registry Details from your endpoints.
-  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: 3rd party tool may used to changed the wallpaper of the machine
-references:
-- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
-- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
 tags:
   analytic_story:
   - Ransomware
@@ -43,9 +40,9 @@ tags:
   - T1491
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -62,3 +59,5 @@ tags:
   - user_id
   risk_score: 54
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml
index 5f41d4c5c9..98990662e1 100644
--- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml
+++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml
@@ -1,17 +1,22 @@
-name: Modify ACL permission To Files Or Folder
-id: 7e8458cc-acca-11eb-9e3f-acde48001122
-version: 1
-date: '2021-05-04'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-05-04'
 description: This analytic identifies suspicious modification of ACL permission to
   a files or folder to make it available to everyone. This technique may be used by
   the adversary to evade ACLs or protected files access. This changes is commonly
   configured by the file or directory owner with appropriate permission. This behavior
   is a good indicator if this command seen on a machine utilized by an account with
   no permission to do so.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
+id: 7e8458cc-acca-11eb-9e3f-acde48001122
+known_false_positives: administrators may use this command. Filter as needed.
+name: Modify ACL permission To Files Or Folder
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cacls.exe"
@@ -20,13 +25,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   by Processes.parent_process_name Processes.process_name Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `modify_acl_permission_to_files_or_folder_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
-known_false_positives: administrators may use this command. Filter as needed.
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   analytic_story:
   - XMRig
@@ -45,22 +43,24 @@ tags:
   - T1222
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.dest
-  - Processes.user
-  - Processes.process
-  - Processes.process_id
   risk_score: 32
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml
index d445f2249f..0c8aa73518 100644
--- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml
+++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml
@@ -1,15 +1,24 @@
-name: Monitor Registry Keys for Print Monitors
-id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc
-version: 3
-date: '2020-01-28'
 author: Bhavin Patel, Teoderick Contreras, Splunk
-type: TTP
-datamodel: []
+datamodel:
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2020-01-28'
 description: This search looks for registry activity associated with modifications
   to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this
   scenario, an attacker can load an arbitrary .dll into the print-monitor registry
   by giving the full path name to the after.dll. The system will execute the .dll
   with elevated (SYSTEM) permissions and will persist after reboot.
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black, or via other endpoint data sources, such as Sysmon.
+  The data used for this search is typically generated via logs that report registry
+  modifications.
+id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc
+known_false_positives: You will encounter noise from legitimate print-monitor registry
+  entries.
+name: Monitor Registry Keys for Print Monitors
+references: []
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
   where Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*"
   by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
@@ -24,15 +33,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   _time dest user parent_process_name parent_process process_name process_path process
   proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `monitor_registry_keys_for_print_monitors_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black, or via other endpoint data sources, such as Sysmon.
-  The data used for this search is typically generated via logs that report registry
-  modifications.
-known_false_positives: You will encounter noise from legitimate print-monitor registry
-  entries.
-references: []
 tags:
   analytic_story:
   - Suspicious Windows Registry Activities
@@ -49,7 +49,6 @@ tags:
   - Stage:Persistence
   - Stage:Privilege Escalation
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.010/atomic_red_team/windows-sysmon.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.010/atomic_red_team/sysmon.log
   impact: 80
   kill_chain_phases:
@@ -64,20 +63,31 @@ tags:
   - PR.AC
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.action
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.action
-  - Registry.registry_path
-  - Registry.dest
-  - Registry.registry_key_name
-  - Registry.user
-  - Registry.registry_value_name
   risk_score: 64
   security_domain: endpoint
+type: TTP
+version: 3
diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml
index 39ae4926de..d6532cbb42 100644
--- a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml
+++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml
@@ -1,11 +1,6 @@
-name: MS Scripting Process Loading Ldap Module
-id: 0b0c40dc-14a6-11ec-b267-acde48001122
-version: 1
-date: '2021-09-13'
 author: Teoderick Contreras, Splunk
-type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-09-13'
 description: This search is to detect a suspicious MS scripting process such as wscript.exe
   or cscript.exe that loading ldap module to process ldap query. This behavior was
   seen in FIN7 implant where it uses javascript to execute ldap query to parse host
@@ -13,20 +8,22 @@ description: This search is to detect a suspicious MS scripting process such as
   step to hunt further a suspicious ldap query or ldap related events to the host
   that may give you good information regarding ldap or AD information processing or
   might be a attacker.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+id: 0b0c40dc-14a6-11ec-b267-acde48001122
+known_false_positives: automation scripting language may used by network operator
+  to do ldap query.
+name: MS Scripting Process Loading Ldap Module
+references:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
 search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded
   IN ("*\\Wldap32.dll", "*\\adsldp.dll", "*\\adsldpc.dll") | stats min(_time) as firstTime
   max(_time) as lastTime count by Image EventCode process_name ProcessId ProcessGuid
   Computer ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `ms_scripting_process_loading_ldap_module_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: automation scripting language may used by network operator
-  to do ldap query.
-references:
-- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
-- https://attack.mitre.org/groups/G0046/
 tags:
   analytic_story:
   - FIN7
@@ -46,9 +43,9 @@ tags:
   - T1059.007
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -64,3 +61,5 @@ tags:
   - ImageLoaded
   risk_score: 9
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml
index 369b9ee11e..a1b49e0fb8 100644
--- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml
+++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml
@@ -1,11 +1,6 @@
-name: MS Scripting Process Loading WMI Module
-id: 2eba3d36-14a6-11ec-a682-acde48001122
-version: 1
-date: '2021-09-13'
 author: Teoderick Contreras, Splunk
-type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-09-13'
 description: This search is to detect a suspicious MS scripting process such as wscript.exe
   or cscript.exe that loading wmi module to process wmi query. This behavior was seen
   in FIN7 implant where it uses javascript to execute wmi query to parse host information
@@ -13,21 +8,23 @@ description: This search is to detect a suspicious MS scripting process such as
   to hunt further a suspicious wmi query or wmi related events to the host that may
   give you good information regarding process that are commonly using wmi query or
   modules or might be an attacker using this technique.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+id: 2eba3d36-14a6-11ec-a682-acde48001122
+known_false_positives: automation scripting language may used by network operator
+  to do ldap query.
+name: MS Scripting Process Loading WMI Module
+references:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
 search: '`sysmon` EventCode =7 Image IN ("*\\wscript.exe", "*\\cscript.exe") ImageLoaded
   IN ("*\\fastprox.dll", "*\\wbemdisp.dll", "*\\wbemprox.dll", "*\\wbemsvc.dll" ,
   "*\\wmiutils.dll", "*\\wbemcomn.dll") | stats min(_time) as firstTime max(_time)
   as lastTime count by Image EventCode process_name ProcessId ProcessGuid Computer
   ImageLoaded | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `ms_scripting_process_loading_wmi_module_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: automation scripting language may used by network operator
-  to do ldap query.
-references:
-- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
-- https://attack.mitre.org/groups/G0046/
 tags:
   analytic_story:
   - FIN7
@@ -47,9 +44,9 @@ tags:
   - T1059.007
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -65,3 +62,5 @@ tags:
   - ImageLoaded
   risk_score: 9
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml
index 4880410409..e0da57ed48 100644
--- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml
+++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml
@@ -1,17 +1,24 @@
-name: MSBuild Suspicious Spawned By Script Process
-id: 213b3148-24ea-11ec-93a2-acde48001122
-version: 1
-date: '2021-10-04'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-10-04'
 description: This analytic is to detect a suspicious child process of MSBuild spawned
   by Windows Script Host - cscript or wscript. This behavior or event are commonly
   seen and used by malware or adversaries to execute malicious msbuild process using
   malicious script in the compromised host. During triage, review parallel processes
   and identify any file modifications. MSBuild may load a script from the same path
   without having command-line arguments.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 213b3148-24ea-11ec-93a2-acde48001122
+known_false_positives: False positives should be limited as developers do not spawn
+  MSBuild via a WSH.
+name: MSBuild Suspicious Spawned By Script Process
+references:
+- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
@@ -19,15 +26,6 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `msbuild_suspicious_spawned_by_script_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives should be limited as developers do not spawn
-  MSBuild via a WSH.
-references:
-- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#
 tags:
   analytic_story:
   - Trusted Developer Utilities Proxy Execution MSBuild
@@ -48,26 +46,29 @@ tags:
   - T1127
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.parent_process
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.original_file_name
-  - Processes.user
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
index 04b24fdeed..42153ad78d 100644
--- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
+++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml
@@ -1,30 +1,28 @@
-name: Mshta spawning Rundll32 OR Regsvr32 Process
-id: 4aa5d062-e893-11eb-9eb2-acde48001122
-version: 2
-date: '2021-07-19'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-07-19'
 description: This search is to detect a suspicious mshta.exe process that spawn rundll32
   or regsvr32 child process. This technique was seen in several malware nowadays like
   trickbot to load its initial .dll stage loader to execute and download the the actual
   trickbot payload.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 4aa5d062-e893-11eb-9eb2-acde48001122
+known_false_positives: limitted. this anomaly behavior is not commonly seen in clean
+  host.
+name: Mshta spawning Rundll32 OR Regsvr32 Process
+references:
+- https://twitter.com/cyb3rops/status/1416050325870587910?s=21
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   = "mshta.exe"  `process_rundll32` OR `process_regsvr32` by Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.process_guid
   Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `mshta_spawning_rundll32_or_regsvr32_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: limitted. this anomaly behavior is not commonly seen in clean
-  host.
-references:
-- https://twitter.com/cyb3rops/status/1416050325870587910?s=21
 tags:
   analytic_story:
   - Trickbot
@@ -46,31 +44,30 @@ tags:
   - T1218.005
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml
index bb9f98ed80..f7e9ac3ee3 100644
--- a/detections/endpoint/mshtml_module_load_in_office_product.yml
+++ b/detections/endpoint/mshtml_module_load_in_office_product.yml
@@ -1,29 +1,26 @@
-name: MSHTML Module Load in Office Product
-id: 5f1c168e-118b-11ec-84ff-acde48001122
-version: 1
-date: '2021-09-09'
 author: Michael Haag, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-09-09'
 description: The following detection identifies the module load of mshtml.dll into
   an Office product. This behavior has been related to CVE-2021-40444, whereas the
   malicious document will load ActiveX, which activates the MSHTML component. The
   vulnerability resides in the MSHTML component. During triage, identify parallel
   processes and capture any file modifications for analysis.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process names and image loads from your endpoints. If you are using
+  Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+id: 5f1c168e-118b-11ec-84ff-acde48001122
+known_false_positives: Limited false positives will be present, however, tune as necessary.
+name: MSHTML Module Load in Office Product
+references:
+- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+- https://strontic.github.io/xcyclopedia/index-dll
 search: '`sysmon` EventID=7  process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
   ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll")
   | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name,
   ImageLoaded, OriginalFileName, process_id | rename Computer as dest | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process names and image loads from your endpoints. If you are using
-  Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: Limited false positives will be present, however, tune as necessary.
-references:
-- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
-- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
-- https://strontic.github.io/xcyclopedia/index-dll
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -47,17 +44,17 @@ tags:
   - T1566.001
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -71,3 +68,5 @@ tags:
   - dest
   risk_score: 80
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml
index c4f72a52aa..3c03c2bafa 100644
--- a/detections/endpoint/msmpeng_application_dll_side_loading.yml
+++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml
@@ -1,28 +1,26 @@
-name: Msmpeng Application DLL Side Loading
-id: 8bb3f280-dd9b-11eb-84d5-acde48001122
-version: 1
-date: '2021-07-05'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2021-07-05'
 description: This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll
   in non default windows defender folder. This technique was seen couple days ago
   with revil ransomware in Kaseya Supply chain. The approach is to drop an old version
   of msmpeng.exe to load the actual payload name as mspvc.dll which will load the
   revil ransomware to the compromise machine
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+id: 8bb3f280-dd9b-11eb-84d5-acde48001122
+known_false_positives: quite minimal false positive expected.
+name: Msmpeng Application DLL Side Loading
+references:
+- https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers
 search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as
   file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
   where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll")  AND
   Filesystem.file_path != "*\\Program Files\\windows defender\\*" by Filesystem.file_create_time
   Filesystem.process_id  Filesystem.file_name Filesystem.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the Filesystem responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
-known_false_positives: quite minimal false positive expected.
-references:
-- https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers
 tags:
   analytic_story:
   - Ransomware
@@ -40,12 +38,14 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.process_id
+  - Endpoint.Filesystem.user
   - _time
-  - Filesystem.file_create_time
-  - Filesystem.process_id
-  - Filesystem.file_name
-  - Filesystem.user
-  - Filesystem.file_path
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml
index 84430a2b77..f9a61c1683 100644
--- a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml
+++ b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml
@@ -1,10 +1,6 @@
-name: Multiple Users Attempting To Authenticate Using Explicit Credentials
-id: e61918fa-9ca4-11eb-836c-acde48001122
-version: 1
-date: '2021-04-13'
 author: Mauricio Velazco, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-04-13'
 description: 'The following analytic identifies a source user failing to authenticate
   with multiple users using explicit credentials on a host. This behavior could represent
   an adversary performing a Password Spraying attack against an Active Directory environment
@@ -25,6 +21,21 @@ description: 'The following analytic identifies a source user failing to authent
   The analytics returned fields allow analysts to investigate the event further by
   providing fields like source account, attempted user accounts and the endpoint were
   the behavior was identified.'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Event Logs from domain controllers as well as member servers and workstations.
+  The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
+  to be enabled.
+id: e61918fa-9ca4-11eb-836c-acde48001122
+known_false_positives: A source user failing attempting to authenticate multiple users
+  on a host is not a common behavior for regular systems. Some applications, however,
+  may exhibit this behavior in which case sets of users hosts can be added to an allow
+  list. Possible false positive scenarios include systems where several users connect
+  to like Mail servers, identity providers, remote desktop services, Citrix, etc.
+name: Multiple Users Attempting To Authenticate Using Explicit Credentials
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
 search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account
   = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1)
   | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$"
@@ -33,19 +44,6 @@ search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval So
   as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3)
   | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
   | search isOutlier=1 | `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter` '
-how_to_implement: To successfully implement this search, you need to be ingesting
-  Windows Event Logs from domain controllers as well as member servers and workstations.
-  The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
-  to be enabled.
-known_false_positives: A source user failing attempting to authenticate multiple users
-  on a host is not a common behavior for regular systems. Some applications, however,
-  may exhibit this behavior in which case sets of users hosts can be added to an allow
-  list. Possible false positive scenarios include systems where several users connect
-  to like Mail servers, identity providers, remote desktop services, Citrix, etc.
-references:
-- https://attack.mitre.org/techniques/T1110/003/
-- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648
-- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
 tags:
   analytic_story:
   - Active Directory Password Spraying
@@ -66,18 +64,19 @@ tags:
   - T1110
   observable:
   - name: ComputerName
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - EventCode
-  - Security_ID
   - Account_Name
   - ComputerName
+  - EventCode
+  - _time
   risk_score: 49
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml
index 5ebf02b7cc..f6b8a0d1e2 100644
--- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml
+++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml
@@ -1,10 +1,6 @@
-name: Multiple Users Failing To Authenticate From Host Using Kerberos
-id: 3a91a212-98a9-11eb-b86a-acde48001122
-version: 1
-date: '2021-04-08'
 author: Mauricio Velazco, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-04-08'
 description: 'The following analytic identifies one source endpoint failing to authenticate
   with multiple valid users using the Kerberos protocol. This behavior could represent
   an adversary performing a Password Spraying attack against an Active Directory environment
@@ -24,23 +20,25 @@ description: 'The following analytic identifies one source endpoint failing to a
 
   The analytics returned fields allow analysts to investigate the event further by
   providing fields like source ip and attempted user accounts.'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+id: 3a91a212-98a9-11eb-b86a-acde48001122
+known_false_positives: A host failing to authenticate with multiple valid domain users
+  is not a common behavior for legitimate systems. Possible false positive scenarios
+  include but are not limited to vulnerability scanners, missconfigured systems and
+  multi-user systems like Citrix farms.
+name: Multiple Users Failing To Authenticate From Host Using Kerberos
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn319109(v=ws.11)
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771
 search: '`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$"
   | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
   as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
   comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3)
   | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
   | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_kerberos_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
-  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
-known_false_positives: A host failing to authenticate with multiple valid domain users
-  is not a common behavior for legitimate systems. Possible false positive scenarios
-  include but are not limited to vulnerability scanners, missconfigured systems and
-  multi-user systems like Citrix farms.
-references:
-- https://attack.mitre.org/techniques/T1110/003/
-- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn319109(v=ws.11)
-- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4771
 tags:
   analytic_story:
   - Active Directory Password Spraying
@@ -62,18 +60,19 @@ tags:
   - T1110
   observable:
   - name: Client_Address
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - EventCode
-  - Result_Code
   - Account_Name
   - Client_Address
+  - EventCode
+  - _time
   risk_score: 49
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml
index 1496df5d6c..2a2c074a41 100644
--- a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml
+++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml
@@ -1,10 +1,6 @@
-name: Multiple Users Failing To Authenticate From Process
-id: 9015385a-9c84-11eb-bef2-acde48001122
-version: 1
-date: '2021-04-13'
 author: Mauricio Velazco, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-04-13'
 description: 'The following analytic identifies a source process name failing to authenticate
   with multiple users. This behavior could represent an adversary performing a Password
   Spraying attack against an Active Directory environment to obtain initial access
@@ -25,6 +21,20 @@ description: 'The following analytic identifies a source process name failing to
 
   The analytics returned fields allow analysts to investigate the event further by
   providing fields like source process name, source account and attempted user accounts.'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Event Logs from domain controllers aas well as member servers and workstations.
+  The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
+  to be enabled.
+id: 9015385a-9c84-11eb-bef2-acde48001122
+known_false_positives: A process failing to authenticate with multiple users is not
+  a common behavior for legitimate user sessions. Possible false positive scenarios
+  include but are not limited to vulnerability scanners and missconfigured systems.
+name: Multiple Users Failing To Authenticate From Process
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
+- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
 search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-"
   | bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account
   = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Account_Name)
@@ -33,18 +43,6 @@ search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name
   by Caller_Process_Name, Source_Account, ComputerName | eval upperBound=(comp_avg+comp_std*3)
   | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
   | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_process_filter` '
-how_to_implement: To successfully implement this search, you need to be ingesting
-  Windows Event Logs from domain controllers aas well as member servers and workstations.
-  The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
-  to be enabled.
-known_false_positives: A process failing to authenticate with multiple users is not
-  a common behavior for legitimate user sessions. Possible false positive scenarios
-  include but are not limited to vulnerability scanners and missconfigured systems.
-references:
-- https://attack.mitre.org/techniques/T1110/003/
-- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
-- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625
-- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
 tags:
   analytic_story:
   - Active Directory Password Spraying
@@ -65,20 +63,21 @@ tags:
   - T1110
   observable:
   - name: ComputerName
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
+  - Account_Name
+  - Caller_Process_Name
+  - ComputerName
   - EventCode
   - Logon_Type
-  - Caller_Process_Name
-  - Security_ID
-  - Account_Name
-  - ComputerName
+  - _time
   risk_score: 49
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml
index 5b9049e85a..ae0c21f92b 100644
--- a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml
+++ b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml
@@ -1,10 +1,6 @@
-name: Multiple Users Remotely Failing To Authenticate From Host
-id: 80f9d53e-9ca1-11eb-b0d6-acde48001122
-version: 1
-date: '2021-04-13'
 author: Mauricio Velazco, Splunk
-type: Anomaly
 datamodel: []
+date: '2021-04-13'
 description: 'The following analytic identifies a source host failing to authenticate
   against a remote host with multiple users. This behavior could represent an adversary
   performing a Password Spraying attack against an Active Directory environment to
@@ -24,6 +20,21 @@ description: 'The following analytic identifies a source host failing to authent
 
   The analytics returned fields allow analysts to investigate the event further by
   providing fields like source process name, source account and attempted user accounts.'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Event Logs from domain controllers as as well as member servers and workstations.
+  The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
+  to be enabled.
+id: 80f9d53e-9ca1-11eb-b0d6-acde48001122
+known_false_positives: A host failing to authenticate with multiple valid users against
+  a remote host is not a common behavior for legitimate systems. Possible false positive
+  scenarios include but are not limited to vulnerability scanners, remote administration
+  tools, missconfigyred systems, etc.
+name: Multiple Users Remotely Failing To Authenticate From Host
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
+- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
 search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-"
   | bucket span=2m _time | eval Destination_Account = mvindex(Account_Name, 1) | stats
   dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts
@@ -31,19 +42,6 @@ search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Addr
   as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName
   | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10
   and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_remotely_failing_to_authenticate_from_host_filter` '
-how_to_implement: To successfully implement this search, you need to be ingesting
-  Windows Event Logs from domain controllers as as well as member servers and workstations.
-  The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
-  to be enabled.
-known_false_positives: A host failing to authenticate with multiple valid users against
-  a remote host is not a common behavior for legitimate systems. Possible false positive
-  scenarios include but are not limited to vulnerability scanners, remote administration
-  tools, missconfigyred systems, etc.
-references:
-- https://attack.mitre.org/techniques/T1110/003/
-- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
-- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4625
-- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/basic-audit-logon-events
 tags:
   analytic_story:
   - Active Directory Password Spraying
@@ -64,20 +62,21 @@ tags:
   - T1110
   observable:
   - name: ComputerName
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - EventCode
-  - Logon_Type
-  - Security_ID
   - Account_Name
   - ComputerName
+  - EventCode
+  - Logon_Type
   - Source_Network_Address
+  - _time
   risk_score: 49
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/endpoint/net_localgroup_discovery.yml
index ea47f2e0e7..49fe54fc4b 100644
--- a/detections/endpoint/net_localgroup_discovery.yml
+++ b/detections/endpoint/net_localgroup_discovery.yml
@@ -1,14 +1,21 @@
-name: Net Localgroup Discovery
-id: 54f5201e-155b-11ec-a6e2-acde48001122
-version: 1
-date: '2021-09-14'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-14'
 description: The following hunting analytic will identify the use of localgroup discovery
   using `net localgroup`. During triage, review parallel processes and identify any
   further suspicious behavior.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 54f5201e-155b-11ec-a6e2-acde48001122
+known_false_positives: False positives may be present. Tune as needed.
+name: Net Localgroup Discovery
+references:
+- https://attack.mitre.org/techniques/T1069/001/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=net.exe
   OR Processes.process_name=net1.exe (Processes.process="*localgroup*") by Processes.dest
@@ -16,15 +23,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process_id Processes.parent_process_id |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `net_localgroup_discovery_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives may be present. Tune as needed.
-references:
-- https://attack.mitre.org/techniques/T1069/001/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -46,29 +44,28 @@ tags:
   - T1069.001
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml
index cf677f99cd..591740d479 100644
--- a/detections/endpoint/net_profiler_uac_bypass.yml
+++ b/detections/endpoint/net_profiler_uac_bypass.yml
@@ -1,30 +1,28 @@
-name: NET Profiler UAC bypass
-id: 0252ca80-e30d-11eb-8aa3-acde48001122
-version: 2
-date: '2022-02-18'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Registry
+date: '2022-02-18'
 description: This search is to detect modification of registry to bypass UAC windows
   feature. This technique is to add a payload dll path on .NET COR file path that
   will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring
   the registry key and values in the detection area. It may happened that windows
   update some dll related to mmc.exe and add dll path in this registry. In this case
   filtering is needed.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: 0252ca80-e30d-11eb-8aa3-acde48001122
+known_false_positives: limited false positive. It may trigger by some windows update
+  that will modify this registry.
+name: NET Profiler UAC bypass
+references:
+- https://offsec.almond.consulting/UAC-bypass-dotnet.html
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH"
   Registry.registry_value_data = "*.dll" by Registry.registry_path Registry.registry_key_name
   Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `net_profiler_uac_bypass_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: limited false positive. It may trigger by some windows update
-  that will modify this registry.
-references:
-- https://offsec.almond.consulting/UAC-bypass-dotnet.html
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -47,20 +45,22 @@ tags:
   - T1548
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
   - _time
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/network_connection_discovery_arp.yml b/detections/endpoint/network_connection_discovery_arp.yml
index 7561ba6375..ae648d68e1 100644
--- a/detections/endpoint/network_connection_discovery_arp.yml
+++ b/detections/endpoint/network_connection_discovery_arp.yml
@@ -1,26 +1,24 @@
-name: Network Connection Discovery With Arp
-id: ae008c0f-83bd-4ed4-9350-98d4328e15d2
-version: 1
-date: '2021-09-10'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-10'
 description: This analytic looks for the execution of `arp.exe` utilized to get a
   listing of network connections on a compromised system. Red Teams and adversaries
   alike may use arp.exe for situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: ae008c0f-83bd-4ed4-9350-98d4328e15d2
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Network Connection Discovery With Arp
+references:
+- https://attack.mitre.org/techniques/T1049/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="arp.exe")
   (Processes.process=*-a*) by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `network_connection_discovery_with_arp_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1049/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -40,24 +38,22 @@ tags:
   - T1049
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/network_connection_discovery_net.yml b/detections/endpoint/network_connection_discovery_net.yml
index 6427083184..5b22d058fb 100644
--- a/detections/endpoint/network_connection_discovery_net.yml
+++ b/detections/endpoint/network_connection_discovery_net.yml
@@ -1,27 +1,25 @@
-name: Network Connection Discovery With Net
-id: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d
-version: 1
-date: '2021-09-10'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-10'
 description: This analytic looks for the execution of `net.exe` with command-line
   arguments utilized to get a listing of network connections on a compromised system.
   Red Teams and adversaries alike may use net.exe for situational awareness and Active
   Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Network Connection Discovery With Net
+references:
+- https://attack.mitre.org/techniques/T1049/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe"
   OR Processes.process_name="net1.exe") (Processes.process=*use*) by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_connection_discovery_with_net_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1049/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -41,24 +39,22 @@ tags:
   - T1049
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/network_connection_discovery_netstat.yml b/detections/endpoint/network_connection_discovery_netstat.yml
index a699d24058..48f0b42606 100644
--- a/detections/endpoint/network_connection_discovery_netstat.yml
+++ b/detections/endpoint/network_connection_discovery_netstat.yml
@@ -1,27 +1,25 @@
-name: Network Connection Discovery With Netstat
-id: 2cf5cc25-f39a-436d-a790-4857e5995ede
-version: 1
-date: '2021-09-10'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-10'
 description: This analytic looks for the execution of `netstat.exe` with command-line
   arguments utilized to get a listing of network connections on a compromised system.
   Red Teams and adversaries alike may use netstat.exe for situational awareness and
   Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 2cf5cc25-f39a-436d-a790-4857e5995ede
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Network Connection Discovery With Netstat
+references:
+- https://attack.mitre.org/techniques/T1049/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="netstat.exe")
   (Processes.process=*-a*) by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `network_connection_discovery_with_netstat_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1049/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -41,24 +39,22 @@ tags:
   - T1049
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/network_discovery_using_route_windows_app.yml b/detections/endpoint/network_discovery_using_route_windows_app.yml
index 444db4a4f3..d699aaee56 100644
--- a/detections/endpoint/network_discovery_using_route_windows_app.yml
+++ b/detections/endpoint/network_discovery_using_route_windows_app.yml
@@ -1,30 +1,28 @@
-name: Network Discovery Using Route Windows App
-id: dd83407e-439f-11ec-ab8e-acde48001122
-version: 1
-date: '2021-11-12'
 author: Teoderick Contreras, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-12'
 description: This analytic look for a spawned process of route.exe windows application.
   Adversaries and red teams alike abuse this application the recon or do a network
   discovery on a target host. but one possible false positive might be an automated
   tool used by a system administator or a powershell script in amazon ec2 config services.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_route` by Processes.dest
-  Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_discovery_using_route_windows_app_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: dd83407e-439f-11ec-ab8e-acde48001122
 known_false_positives: A network operator or systems administrator may utilize an
   automated host discovery application that may generate false positives or an amazon
   ec2 script that uses this application. Filter as needed.
+name: Network Discovery Using Route Windows App
 references:
 - https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_route` by Processes.dest
+  Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_discovery_using_route_windows_app_filter`'
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -45,22 +43,24 @@ tags:
   - T1016.001
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 9
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml
index e4858581cd..bf7c70565d 100644
--- a/detections/endpoint/nishang_powershelltcponeline.yml
+++ b/detections/endpoint/nishang_powershelltcponeline.yml
@@ -1,35 +1,33 @@
-name: Nishang PowershellTCPOneLine
-id: 1a382c6c-7c2e-11eb-ac69-acde48001122
-version: 2
-date: '2021-03-03'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-03-03'
 description: This query detects the Nishang Invoke-PowerShellTCPOneLine utility that
   spawns a call back to a remote command and control server. This is a powershell
   oneliner. In addition, this will capture on the command-line additional utilities
   used by Nishang. Triage the endpoint and identify any parallel processes that look
   suspicious. Review the reputation of the remote IP or domain contacted by the powershell
   process.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 1a382c6c-7c2e-11eb-ac69-acde48001122
+known_false_positives: Limited false positives may be present. Filter as needed based
+  on initial analysis.
+name: Nishang PowershellTCPOneLine
+references:
+- https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1
+- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
+- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
+- https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process=*Net.Sockets.TCPClient*
   AND Processes.process=*System.Text.ASCIIEncoding*) by Processes.dest Processes.user
   Processes.parent_process Processes.original_file_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `nishang_powershelltcponeline_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives may be present. Filter as needed based
-  on initial analysis.
-references:
-- https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcpOneLine.ps1
-- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
-- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
-- https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/
 tags:
   analytic_story:
   - HAFNIUM Group
@@ -50,27 +48,26 @@ tags:
   - T1059.001
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml
index 0351a8b0cc..eaf6ab59a8 100644
--- a/detections/endpoint/nltest_domain_trust_discovery.yml
+++ b/detections/endpoint/nltest_domain_trust_discovery.yml
@@ -1,27 +1,19 @@
-name: NLTest Domain Trust Discovery
-id: c3e05466-5f22-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-25'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-01-25'
 description: This search looks for the execution of `nltest.exe` with command-line
   arguments utilized to query for Domain Trust information. Two arguments `/domain
   trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted
   domains. Red Teams and adversaries alike use NLTest.exe to enumerate the current
   domain to assist with further understanding where to pivot next.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=nltest.exe
-  OR Processes.process_name!=nltest.exe) (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*)
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `nltest_domain_trust_discovery_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: c3e05466-5f22-11eb-ae93-0242ac130002
 known_false_positives: Administrators may use nltest for troubleshooting purposes,
   otherwise, rarely used.
+name: NLTest Domain Trust Discovery
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1482/T1482.md
 - https://malware.news/t/lets-learn-trickbot-implements-network-collector-module-leveraging-cmd-wmi-ldap/19104
@@ -30,6 +22,12 @@ references:
 - https://ss64.com/nt/nltest.html
 - https://redcanary.com/threat-detection-report/techniques/domain-trust-discovery/
 - https://thedfirreport.com/2020/10/08/ryuks-return/
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=nltest.exe
+  OR Processes.process_name!=nltest.exe) (Processes.process=*/domain_trusts* OR Processes.process=*/all_trusts*)
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `nltest_domain_trust_discovery_filter`'
 tags:
   analytic_story:
   - Ryuk Ransomware
@@ -57,23 +55,25 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
index 3306d0a93d..d0c3885c92 100644
--- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
+++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
@@ -1,11 +1,6 @@
-name: Non Chrome Process Accessing Chrome Default Dir
-id: 81263de4-160a-11ec-944f-acde48001122
-version: 1
-date: '2021-09-15'
 author: Teoderick Contreras, Splunk
-type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-09-15'
 description: This search is to detect an anomaly event of non-chrome process accessing
   the files in chrome user default folder. This folder contains all the sqlite database
   of the chrome browser related to users login, history, cookies and etc. Most of
@@ -14,17 +9,19 @@ description: This search is to detect an anomaly event of non-chrome process acc
   enabled to tthe firefox profile directory to be eable to use this. Since you monitoring
   this access to the folder a noise coming from firefox need to be filter and also
   sqlite db browser and explorer .exe to make this detection more stable.
+how_to_implement: To successfully implement this search, you must ingest Windows Security
+  Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
+  Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+id: 81263de4-160a-11ec-944f-acde48001122
+known_false_positives: other browser not listed related to firefox may catch by this
+  rule.
+name: Non Chrome Process Accessing Chrome Default Dir
+references: []
 search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\chrome.exe",
   "*\\explorer.exe", "*sql*")) Object_Name="*\\Google\\Chrome\\User Data\\Default*"
   | stats count min(_time) as firstTime max(_time) as lastTime by Object_Name Object_Type
   process_name Access_Mask Accesses process_id EventCode dest user | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `non_chrome_process_accessing_chrome_default_dir_filter`'
-how_to_implement: To successfully implement this search, you must ingest Windows Security
-  Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
-  Group Policy. Then check the two boxes listed for both "Success" and "Failure."
-known_false_positives: other browser not listed related to firefox may catch by this
-  rule.
-references: []
 tags:
   analytic_story:
   - FIN7
@@ -45,13 +42,13 @@ tags:
   - T1555.003
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -69,3 +66,5 @@ tags:
   - user
   risk_score: 35
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
index a0ab4f8f17..d8e41e0c9b 100644
--- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
+++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
@@ -1,11 +1,6 @@
-name: Non Firefox Process Access Firefox Profile Dir
-id: e6fc13b0-1609-11ec-b533-acde48001122
-version: 1
-date: '2021-09-15'
 author: Teoderick Contreras, Splunk
-type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-09-15'
 description: This search is to detect an anomaly event of non-firefox process accessing
   the files in  profile folder. This folder contains all the sqlite database of the
   firefox browser related to users login, history, cookies and etc. Most of the RAT,
@@ -14,17 +9,19 @@ description: This search is to detect an anomaly event of non-firefox process ac
   tthe firefox profile directory to be eable to use this. Since you monitoring this
   access to the folder a noise coming from firefox need to be filter and also sqlite
   db browser and explorer .exe to make this detection more stable.
+how_to_implement: To successfully implement this search, you must ingest Windows Security
+  Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
+  Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+id: e6fc13b0-1609-11ec-b533-acde48001122
+known_false_positives: other browser not listed related to firefox may catch by this
+  rule.
+name: Non Firefox Process Access Firefox Profile Dir
+references: []
 search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\firefox.exe",
   "*\\explorer.exe", "*sql*")) Object_Name="*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles*"
   | stats count min(_time) as firstTime max(_time) as lastTime by Object_Name Object_Type
   process_name Access_Mask Accesses process_id EventCode dest user | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `non_firefox_process_access_firefox_profile_dir_filter`'
-how_to_implement: To successfully implement this search, you must ingest Windows Security
-  Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
-  Group Policy. Then check the two boxes listed for both "Success" and "Failure."
-known_false_positives: other browser not listed related to firefox may catch by this
-  rule.
-references: []
 tags:
   analytic_story:
   - FIN7
@@ -45,13 +42,13 @@ tags:
   - T1555.003
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -69,3 +66,5 @@ tags:
   - user
   risk_score: 35
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml
index aa6664ba7e..528f497db8 100644
--- a/detections/endpoint/ntdsutil_export_ntds.yml
+++ b/detections/endpoint/ntdsutil_export_ntds.yml
@@ -1,11 +1,7 @@
-name: Ntdsutil Export NTDS
-id: da63bc76-61ae-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-28'
 author: Michael Haag, Patrick Bareiss, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-01-28'
 description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory
   database - NTDS.dit, typically used for offline password cracking. It may be used
   in normal circumstances with no command line arguments or shorthand variations of
@@ -17,23 +13,25 @@ description: 'Monitor for signs that Ntdsutil is being used to Extract Active Di
   This technique uses "Install from Media" (IFM), which will extract a copy of the
   Active Directory database. A successful export of the Active Directory database
   will yield a file modification named ntds.dit to the destination.'
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints, to populate the Endpoint
+  data model in the Processes node. The command-line arguments are mapped to the "process"
+  field in the Endpoint data model.
+id: da63bc76-61ae-11eb-ae93-0242ac130002
+known_false_positives: Highly possible Server Administrators will troubleshoot with
+  ntdsutil.exe, generating false positives.
+name: Ntdsutil Export NTDS
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11)
+- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=ntdsutil.exe
   Processes.process=*ntds* Processes.process=*create*) by Processes.dest Processes.user
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `ntdsutil_export_ntds_filter`'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints, to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
-known_false_positives: Highly possible Server Administrators will troubleshoot with
-  ntdsutil.exe, generating false positives.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil
-- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11)
-- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
-- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html
 tags:
   analytic_story:
   - Credential Dumping
@@ -60,23 +58,25 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 50
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml
index 25b2f1dfa7..efed529643 100644
--- a/detections/endpoint/office_application_drop_executable.yml
+++ b/detections/endpoint/office_application_drop_executable.yml
@@ -1,17 +1,24 @@
-name: Office Application Drop Executable
-id: 73ce70c4-146d-11ec-9184-acde48001122
-version: 1
-date: '2021-09-13'
 author: Teoderick Contreras, Michael Haag Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+- Endpoint.Processes
+date: '2021-09-13'
 description: This search is to detect a suspicious MS office application that drop
   or create executables or script in the host. This behavior is commonly seen in spear
   phishing office attachment where it drop malicious files or script to compromised
   the host. It might be some normal macro may drop script or tools as part of automation
   but still this behavior is reallly suspicious and not commonly seen in normal office
   application
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+id: 73ce70c4-146d-11ec-9184-acde48001122
+known_false_positives: office macro for automation may do this behavior
+name: Office Application Drop Executable
+references:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
   by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
@@ -25,14 +32,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   file_path process_name process_path process proc_guid] | dedup file_create_time
   | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid
   | `office_application_drop_executable_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: office macro for automation may do this behavior
-references:
-- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
-- https://attack.mitre.org/groups/G0046/
 tags:
   analytic_story:
   - FIN7
@@ -52,23 +51,31 @@ tags:
   - T1566.001
   observable:
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.process_guid
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
   - _time
-  - Image
-  - TargetFilename
-  - ProcessGuid
   - dest
-  - user_id
   risk_score: 64
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml
index 7cee8cbf6d..99c422cf6b 100644
--- a/detections/endpoint/office_application_spawn_regsvr32_process.yml
+++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml
@@ -1,15 +1,21 @@
-name: Office Application Spawn Regsvr32 process
-id: 2d9fc90c-f11f-11eb-9300-acde48001122
-version: 2
-date: '2021-07-30'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-07-30'
 description: this detection was designed to identifies suspicious spawned process
   of known MS office application due to macro or malicious code. this technique can
   be seen in so many malware like IcedID that used MS office as its weapon or attack
   vector to initially infect the machines.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 2d9fc90c-f11f-11eb-9300-acde48001122
+known_false_positives: unknown
+name: Office Application Spawn Regsvr32 process
+references:
+- https://www.joesandbox.com/analysis/380662/0/html
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
   = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name
@@ -18,14 +24,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process Processes.process_id Processes.process_guid
   Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `office_application_spawn_regsvr32_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: unknown
-references:
-- https://www.joesandbox.com/analysis/380662/0/html
 tags:
   analytic_story:
   - IcedID
@@ -45,27 +43,27 @@ tags:
   - T1566.001
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml
index 30f2fa1600..52f365b267 100644
--- a/detections/endpoint/office_application_spawn_rundll32_process.yml
+++ b/detections/endpoint/office_application_spawn_rundll32_process.yml
@@ -1,15 +1,22 @@
-name: Office Application Spawn rundll32 process
-id: 958751e4-9c5f-11eb-b103-acde48001122
-version: 2
-date: '2021-04-13'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-04-13'
 description: this detection was designed to identifies suspicious spawned process
   of known MS office application due to macro or malicious code. this technique can
   be seen in so many malware like trickbot that used MS office as its weapon or attack
   vector to initially infect the machines.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 958751e4-9c5f-11eb-b103-acde48001122
+known_false_positives: unknown
+name: Office Application Spawn rundll32 process
+references:
+- https://any.run/malware-trends/trickbot
+- https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
   = "winword.exe" OR Processes.parent_process_name = "excel.exe" OR Processes.parent_process_name
@@ -17,15 +24,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
   | `office_application_spawn_rundll32_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: unknown
-references:
-- https://any.run/malware-trends/trickbot
-- https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -47,26 +45,25 @@ tags:
   - T1566.001
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml
index e3455839fd..bd3ebe6315 100644
--- a/detections/endpoint/office_document_creating_schedule_task.yml
+++ b/detections/endpoint/office_document_creating_schedule_task.yml
@@ -1,11 +1,6 @@
-name: Office Document Creating Schedule Task
-id: cc8b7b74-9d0f-11eb-8342-acde48001122
-version: 1
-date: '2021-04-14'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-04-14'
 description: this search detects a potential malicious office document that create
   schedule task entry through macro VBA api or through loading taskschd.dll. This
   technique was seen in so many malicious macro malware that create persistence ,
@@ -19,19 +14,21 @@ description: this search detects a potential malicious office document that crea
   source. Was it schtasks.exe or via TaskService? Review the job created and the Command
   to be executed. Capture any artifacts on disk and review. Identify any parallel
   processes within the same timeframe to identify source.'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+  Also be sure to include those monitored dll to your own sysmon config.
+id: cc8b7b74-9d0f-11eb-8342-acde48001122
+known_false_positives: unknown
+name: Office Document Creating Schedule Task
+references:
+- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/
+- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/
 search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
   ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime
   values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name
   ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `office_document_creating_schedule_task_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints.
-  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-  Also be sure to include those monitored dll to your own sysmon config.
-known_false_positives: unknown
-references:
-- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/
-- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -51,9 +48,9 @@ tags:
   - T1566.001
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -70,3 +67,5 @@ tags:
   - _time
   risk_score: 49
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml
index 5d78357f23..2dee5f3604 100644
--- a/detections/endpoint/office_document_executing_macro_code.yml
+++ b/detections/endpoint/office_document_executing_macro_code.yml
@@ -1,11 +1,6 @@
-name: Office Document Executing Macro Code
-id: b12c89bc-9d06-11eb-a592-acde48001122
-version: 1
-date: '2021-04-14'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-04-14'
 description: this detection was designed to identifies suspicious office documents
   that using macro code. Macro code is known to be one of the prevalent weaponization
   or attack vector of threat actor. This malicious macro code is embed to a office
@@ -13,18 +8,20 @@ description: this detection was designed to identifies suspicious office documen
   or other malware component. It is really good practice to disable macro by default
   to avoid automatically execute macro code while opening or closing a office document
   files.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+  Also be sure to include those monitored dll to your own sysmon config.
+id: b12c89bc-9d06-11eb-a592-acde48001122
+known_false_positives: Normal Office Document macro use for automation
+name: Office Document Executing Macro Code
+references:
+- https://www.joesandbox.com/analysis/386500/0/html
 search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
   ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time)
   as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count
   by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints.
-  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-  Also be sure to include those monitored dll to your own sysmon config.
-known_false_positives: Normal Office Document macro use for automation
-references:
-- https://www.joesandbox.com/analysis/386500/0/html
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -46,9 +43,9 @@ tags:
   - T1566.001
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -65,3 +62,5 @@ tags:
   - _time
   risk_score: 35
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml
index f3d8d1fa01..3a963eae42 100644
--- a/detections/endpoint/office_document_spawned_child_process_to_download.yml
+++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml
@@ -1,15 +1,21 @@
-name: Office Document Spawned Child Process To Download
-id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3
-version: 3
-date: '2021-09-20'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-20'
 description: This search is to detect potential malicious office document executing
   lolbin child process to download payload or other malware. Since most of the attacker
   abused the capability of office document to execute living on land application to
   blend it to the normal noise in the infected machine to cover its track.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances office application and browser may be
+  used.
+id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3
+known_false_positives: Default browser not in the filter list.
+name: Office Document Spawned Child Process To Download
+references:
+- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/#
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process
@@ -18,14 +24,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `office_document_spawned_child_process_to_download_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances office application and browser may be
-  used.
-known_false_positives: Default browser not in the filter list.
-references:
-- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/#
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -45,27 +43,26 @@ tags:
   - T1566.001
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 3
diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml
index 69de3a2862..6c462bf0a8 100644
--- a/detections/endpoint/office_product_spawn_cmd_process.yml
+++ b/detections/endpoint/office_product_spawn_cmd_process.yml
@@ -1,16 +1,23 @@
-name: Office Product Spawn CMD Process
-id: b8b19420-e892-11eb-9244-acde48001122
-version: 2
-date: '2021-07-19'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-07-19'
 description: this search is to detect a suspicious office product process that spawn
   cmd child process. This is commonly seen in a ms office product having macro to
   execute shell command to download or execute malicious lolbin relative to its malicious
   code. This is seen in trickbot spear phishing doc where it execute shell cmd to
   run mshta payload.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: b8b19420-e892-11eb-9244-acde48001122
+known_false_positives: IT or network admin may create an document automation that
+  will run shell script.
+name: Office Product Spawn CMD Process
+references:
+- https://twitter.com/cyb3rops/status/1416050325870587910?s=21
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
   = "winword.exe" OR Processes.parent_process_name= "excel.exe" OR Processes.parent_process_name
@@ -18,15 +25,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest
   Processes.original_file_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `office_product_spawn_cmd_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: IT or network admin may create an document automation that
-  will run shell script.
-references:
-- https://twitter.com/cyb3rops/status/1416050325870587910?s=21
 tags:
   analytic_story:
   - Trickbot
@@ -47,31 +45,31 @@ tags:
   - T1218.005
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml
index 094bebf61f..a0f1ff7576 100644
--- a/detections/endpoint/office_product_spawning_bitsadmin.yml
+++ b/detections/endpoint/office_product_spawning_bitsadmin.yml
@@ -1,11 +1,7 @@
-name: Office Product Spawning BITSAdmin
-id: e8c591f4-a6d7-11eb-8cf7-acde48001122
-version: 2
-date: '2021-04-26'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-04-26'
 description: The following detection identifies the latest behavior utilized by different
   malware families (including TA551, IcedID). This detection identifies any Windows
   Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line
@@ -17,6 +13,16 @@ description: The following detection identifies the latest behavior utilized by
   on disk. The Office Product, or `bitsadmin.exe` will have reached out to a remote
   destination, capture and block the IPs or domain. Review additional parallel processes
   for further activity.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: e8c591f4-a6d7-11eb-8cf7-acde48001122
+known_false_positives: No false positives known. Filter as needed.
+name: Office Product Spawning BITSAdmin
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_bitsadmin`
@@ -24,14 +30,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `office_product_spawning_bitsadmin_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: No false positives known. Filter as needed.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -52,31 +50,31 @@ tags:
   - T1566.001
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: process_name
     role:
     - Attacker
+    type: process_name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml
index 0326a05e7a..709650460a 100644
--- a/detections/endpoint/office_product_spawning_certutil.yml
+++ b/detections/endpoint/office_product_spawning_certutil.yml
@@ -1,11 +1,7 @@
-name: Office Product Spawning CertUtil
-id: 6925fe72-a6d5-11eb-9e17-acde48001122
-version: 2
-date: '2021-04-26'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-04-26'
 description: The following detection identifies the latest behavior utilized by different
   malware families (including TA551, IcedID). This detection identifies any Windows
   Office Product spawning `certutil.exe`. In malicious instances, the command-line
@@ -16,6 +12,17 @@ description: The following detection identifies the latest behavior utilized by
   on disk. The Office Product, or `certutil.exe` will have reached out to a remote
   destination, capture and block the IPs or domain. Review additional parallel processes
   for further activity.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 6925fe72-a6d5-11eb-9e17-acde48001122
+known_false_positives: No false positives known. Filter as needed.
+name: Office Product Spawning CertUtil
+references:
+- https://redcanary.com/threat-detection-report/threats/TA551/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_certutil`
@@ -23,15 +30,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `office_product_spawning_certutil_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: No false positives known. Filter as needed.
-references:
-- https://redcanary.com/threat-detection-report/threats/TA551/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -52,31 +50,31 @@ tags:
   - T1566.001
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: process_name
     role:
     - Attacker
+    type: process_name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml
index 5c136fd5a4..e161cc0663 100644
--- a/detections/endpoint/office_product_spawning_mshta.yml
+++ b/detections/endpoint/office_product_spawning_mshta.yml
@@ -1,11 +1,7 @@
-name: Office Product Spawning MSHTA
-id: 6078fa20-a6d2-11eb-b662-acde48001122
-version: 2
-date: '2021-04-26'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-04-26'
 description: The following detection identifies the latest behavior utilized by different
   malware families (including TA551, IcedID). This detection identifies any Windows
   Office Product spawning `mshta.exe`. In malicious instances, the command-line of
@@ -16,6 +12,16 @@ description: The following detection identifies the latest behavior utilized by
   any artifacts on disk. The Office Product, or `mshta.exe` will have reached out
   to a remote destination, capture and block the IPs or domain. Review additional
   parallel processes for further activity.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 6078fa20-a6d2-11eb-b662-acde48001122
+known_false_positives: No false positives known. Filter as needed.
+name: Office Product Spawning MSHTA
+references:
+- https://redcanary.com/threat-detection-report/threats/TA551/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_mshta`
@@ -23,14 +29,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `office_product_spawning_mshta_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: No false positives known. Filter as needed.
-references:
-- https://redcanary.com/threat-detection-report/threats/TA551/
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -52,31 +50,31 @@ tags:
   - T1566.001
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: process_name
     role:
     - Attacker
+    type: process_name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml
index d2a2ea1b65..1f041467f3 100644
--- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml
+++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml
@@ -1,11 +1,7 @@
-name: Office Product Spawning Rundll32 with no DLL
-id: c661f6be-a38c-11eb-be57-acde48001122
-version: 2
-date: '2021-04-22'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-04-22'
 description: The following detection identifies the latest behavior utilized by IcedID
   malware family. This detection identifies any Windows Office Product spawning `rundll32.exe`
   without a `.dll` file extension. In malicious instances, the command-line of `rundll32.exe`
@@ -16,6 +12,19 @@ description: The following detection identifies the latest behavior utilized by
   Capture and analyze the `DLL` that was dropped to disk. The Office Product will
   have reached out to a remote destination, capture and block the IPs or domain. Review
   additional parallel processes for further activity.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: c661f6be-a38c-11eb-be57-acde48001122
+known_false_positives: False positives should be limited, but if any are present,
+  filter as needed.
+name: Office Product Spawning Rundll32 with no DLL
+references:
+- https://www.joesandbox.com/analysis/395471/0/html
+- https://app.any.run/tasks/cef4b8ba-023c-4b3b-b2ef-6486a44f6ed9/
+- https://any.run/malware-trends/icedid
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_rundll32`
@@ -23,17 +32,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `office_product_spawning_rundll32_with_no_dll_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives should be limited, but if any are present,
-  filter as needed.
-references:
-- https://www.joesandbox.com/analysis/395471/0/html
-- https://app.any.run/tasks/cef4b8ba-023c-4b3b-b2ef-6486a44f6ed9/
-- https://any.run/malware-trends/icedid
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -55,31 +53,30 @@ tags:
   - T1566.001
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml
index cb49a67c41..b617815b80 100644
--- a/detections/endpoint/office_product_spawning_wmic.yml
+++ b/detections/endpoint/office_product_spawning_wmic.yml
@@ -1,11 +1,7 @@
-name: Office Product Spawning Wmic
-id: ffc236d6-a6c9-11eb-95f1-acde48001122
-version: 3
-date: '2021-09-16'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: The following detection identifies the latest behavior utilized by Ursnif
   malware family. This detection identifies any Windows Office Product spawning `wmic.exe`.
   In malicious instances, the command-line of `wmic.exe` will contain `wmic process
@@ -16,6 +12,18 @@ description: The following detection identifies the latest behavior utilized by
   on disk. The Office Product, or `wmic.exe` will have reached out to a remote destination,
   capture and block the IPs or domain. Review additional parallel processes for further
   activity.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: ffc236d6-a6c9-11eb-95f1-acde48001122
+known_false_positives: No false positives known. Filter as needed.
+name: Office Product Spawning Wmic
+references:
+- https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/
+- https://attack.mitre.org/techniques/T1047/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") `process_wmic`
@@ -23,16 +31,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `office_product_spawning_wmic_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: No false positives known. Filter as needed.
-references:
-- https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/
-- https://attack.mitre.org/techniques/T1047/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -54,31 +52,31 @@ tags:
   - T1566.001
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: process_name
     role:
     - Attacker
+    type: process_name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 3
diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/endpoint/office_product_writing_cab_or_inf.yml
index 6df24c4ce8..75273d0d79 100644
--- a/detections/endpoint/office_product_writing_cab_or_inf.yml
+++ b/detections/endpoint/office_product_writing_cab_or_inf.yml
@@ -1,15 +1,26 @@
-name: Office Product Writing cab or inf
-id: f48cd1d4-125a-11ec-a447-acde48001122
-version: 1
-date: '2021-09-10'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+- Endpoint.Processes
+date: '2021-09-10'
 description: The following analytic identifies behavior related to CVE-2021-40444.
   Whereas the malicious document will load ActiveX and download the remote payload
   (.inf, .cab). During triage, review parallel processes and further activity on endpoint
   to identify additional patterns. Retrieve the file modifications and analyze further.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem`
+  node.
+id: f48cd1d4-125a-11ec-a447-acde48001122
+known_false_positives: The query is structured in a way that `action` (read, create)
+  is not defined. Review the results of this query, filter, and tune as necessary.
+  It may be necessary to generate this query specific to your endpoint product.
+name: Office Product Writing cab or inf
+references:
+- https://twitter.com/vxunderground/status/1436326057179860992?s=20
+- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
+- https://twitter.com/RonnyTNL/status/1436334640617373699?s=20
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
   by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
@@ -20,18 +31,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   | fields _time dest file_create_time file_name file_path process_name process_path
   process] | dedup file_create_time | table dest, process_name, process, file_create_time,
   file_name, file_path | `office_product_writing_cab_or_inf_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem`
-  node.
-known_false_positives: The query is structured in a way that `action` (read, create)
-  is not defined. Review the results of this query, filter, and tune as necessary.
-  It may be necessary to generate this query specific to your endpoint product.
-references:
-- https://twitter.com/vxunderground/status/1436326057179860992?s=20
-- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
-- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
-- https://twitter.com/RonnyTNL/status/1436334640617373699?s=20
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -55,24 +54,34 @@ tags:
   - T1566.001
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
   - _time
   - dest
-  - process_name
-  - process
   - file_create_time
   - file_name
   - file_path
+  - process
+  - process_name
   risk_score: 80
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/office_spawning_control.yml b/detections/endpoint/office_spawning_control.yml
index 9a776be427..036f97549a 100644
--- a/detections/endpoint/office_spawning_control.yml
+++ b/detections/endpoint/office_spawning_control.yml
@@ -1,11 +1,7 @@
-name: Office Spawning Control
-id: 053e027c-10c7-11ec-8437-acde48001122
-version: 1
-date: '2021-09-08'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-08'
 description: The following detection identifies control.exe spawning from an office
   product. This detection identifies any Windows Office Product spawning `control.exe`.
   In malicious instances, the command-line of `control.exe` will contain a file path
@@ -13,19 +9,14 @@ description: The following detection identifies control.exe spawning from an off
   down to the Office suite as a parent process. During triage, review all file modifications.
   Capture and analyze any artifacts on disk. review parallel and child processes to
   identify further suspicious behavior
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
-  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
-  Processes.process_name=control.exe by Processes.dest Processes.user Processes.parent_process
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
-  `office_spawning_control_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: 053e027c-10c7-11ec-8437-acde48001122
 known_false_positives: Limited false positives should be present.
+name: Office Spawning Control
 references:
 - https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html
 - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
@@ -33,6 +24,13 @@ references:
 - https://www.echotrail.io/insights/search/control.exe
 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
+  IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
+  Processes.process_name=control.exe by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `office_spawning_control_filter`'
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -56,34 +54,33 @@ tags:
   - T1566.001
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
index b22c450fe7..4fa015f412 100644
--- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
+++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml
@@ -1,10 +1,8 @@
-name: Outbound Network Connection from Java Using Default Ports
-id: d2c14d28-5c47-11ec-9892-acde48001122
-version: 1
-date: '2021-12-13'
 author: Mauricio Velazco, Splunk
-type: TTP
-datamodel: []
+datamodel:
+- Endpoint.Ports
+- Endpoint.Processes
+date: '2021-12-13'
 description: A required step while exploiting the CVE-2021-44228-Log4j vulnerability
   is that the victim server will perform outbound connections to attacker-controlled
   infrastructure. This is required as part of the JNDI lookup as well as for retrieving
@@ -12,6 +10,16 @@ description: A required step while exploiting the CVE-2021-44228-Log4j vulnerabi
   reaching out to default ports used by the LDAP and RMI protocols. This behavior
   could represent successfull exploitation. Note that adversaries can easily decide
   to use arbitrary ports for these protocols and potentially bypass this detection.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: d2c14d28-5c47-11ec-9892-acde48001122
+known_false_positives: Legitimate Java applications may use perform outbound connections
+  to these ports. Filter as needed
+name: Outbound Network Connection from Java Using Default Ports
+references:
+- https://www.lunasec.io/docs/blog/log4j-zero-day/
+- https://www.govcert.admin.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR
   Processes.process_name=javaw.exe) by _time Processes.process_guid Processes.process_name
@@ -22,14 +30,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Ports.dest_port = 1099 ) by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)`
   |  rename  dest as connection_to_CNC] | table _time dest parent_process_name process_name
   process_path process connection_to_CNC dest_port | `outbound_network_connection_from_java_using_default_ports_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Legitimate Java applications may use perform outbound connections
-  to these ports. Filter as needed
-references:
-- https://www.lunasec.io/docs/blog/log4j-zero-day/
-- https://www.govcert.admin.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
 tags:
   analytic_story:
   - Log4Shell CVE-2021-44228
@@ -51,23 +51,25 @@ tags:
   - T1190
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Ports.dest
+  - Endpoint.Ports.dest_port
+  - Endpoint.Ports.process_guid
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
   - _time
-  - Processes.process_guid
-  - Processes.process_name
-  - Processes.dest
-  - Processes.process_path
-  - Processes.process
-  - Processes.parent_process_name
-  - Ports.process_guid
-  - Ports.dest
-  - Ports.dest_port
   risk_score: 54
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml
index 4c2b15a2e0..560381f17c 100644
--- a/detections/endpoint/overwriting_accessibility_binaries.yml
+++ b/detections/endpoint/overwriting_accessibility_binaries.yml
@@ -1,15 +1,20 @@
-name: Overwriting Accessibility Binaries
-id: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae
-version: 4
-date: '2020-07-21'
 author: David Dorsey, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2020-07-21'
 description: Microsoft Windows contains accessibility features that can be launched
   with a key combination before a user has logged in. An adversary can modify or replace
   these programs so they can get a command prompt or backdoor without logging in to
   the system. This search looks for modifications to these binaries.
+how_to_implement: You must be ingesting data that records the filesystem activity
+  from your hosts to populate the Endpoint file-system data model node. If you are
+  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
+  you want to collect data.
+id: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae
+known_false_positives: Microsoft may provide updates to these binaries. Verify that
+  these changes do not correspond with your normal software update cycle.
+name: Overwriting Accessibility Binaries
+references: []
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path)
   as file_path from datamodel=Endpoint.Filesystem where (Filesystem.file_path=*\\Windows\\System32\\sethc.exe*
@@ -18,13 +23,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   OR Filesystem.file_path=*\\Windows\\System32\\DisplaySwitch.exe* OR Filesystem.file_path=*\\Windows\\System32\\AtBroker.exe*)
   by Filesystem.file_name Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)`
   | `security_content_ctime(firstTime)` | `overwriting_accessibility_binaries_filter`'
-how_to_implement: You must be ingesting data that records the filesystem activity
-  from your hosts to populate the Endpoint file-system data model node. If you are
-  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
-  you want to collect data.
-known_false_positives: Microsoft may provide updates to these binaries. Verify that
-  these changes do not correspond with your normal software update cycle.
-references: []
 tags:
   analytic_story:
   - Windows Privilege Escalation
@@ -50,24 +48,26 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: file_path
-    type: file_path
     role:
     - Attacker
+    type: file_path
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.user
   - _time
-  - Filesystem.dest
-  - Filesystem.file_path
-  - Filesystem.file_name
-  - Filesystem.dest
   risk_score: 72
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 4
diff --git a/detections/endpoint/password_policy_discovery_with_net.yml b/detections/endpoint/password_policy_discovery_with_net.yml
index b78172fb96..3ad7ba0b2f 100644
--- a/detections/endpoint/password_policy_discovery_with_net.yml
+++ b/detections/endpoint/password_policy_discovery_with_net.yml
@@ -1,15 +1,20 @@
-name: Password Policy Discovery with Net
-id: 09336538-065a-11ec-8665-acde48001122
-version: 1
-date: '2021-08-26'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-26'
 description: This analytic looks for the execution of `net.exe` or `net1.exe` with
   command line arguments used to obtain the domain password policy. Red Teams and
   adversaries may leverage `net.exe` for situational awareness and Active Directory
   Discovery.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+id: 09336538-065a-11ec-8665-acde48001122
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Password Policy Discovery with Net
+references:
+- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe"
   OR Processes.process_name="net1.exe") AND Processes.process = "*accounts*" AND Processes.process
@@ -17,13 +22,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `password_policy_discovery_with_net_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -42,30 +40,32 @@ tags:
   - T1201
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  - Processes.parent_process_name
   risk_score: 9
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml
index 0a4ff79263..13b686d766 100644
--- a/detections/endpoint/permission_modification_using_takeown_app.yml
+++ b/detections/endpoint/permission_modification_using_takeown_app.yml
@@ -1,28 +1,26 @@
-name: Permission Modification using Takeown App
-id: fa7ca5c6-c9d8-11eb-bce9-acde48001122
-version: 1
-date: '2021-06-10'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-06-10'
 description: This search is to detect a modification of file or directory permission
   using takeown.exe windows app. This technique was seen in some ransomware that take
   the ownership of a folder or files to encrypt or delete it.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: fa7ca5c6-c9d8-11eb-bce9-acde48001122
+known_false_positives: takeown.exe is a normal windows application that may used by
+  network operator.
+name: Permission Modification using Takeown App
+references:
+- https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "takeown.exe"
   Processes.process = "*/f*" by Processes.parent_process_name Processes.parent_process
   Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id
   Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `permission_modification_using_takeown_app_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: takeown.exe is a normal windows application that may used by
-  network operator.
-references:
-- https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/
 tags:
   analytic_story:
   - Ransomware
@@ -42,28 +40,30 @@ tags:
   - T1222
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.dest
-  - Processes.user
-  - Processes.process_id
-  - Processes.process_guid
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml
index f015fa1240..f909a4fc80 100644
--- a/detections/endpoint/ping_sleep_batch_command.yml
+++ b/detections/endpoint/ping_sleep_batch_command.yml
@@ -1,17 +1,23 @@
-name: Ping Sleep Batch Command
-id: ce058d6c-79f2-11ec-b476-acde48001122
-version: 1
-date: '2022-01-20'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-01-20'
 description: This analytic will identify the possible execution of ping sleep batch
   commands. This technique was seen in several malware samples and is used to trigger
   sleep times without explicitly calling sleep functions or commandlets. The goal
   is to delay the execution of malicious code and bypass detection or sandbox analysis.
   This  detection can be a good indicator of a process delaying its execution for
   malicious purposes.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: ce058d6c-79f2-11ec-b476-acde48001122
+known_false_positives: Administrator or network operator may execute this command.
+  Please update the filter macros to remove false positives.
+name: Ping Sleep Batch Command
+references:
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_ping` (Processes.parent_process
   = "*ping*" Processes.parent_process = *-n* Processes.parent_process="* Nul*"Processes.parent_process="*&gt;*")
@@ -20,14 +26,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process Processes.process_id Processes.process_guid
   Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
   |`security_content_ctime(lastTime)` | `ping_sleep_batch_command_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: Administrator or network operator may execute this command.
-  Please update the filter macros to remove false positives.
-references:
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - WhisperGate
@@ -53,31 +51,31 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 36
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/endpoint/possible_browser_pass_view_parameter.yml
index 5b0b1d67e8..9b9c4ac6a1 100644
--- a/detections/endpoint/possible_browser_pass_view_parameter.yml
+++ b/detections/endpoint/possible_browser_pass_view_parameter.yml
@@ -1,11 +1,7 @@
-name: Possible Browser Pass View Parameter
-id: 8ba484e8-4b97-11ec-b19a-acde48001122
-version: 1
-date: '2021-11-22'
 author: Teoderick Contreras, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-22'
 description: This analytic will detect if a suspicious process contains a commandline
   parameter related to a web browser credential dumper. This technique is used by
   Remcos RAT malware which uses the Nirsoft webbrowserpassview.exe application to
@@ -14,6 +10,16 @@ description: This analytic will detect if a suspicious process contains a comman
   from possible Remcos RAT infection. Since the hunting query is based on the parameter
   command and the possible path where it will save the text credential information,
   it may catch normal tools that are using the same command and behavior.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 8ba484e8-4b97-11ec-b19a-acde48001122
+known_false_positives: False positive is quite limited. Filter is needed
+name: Possible Browser Pass View Parameter
+references:
+- https://www.nirsoft.net/utils/web_browser_password.html
+- https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process  IN ("*/stext
   *", "*/shtml *", "*/LoadPasswordsIE*", "*/LoadPasswordsFirefox*", "*/LoadPasswordsChrome*",
@@ -24,14 +30,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `possible_browser_pass_view_parameter_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: False positive is quite limited. Filter is needed
-references:
-- https://www.nirsoft.net/utils/web_browser_password.html
-- https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/
 tags:
   analytic_story:
   - Remcos
@@ -51,29 +49,29 @@ tags:
   - T1555
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 16
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
index 6110ef0b52..0795cfa5c2 100644
--- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
+++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
@@ -1,11 +1,7 @@
-name: Possible Lateral Movement PowerShell Spawn
-id: cb909b3e-512b-11ec-aa31-3e22fbd008af
-version: 1
-date: '2021-11-29'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-29'
 description: The following analytic assists with identifying a PowerShell process
   spawned as a child or grand child process of commonly abused processes during lateral
   movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe`
@@ -15,6 +11,19 @@ description: The following analytic assists with identifying a PowerShell proces
   for PowerShell spawned out of this processes may reveal a lateral movement attack.
   Red Teams and adversaries alike may abuse these services during a breach for lateral
   movement and remote code execution.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+id: cb909b3e-512b-11ec-aa31-3e22fbd008af
+known_false_positives: Legitimate applications may spawn PowerShell as a child process
+  of the the identified processes. Filter as needed.
+name: Possible Lateral Movement PowerShell Spawn
+references:
+- https://attack.mitre.org/techniques/T1021/003
+- https://attack.mitre.org/techniques/T1021/006/
+- https://attack.mitre.org/techniques/T1047/
+- https://attack.mitre.org/techniques/T1053.005/
+- https://attack.mitre.org/techniques/T1543/003/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe
   OR Processes.parent_process_name=services.exe OR Processes.parent_process_name=svchost.exe
@@ -24,17 +33,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `possible_lateral_movement_powershell_spawn_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
-known_false_positives: Legitimate applications may spawn PowerShell as a child process
-  of the the identified processes. Filter as needed.
-references:
-- https://attack.mitre.org/techniques/T1021/003
-- https://attack.mitre.org/techniques/T1021/006/
-- https://attack.mitre.org/techniques/T1047/
-- https://attack.mitre.org/techniques/T1053.005/
-- https://attack.mitre.org/techniques/T1543/003/
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -62,27 +60,26 @@ tags:
   - T1059.001
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 45
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/potentially_malicious_code_on_commandline.yml b/detections/endpoint/potentially_malicious_code_on_commandline.yml
index 57c5634513..e535b45b88 100644
--- a/detections/endpoint/potentially_malicious_code_on_commandline.yml
+++ b/detections/endpoint/potentially_malicious_code_on_commandline.yml
@@ -1,11 +1,7 @@
-name: Potentially malicious code on commandline
-id: 9c53c446-757e-11ec-871d-acde48001122
-version: 1
-date: '2022-01-14'
 author: Michael Hart, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-01-14'
 description: The following analytic uses a pretrained machine learning text classifier
   to detect potentially malicious commandlines.  The model identifies unusual combinations
   of keywords found in samples of commandlines where adversaries executed powershell
@@ -16,26 +12,28 @@ description: The following analytic uses a pretrained machine learning text clas
   script is possible, combinations of keywords observed in attack data are not typically
   found in normal usage of the commandline.  The model will output a score where all
   values above zero are suspicious, anything greater than one particularly so.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes by Processes.parent_process_name
-  Processes.process_name Processes.process Processes.user Processes.dest  | `drop_dm_object_name(Processes)`  |
-  where len(process) > 200 | `potentially_malicious_code_on_cmdline_tokenize_score`
-  | apply unusual_commandline_detection | eval score=''predicted(unusual_cmdline_logits)'',
-  process=orig_process | fields - unusual_cmdline* predicted(unusual_cmdline_logits)
-  orig_process | where score > 0.5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `potentially_malicious_code_on_commandline_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.  You will also need to install the Machine Learning Toolkit version 5.3
   or above to apply the pretrained model.
+id: 9c53c446-757e-11ec-871d-acde48001122
 known_false_positives: This model is an anomaly detector that identifies usage of
   APIs and scripting constructs that are correllated with malicious activity.  These
   APIs and scripting constructs are part of the programming langauge and advanced
   scripts may generate false positives.
+name: Potentially malicious code on commandline
 references:
 - https://attack.mitre.org/techniques/T1059/003/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes by Processes.parent_process_name Processes.process_name
+  Processes.process Processes.user Processes.dest  | `drop_dm_object_name(Processes)`  |
+  where len(process) > 200 | `potentially_malicious_code_on_cmdline_tokenize_score`
+  | apply unusual_commandline_detection | eval score=''predicted(unusual_cmdline_logits)'',
+  process=orig_process | fields - unusual_cmdline* predicted(unusual_cmdline_logits)
+  orig_process | where score > 0.5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `potentially_malicious_code_on_commandline_filter`'
 tags:
   analytic_story:
   - Suspicious Command-Line Executions
@@ -54,26 +52,27 @@ tags:
   - T1059.003
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.parent_process
-  - Processes.user
-  - Processes.dest
   risk_score: 12
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml
index 4c975113aa..2cb2862527 100644
--- a/detections/endpoint/powershell_4104_hunting.yml
+++ b/detections/endpoint/powershell_4104_hunting.yml
@@ -1,15 +1,25 @@
-name: PowerShell 4104 Hunting
-id: d6f2b006-0041-11ec-8885-acde48001122
-version: 1
-date: '2021-08-18'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel: []
+date: '2021-08-18'
 description: The following Hunting analytic assists with identifying suspicious PowerShell
   execution using Script Block Logging, or EventCode 4104. This analytic is not meant
   to be ran hourly, but occasionally to identify malicious or suspicious PowerShell.
   This analytic is a combination of work completed by Alex Teixeira and Splunk Threat
   Research Team.
+how_to_implement: The following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+id: d6f2b006-0041-11ec-8885-acde48001122
+known_false_positives: Limited false positives. May filter as needed.
+name: PowerShell 4104 Hunting
+references:
+- https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md
+- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell
+- https://github.com/marcurdy/dfir-toolset/blob/master/Powershell%20Blueteam.txt
+- https://devblogs.microsoft.com/powershell/powershell-the-blue-team/
+- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1
+- https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html
+- https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/
 search: '`powershell` EventCode=4104 | eval DoIt = if(match(Message,"(?i)(\$doit)"),
   "4", 0) | eval enccom=if(match(Message,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)")
   OR match(Message, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) | eval suspcmdlet=if(match(Message,
@@ -35,18 +45,6 @@ search: '`powershell` EventCode=4104 | eval DoIt = if(match(Message,"(?i)(\$doit
   base64, get | stats values(Score) by DoIt, enccom, compressed, downgrade, iex, mimikatz,
   rundll32, empire, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd,
   base64, get, suspcmdlet, suspkeywrd | `powershell_4104_hunting_filter`'
-how_to_implement: The following Hunting analytic requires PowerShell operational logs
-  to be imported. Modify the powershell macro as needed to match the sourcetype or
-  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
-known_false_positives: Limited false positives. May filter as needed.
-references:
-- https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md
-- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell
-- https://github.com/marcurdy/dfir-toolset/blob/master/Powershell%20Blueteam.txt
-- https://devblogs.microsoft.com/powershell/powershell-the-blue-team/
-- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1
-- https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html
-- https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -54,7 +52,7 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  dataset: 
+  dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_testing/windows-powershell.log
   impact: 80
   kill_chain_phases:
@@ -66,27 +64,28 @@ tags:
   - T1059.001
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
   - Message
   risk_score: 80
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml
index c6cf21808e..8bb4c44956 100644
--- a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml
+++ b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml
@@ -1,11 +1,7 @@
-name: PowerShell - Connect To Internet With Hidden Window
-id: ee18ed37-0802-4268-9435-b3b91aaa18db
-version: 8
-date: '2022-01-12'
 author: David Dorsey, Michael Haag Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-01-12'
 description: The following hunting analytic identifies PowerShell commands utilizing
   the WindowStyle parameter to hide the window on the compromised endpoint. This combination
   of command-line options is suspicious because it is overriding the default PowerShell
@@ -15,25 +11,27 @@ description: The following hunting analytic identifies PowerShell commands utili
   For example w, win, windowsty and so forth. In addition, through our research it
   was identified that PowerShell will interpret different command switch types beyond
   the hyphen. We have added endash, emdash, horizontal bar, and forward slash.
-search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\
-  \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\
-  \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\
-  \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
-  \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
-  |\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`"
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.
   The command-line arguments are mapped to the "process" field in the Endpoint data
   model.
+id: ee18ed37-0802-4268-9435-b3b91aaa18db
 known_false_positives: Legitimate process can have this combination of command-line
   options, but it's not common.
+name: PowerShell - Connect To Internet With Hidden Window
 references:
 - https://regexr.com/663rr
 - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1
 - https://ss64.com/ps/powershell.html
 - https://twitter.com/M_haggis/status/1440758396534214658?s=20
 - https://blog.netlab.360.com/ten-families-of-malicious-samples-are-spreading-using-the-log4j2-vulnerability-now/
+search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\
+  \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\
+  \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\
+  \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\
+  \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\
+  |\u2014|\u2015]w(in*d*o*w*s*t*y*l*e*)*\\s+[^-]\") | `powershell___connect_to_internet_with_hidden_window_filter`"
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -71,27 +69,31 @@ tags:
   - PR.IP
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   - name: process
-    type: Process
     role:
     - Attacker
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.process_name
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.dest
   risk_score: 81
   security_domain: endpoint
+type: Hunting
+version: 8
diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml
index 5f8fcb73e6..83475623f2 100644
--- a/detections/endpoint/powershell_disable_security_monitoring.yml
+++ b/detections/endpoint/powershell_disable_security_monitoring.yml
@@ -1,14 +1,21 @@
-name: Powershell Disable Security Monitoring
-id: c148a894-dd93-11eb-bf2a-acde48001122
-version: 2
-date: '2021-07-05'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-07-05'
 description: This search is to identifies a modification in registry to disable the
   windows denfender real time behavior monitoring. This event or technique is commonly
   seen in RAT, bot, or Trojan to disable AV to evade detections.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: c148a894-dd93-11eb-bf2a-acde48001122
+known_false_positives: Limited false positives. However, tune based on scripts that
+  may perform this action.
+name: Powershell Disable Security Monitoring
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process="*set-mppreference*"
   AND Processes.process IN ("*disablerealtimemonitoring*","*disableioavprotection*","*disableintrusionpreventionsystem*","*disablescriptscanning*","*disableblockatfirstseen*")
@@ -16,15 +23,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_disable_security_monitoring_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives. However, tune based on scripts that
-  may perform this action.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-15---tamper-with-windows-defender-atp-powershell
 tags:
   analytic_story:
   - Ransomware
@@ -42,18 +40,17 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml
index e75d2001d3..bd22b818f5 100644
--- a/detections/endpoint/powershell_enable_smb1protocol_feature.yml
+++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml
@@ -1,25 +1,22 @@
-name: Powershell Enable SMB1Protocol Feature
-id: afed80b2-d34b-11eb-a952-acde48001122
-version: 1
-date: '2021-06-22'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-06-22'
 description: This search is to detect a suspicious enabling of smb1protocol through
   "powershell.exe". This technique was seen in some ransomware (like reddot) where
   it enable smb share to do the lateral movement and encrypt other files within the
   compromise network system.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the powershell logs  from your endpoints. make sure you enable needed
+  registry to monitor this event.
+id: afed80b2-d34b-11eb-a952-acde48001122
+known_false_positives: network operator may enable or disable this windows feature.
+name: Powershell Enable SMB1Protocol Feature
+references:
+- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
 search: '`powershell` EventCode=4104 Message = "*Enable-WindowsOptionalFeature*" Message
   = "*SMB1Protocol*" | stats count min(_time) as firstTime max(_time) as lastTime
   by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_enable_smb1protocol_feature_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the powershell logs  from your endpoints. make sure you enable needed
-  registry to monitor this event.
-known_false_positives: network operator may enable or disable this windows feature.
-references:
-- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -43,3 +40,5 @@ tags:
   - ComputerName
   - User
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml
index 30626cd311..70d0162f15 100644
--- a/detections/endpoint/powershell_execute_com_object.yml
+++ b/detections/endpoint/powershell_execute_com_object.yml
@@ -1,27 +1,24 @@
-name: Powershell Execute COM Object
-id: 65711630-f9bf-11eb-8d72-acde48001122
-version: 1
-date: '2021-08-10'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-08-10'
 description: This search is to detect a COM CLSID execution through powershell. This
   technique was seen in several adversaries and malware like ransomware conti where
   it has a feature to execute command using COM Object. This technique may use by
   network operator at some cases but a good indicator if some application want to
   gain privilege escalation or bypass uac.
-search: '`powershell` EventCode=4104 Message = "*CreateInstance([type]::GetTypeFromCLSID*"
-  OR Message = "*CreateInstance([Type]::GetTypeFromProgID*"| stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `powershell_execute_com_object_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA.
+id: 65711630-f9bf-11eb-8d72-acde48001122
 known_false_positives: network operrator may use this command.
+name: Powershell Execute COM Object
 references:
 - https://threadreaderapp.com/thread/1423361119926816776.html
+search: '`powershell` EventCode=4104 Message = "*CreateInstance([type]::GetTypeFromCLSID*"
+  OR Message = "*CreateInstance([Type]::GetTypeFromProgID*"| stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `powershell_execute_com_object_filter`'
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -43,13 +40,13 @@ tags:
   - T1546
   observable:
   - name: ComputerName
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -58,3 +55,5 @@ tags:
   - _time
   risk_score: 5
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/powershell_get_localgroup_discovery.yml b/detections/endpoint/powershell_get_localgroup_discovery.yml
index 85979673ad..bf13c4df47 100644
--- a/detections/endpoint/powershell_get_localgroup_discovery.yml
+++ b/detections/endpoint/powershell_get_localgroup_discovery.yml
@@ -1,29 +1,27 @@
-name: PowerShell Get LocalGroup Discovery
-id: b71adfcc-155b-11ec-9413-acde48001122
-version: 1
-date: '2021-09-14'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-14'
 description: The following hunting analytic identifies the use of `get-localgroup`
   being used with PowerShell to identify local groups on the endpoint. During triage,
   review parallel processes and identify any further suspicious behavior.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: b71adfcc-155b-11ec-9413-acde48001122
+known_false_positives: False positives may be present. Tune as needed.
+name: PowerShell Get LocalGroup Discovery
+references:
+- https://attack.mitre.org/techniques/T1069/001/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=powershell.exe
   OR Processes.process_name=cmd.exe) (Processes.process="*get-localgroup*") by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives may be present. Tune as needed.
-references:
-- https://attack.mitre.org/techniques/T1069/001/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -44,29 +42,27 @@ tags:
   - T1069.001
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml
index cb00089ad5..586f987b32 100644
--- a/detections/endpoint/powershell_processing_stream_of_data.yml
+++ b/detections/endpoint/powershell_processing_stream_of_data.yml
@@ -1,30 +1,28 @@
-name: Powershell Processing Stream Of Data
-id: 0d718b52-c9f1-11eb-bc61-acde48001122
-version: 1
-date: '2021-06-10'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel: []
+date: '2021-06-10'
 description: The following analytic identifies suspicious PowerShell script execution
   via EventCode 4104 that is processing compressed stream data. This is typically
   found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files
   that are stream flattened and will be deflated durnig execution. During triage,
   review parallel processes within the same timeframe. Review the full script block
   to identify other related artifacts.
-search: '`powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*"
-  OR Message = "*]::Decompress*" | stats count min(_time) as firstTime max(_time)
-  as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+id: 0d718b52-c9f1-11eb-bc61-acde48001122
 known_false_positives: powershell may used this function to process compressed data.
+name: Powershell Processing Stream Of Data
 references:
 - https://medium.com/@ahmedjouini99/deobfuscating-emotets-powershell-payload-e39fb116f7b9
 - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell
 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+search: '`powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*"
+  OR Message = "*]::Decompress*" | stats count min(_time) as firstTime max(_time)
+  as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`'
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -46,23 +44,24 @@ tags:
   - T1059.001
   observable:
   - name: ComputerName
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
+  - ComputerName
   - EventCode
   - Message
-  - ComputerName
   - User
-  - Score
+  - _time
   risk_score: 40
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
index bd27bcef1f..39196a7be9 100644
--- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
+++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
@@ -1,29 +1,26 @@
-name: Powershell Remote Thread To Known Windows Process
-id: ec102cb2-a0f5-11eb-9b38-acde48001122
-version: 1
-date: '2021-04-19'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-04-19'
 description: this search is designed to detect suspicious powershell process that
   tries to inject code and to known/critical windows process and execute it using
   CreateRemoteThread. This technique is seen in several malware like trickbot and
   offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to
   execute reverse shell to c2 and download another payload
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, Create Remote thread from your endpoints. If you are
+  using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter
+  known instances of create remote thread may be used.
+id: ec102cb2-a0f5-11eb-9b38-acde48001122
+known_false_positives: unknown
+name: Powershell Remote Thread To Known Windows Process
+references:
+- https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/
 search: '`sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe")
   TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe")
   | stats  min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name
   SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress
   Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_remote_thread_to_known_windows_process_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, Create Remote thread from your endpoints. If you are
-  using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter
-  known instances of create remote thread may be used.
-known_false_positives: unknown
-references:
-- https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/
 tags:
   analytic_story:
   - Trickbot
@@ -44,13 +41,13 @@ tags:
   - T1055
   observable:
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -69,3 +66,5 @@ tags:
   - EventCode
   risk_score: 63
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml
index edf5f27b62..10653a18e6 100644
--- a/detections/endpoint/powershell_remove_windows_defender_directory.yml
+++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml
@@ -1,26 +1,23 @@
-name: Powershell Remove Windows Defender Directory
-id: adf47620-79fa-11ec-b248-acde48001122
-version: 2
-date: '2022-01-18'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2022-01-18'
 description: This analytic will identify a suspicious PowerShell command used to delete
   the Windows Defender folder. This technique was seen used by the WhisperGate malware
   campaign where it used Nirsofts advancedrun.exe to gain administrative privileges
   to then execute a PowerShell command to delete the Windows Defender folder. This
   is a good indicator the offending process is trying corrupt a Windows Defender installation.
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+id: adf47620-79fa-11ec-b248-acde48001122
+known_false_positives: unknown
+name: Powershell Remove Windows Defender Directory
+references:
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 search: '`powershell` EventCode=4104 Message = "*rmdir *" AND Message = "*\\Microsoft\\Windows
   Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode
   Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_remove_windows_defender_directory_filter` '
-how_to_implement: To successfully implement this analytic, you will need to enable
-  PowerShell Script Block Logging on some or all endpoints. Additional setup here
-  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: unknown
-references:
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - WhisperGate
@@ -46,13 +43,13 @@ tags:
   - DE.CM
   observable:
   - name: ComputerName
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -65,3 +62,5 @@ tags:
   - User
   risk_score: 90
   security_domain: endpoint
+type: TTP
+version: 2
diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml
index 41be205342..178513bbff 100644
--- a/detections/endpoint/powershell_start_bitstransfer.yml
+++ b/detections/endpoint/powershell_start_bitstransfer.yml
@@ -1,11 +1,7 @@
-name: PowerShell Start-BitsTransfer
-id: 39e2605a-90d8-11eb-899e-acde48001122
-version: 2
-date: '2021-03-29'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-03-29'
 description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar
   functionality is present. This technique variation is not as commonly used by adversaries,
   but has been abused in the past. Lesser known uses include the ability to set the
@@ -13,23 +9,25 @@ description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Si
   is used, it is highly possible files will be archived. During triage, review parallel
   processes and process lineage. Capture any files on disk and review. For the remote
   domain or IP, what is the reputation?
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 39e2605a-90d8-11eb-899e-acde48001122
+known_false_positives: Limited false positives. It is possible administrators will
+  utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent
+  process or command-line arguments.
+name: PowerShell Start-BitsTransfer
+references:
+- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281
+- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*start-bitstransfer*
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.original_file_name Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_start_bitstransfer_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives. It is possible administrators will
-  utilize Start-BitsTransfer for administrative tasks, otherwise filter based parent
-  process or command-line arguments.
-references:
-- https://isc.sans.edu/diary/Investigating+Microsoft+BITS+Activity/23281
-- https://docs.microsoft.com/en-us/windows/win32/bits/using-windows-powershell-to-create-bits-transfer-jobs
 tags:
   analytic_story:
   - BITS Jobs
@@ -50,31 +48,30 @@ tags:
   - T1197
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml
index 73b3d2921e..5fb59b154c 100644
--- a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml
+++ b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml
@@ -1,30 +1,27 @@
-name: Powershell Windows Defender Exclusion Commands
-id: 907ac95c-4dd9-11ec-ba2c-acde48001122
-version: 1
-date: '2021-11-25'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-11-25'
 description: This analytic will detect a suspicious process commandline related to
   windows defender exclusion feature. This command is abused by adversaries, malware
   author and red teams to bypassed Windows Defender Anti-Virus product by excluding  folder
   path, file path, process, extensions and etc. from its real time or schedule scan
   to execute their malicious code. This is a good indicator for defense evasion and
   to look further for events after this behavior.
-search: '`powershell` EventCode=4104 (Message = "*Add-MpPreference *" OR Message =
-  "*Set-MpPreference *") AND Message = "*-exclusion*" | stats count min(_time) as
-  firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `powershell_windows_defender_exclusion_commands_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
   that this registry was included in your config files ex. sysmon config to be monitored.
+id: 907ac95c-4dd9-11ec-ba2c-acde48001122
 known_false_positives: admin or user may choose to use this windows features.
+name: Powershell Windows Defender Exclusion Commands
 references:
 - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
 - https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+search: '`powershell` EventCode=4104 (Message = "*Add-MpPreference *" OR Message =
+  "*Set-MpPreference *") AND Message = "*-exclusion*" | stats count min(_time) as
+  firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `powershell_windows_defender_exclusion_commands_filter`'
 tags:
   analytic_story:
   - Remcos
@@ -46,13 +43,13 @@ tags:
   - T1562
   observable:
   - name: User
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: ComputerName
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -65,3 +62,5 @@ tags:
   - User
   risk_score: 64
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml
index 54aa65d39c..4d78fde868 100644
--- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml
+++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml
@@ -1,14 +1,20 @@
-name: Prevent Automatic Repair Mode using Bcdedit
-id: 7742aa92-c9d9-11eb-bbfc-acde48001122
-version: 1
-date: '2021-06-10'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-06-10'
 description: This search is to detect a suspicious bcdedit.exe execution to ignore
   all failures. This technique was used by ransomware to prevent the compromise machine
   automatically boot in repair mode.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed bcdedit.exe may be used.
+id: 7742aa92-c9d9-11eb-bbfc-acde48001122
+known_false_positives: Administrators may modify the boot configuration ignore failure
+  during testing and debugging.
+name: Prevent Automatic Repair Mode using Bcdedit
+references:
+- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "bcdedit.exe"
   Processes.process = "*bootstatuspolicy*"  Processes.process = "*ignoreallfailures*"
@@ -16,14 +22,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
   `prevent_automatic_repair_mode_using_bcdedit_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed bcdedit.exe may be used.
-known_false_positives: Administrators may modify the boot configuration ignore failure
-  during testing and debugging.
-references:
-- https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_1_tamada-yamazaki-nakatsuru_en.pdf
 tags:
   analytic_story:
   - Ransomware
@@ -43,28 +41,30 @@ tags:
   - T1490
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.dest
-  - Processes.user
-  - Processes.process_id
-  - Processes.process_guid
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml
index 37337cc0ef..3d94eef705 100644
--- a/detections/endpoint/print_spooler_adding_a_printer_driver.yml
+++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml
@@ -1,11 +1,6 @@
-name: Print Spooler Adding A Printer Driver
-id: 313681a2-da8e-11eb-adad-acde48001122
-version: 1
-date: '2021-07-01'
 author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-07-01'
 description: 'The following analytic identifies new printer drivers being load by
   utilizing the Windows PrintService operational logs, EventCode 316. This was identified
   during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare.
@@ -18,19 +13,21 @@ description: 'The following analytic identifies new printer drivers being load b
   During triage, isolate the endpoint and review for source of exploitation. Capture
   any additional file modification events and review the source of where the exploitation
   began.'
-search: '`printservice` EventCode=316 category = "Adding a printer driver" Message
-  = "*kernelbase.dll,*" Message = "*UNIDRV.DLL,*" Message = "*.DLL.*" | stats  count
-  min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName
-  Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `print_spooler_adding_a_printer_driver_filter`'
 how_to_implement: You will need to ensure PrintService Admin and Operational logs
   are being logged to Splunk from critical or all systems.
+id: 313681a2-da8e-11eb-adad-acde48001122
 known_false_positives: Unknown. This may require filtering.
+name: Print Spooler Adding A Printer Driver
 references:
 - https://twitter.com/MalwareJake/status/1410421445608476679?s=20
 - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
 - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
 - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
+search: '`printservice` EventCode=316 category = "Adding a printer driver" Message
+  = "*kernelbase.dll,*" Message = "*UNIDRV.DLL,*" Message = "*.DLL.*" | stats  count
+  min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName
+  Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `print_spooler_adding_a_printer_driver_filter`'
 tags:
   analytic_story:
   - PrintNightmare CVE-2021-34527
@@ -56,9 +53,9 @@ tags:
   - T1547
   observable:
   - name: ComputerName
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -71,3 +68,5 @@ tags:
   - Message
   risk_score: 72
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml
index 9f557889ad..73ef76be60 100644
--- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml
+++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml
@@ -1,11 +1,6 @@
-name: Print Spooler Failed to Load a Plug-in
-id: 1adc9548-da7c-11eb-8f13-acde48001122
-version: 1
-date: '2021-07-01'
 author: Mauricio Velazco, Michael Haag, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-07-01'
 description: 'The following analytic identifies driver load errors utilizing the Windows
   PrintService Admin logs. This was identified during our testing of CVE-2021-34527
   previously (CVE-2021-1675) or PrintNightmare. \
@@ -18,18 +13,20 @@ description: 'The following analytic identifies driver load errors utilizing the
 
   During triage, isolate the endpoint and review for source of exploitation. Capture
   any additional file modification events.'
+how_to_implement: You will need to ensure PrintService Admin and Operational logs
+  are being logged to Splunk from critical or all systems.
+id: 1adc9548-da7c-11eb-8f13-acde48001122
+known_false_positives: False positives are unknown and filtering may be required.
+name: Print Spooler Failed to Load a Plug-in
+references:
+- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
+- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
+- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
 search: '`printservice` ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909"))
   OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\"))
   | stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode
   ComputerName Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `print_spooler_failed_to_load_a_plug_in_filter`'
-how_to_implement: You will need to ensure PrintService Admin and Operational logs
-  are being logged to Splunk from critical or all systems.
-known_false_positives: False positives are unknown and filtering may be required.
-references:
-- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
-- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
-- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
 tags:
   analytic_story:
   - PrintNightmare CVE-2021-34527
@@ -55,9 +52,9 @@ tags:
   - T1547
   observable:
   - name: ComputerName
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -70,3 +67,5 @@ tags:
   - Message
   risk_score: 72
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
index 25799511ff..446f16e677 100644
--- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
+++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml
@@ -1,13 +1,21 @@
-name: Process Creating LNK file in Suspicious Location
-id: 5d814af1-1041-47b5-a9ac-d754e82e9a26
-version: 5
-date: '2021-08-26'
 author: Jose Hernandez, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+- Endpoint.Processes
+date: '2021-08-26'
 description: This search looks for a process launching an `*.lnk` file under `C:\User*`
   or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools.
+how_to_implement: You must be ingesting data that records filesystem and process activity
+  from your hosts to populate the Endpoint data model. This is typically populated
+  via endpoint detection-and-response product, such as Carbon Black, or endpoint data
+  sources, such as Sysmon.
+id: 5d814af1-1041-47b5-a9ac-d754e82e9a26
+known_false_positives: This detection should yield little or no false positive results.
+  It is uncommon for LNK files to be executed from temporary or user directories.
+name: Process Creating LNK file in Suspicious Location
+references:
+- https://attack.mitre.org/techniques/T1566/001/
+- https://www.trendmicro.com/en_us/research/17/e/rising-trend-attackers-using-lnk-files-download-malware.html
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk"
   AND (Filesystem.file_path="C:\\User\\*" OR Filesystem.file_path="*\\Temp\\*") by
@@ -21,15 +29,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   process_name process_path process] | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | table firstTime, lastTime, lnk_guid, process_id, user, dest, file_name, file_path,
   process_name, process, process_path, file_hash | `process_creating_lnk_file_in_suspicious_location_filter`'
-how_to_implement: You must be ingesting data that records filesystem and process activity
-  from your hosts to populate the Endpoint data model. This is typically populated
-  via endpoint detection-and-response product, such as Carbon Black, or endpoint data
-  sources, such as Sysmon.
-known_false_positives: This detection should yield little or no false positive results.
-  It is uncommon for LNK files to be executed from temporary or user directories.
-references:
-- https://attack.mitre.org/techniques/T1566/001/
-- https://www.trendmicro.com/en_us/research/17/e/rising-trend-attackers-using-lnk-files-download-malware.html
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -58,27 +57,33 @@ tags:
   - PR.DS
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.file_hash
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.process_guid
+  - Endpoint.Filesystem.user
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_guid
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
   - _time
-  - Filesystem.file_name
-  - Filesystem.file_path
-  - Filesystem.process_id
-  - Filesystem.file_name
-  - Filesystem.file_path
-  - Filesystem.file_hash
-  - Filesystem.user
   risk_score: 63
   security_domain: network
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 5
diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml
index f507305b83..6b12721436 100644
--- a/detections/endpoint/process_deleting_its_process_file_path.yml
+++ b/detections/endpoint/process_deleting_its_process_file_path.yml
@@ -1,32 +1,29 @@
-name: Process Deleting Its Process File Path
-id: f7eda4bc-871c-11eb-b110-acde48001122
-version: 2
-date: '2022-02-18'
 author: Teoderick Contreras
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2022-02-18'
 description: This detection is to identify a suspicious process that tries to delete
   the process file path related to its process. This technique is known to be defense
   evasion once a certain condition of malware is satisfied or not. Clop ransomware
   use this technique where it will try to delete its process file path using a .bat
   command if the keyboard layout is not the layout it tries to infect.
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+id: f7eda4bc-871c-11eb-b110-acde48001122
+known_false_positives: unknown
+name: Process Deleting Its Process File Path
+references:
+- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
+- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 search: '`sysmon` EventCode=1 CommandLine = "* /c *" CommandLine = "* del*" Image
   = "*\\cmd.exe" | eval result = if(like(process,"%".parent_process."%"), "Found",
   "Not Found") | stats min(_time) as firstTime max(_time) as lastTime count by Computer
   user ParentImage ParentCommandLine Image CommandLine EventCode ProcessID result
   | where result = "Found" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `process_deleting_its_process_file_path_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
-known_false_positives: unknown
-references:
-- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
-- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Clop Ransomware
@@ -48,27 +45,28 @@ tags:
   - T1070
   observable:
   - name: Computer
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - EventCode
   - Computer
-  - user
-  - ParentImage
-  - ParentCommandLine
+  - EventCode
   - Image
-  - cmdline
+  - ParentCommandLine
+  - ParentImage
   - ProcessID
-  - result
   - _time
+  - result
+  - user
   risk_score: 60
   security_domain: endpoint
+type: TTP
+version: 2
diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml
index faec4079dd..d429597457 100644
--- a/detections/endpoint/process_execution_via_wmi.yml
+++ b/detections/endpoint/process_execution_via_wmi.yml
@@ -1,28 +1,26 @@
-name: Process Execution via WMI
-id: 24869767-8579-485d-9a4f-d9ddfd8f0cac
-version: 4
-date: '2020-03-16'
 author: Rico Valdez, Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-03-16'
 description: The following analytic identifies `WmiPrvSE.exe` spawning a process.
   This typically occurs when a process is instantiated from a local or remote process
   using `wmic.exe`. During triage, review parallel processes for suspicious behavior
   or commands executed. Review the process and command-line spawning from `wmiprvse.exe`.
   Contain and remediate the endpoint as necessary.
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints to populate the Endpoint
+  data model in the Processes node. The command-line arguments are mapped to the "process"
+  field in the Endpoint data model.
+id: 24869767-8579-485d-9a4f-d9ddfd8f0cac
+known_false_positives: Although unlikely, administrators may use wmi to execute commands
+  for legitimate purposes.
+name: Process Execution via WMI
+references: []
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=WmiPrvSE.exe
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `process_execution_via_wmi_filter` '
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
-known_false_positives: Although unlikely, administrators may use wmi to execute commands
-  for legitimate purposes.
-references: []
 tags:
   analytic_story:
   - Suspicious WMI Use
@@ -51,25 +49,30 @@ tags:
   - PR.IP
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.parent_process_name
-  - Processes.user
-  - Processes.dest
-  - Processes.process_name
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 4
diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml
index 335870e7f0..30d3d15f7a 100644
--- a/detections/endpoint/process_kill_base_on_file_path.yml
+++ b/detections/endpoint/process_kill_base_on_file_path.yml
@@ -1,14 +1,20 @@
-name: Process Kill Base On File Path
-id: 5ffaa42c-acdb-11eb-9ad3-acde48001122
-version: 2
-date: '2021-05-04'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-05-04'
 description: The following analytic identifies the use of `wmic.exe` using `delete`
   to remove a executable path. This is typically ran via a batch file during beginning
   stages of an adversary setting up for mining on an endpoint.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 5ffaa42c-acdb-11eb-9ad3-acde48001122
+known_false_positives: Unknown.
+name: Process Kill Base On File Path
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
   as lastTime  from datamodel=Endpoint.Processes where `process_wmic` AND Processes.process="*process*"
@@ -16,14 +22,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.process_name Processes.original_file_name Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `process_kill_base_on_file_path_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Unknown.
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   analytic_story:
   - XMRig
@@ -44,31 +42,29 @@ tags:
   - T1562
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/process_writing_dynamicwrapperx.yml b/detections/endpoint/process_writing_dynamicwrapperx.yml
index 569355761b..062a2a2e96 100644
--- a/detections/endpoint/process_writing_dynamicwrapperx.yml
+++ b/detections/endpoint/process_writing_dynamicwrapperx.yml
@@ -1,11 +1,8 @@
-name: Process Writing DynamicWrapperX
-id: b0a078e4-2601-11ec-9aec-acde48001122
-version: 1
-date: '2021-10-05'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+- Endpoint.Processes
+date: '2021-10-05'
 description: DynamicWrapperX is an ActiveX component that can be used in a script
   to call Windows API functions, but it requires the dynwrapx.dll to be installed
   and registered. With that, a binary writing dynwrapx.dll to disk and registering
@@ -14,6 +11,23 @@ description: DynamicWrapperX is an ActiveX component that can be used in a scrip
   processes and pivot on the process_guid. Review the registry for any suspicious
   modifications meant to load dynwrapx.dll. Identify any suspicious module loads of
   dynwrapx.dll. This will identify the process that will invoke vbs/wscript/cscript.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem`
+  node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
+  latest TA for the endpoint product.
+id: b0a078e4-2601-11ec-9aec-acde48001122
+known_false_positives: False positives should be limited, however it is possible to
+  filter by Processes.process_name and specific processes (ex. wscript.exe). Filter
+  as needed. This may need modification based on EDR telemetry and how it brings in
+  registry data. For example, removal of (Default).
+name: Process Writing DynamicWrapperX
+references:
+- https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/
+- https://www.script-coding.com/dynwrapx_eng.html
+- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
+- https://tria.ge/210929-ap75vsddan
+- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   by _time Processes.process_id Processes.process_name Processes.dest Processes.process_guid
   Processes.user | `drop_dm_object_name(Processes)` | join process_guid [| tstats
@@ -25,21 +39,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   as lastTime by dest process_name process_guid file_name file_path file_create_time
   user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `process_writing_dynamicwrapperx_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem`
-  node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
-  latest TA for the endpoint product.
-known_false_positives: False positives should be limited, however it is possible to
-  filter by Processes.process_name and specific processes (ex. wscript.exe). Filter
-  as needed. This may need modification based on EDR telemetry and how it brings in
-  registry data. For example, removal of (Default).
-references:
-- https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/
-- https://www.script-coding.com/dynwrapx_eng.html
-- https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
-- https://tria.ge/210929-ap75vsddan
-- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
 tags:
   analytic_story:
   - Remcos
@@ -60,28 +59,41 @@ tags:
   - T1559.001
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.process_guid
+  - Endpoint.Filesystem.user
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
   - dest
-  - process_name
-  - process_guid
+  - file_create_time user
   - file_name
   - file_path
-  - file_create_time user
+  - process_guid
+  - process_name
   risk_score: 80
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml
index f6ebe63ee3..6af04d65c9 100644
--- a/detections/endpoint/processes_launching_netsh.yml
+++ b/detections/endpoint/processes_launching_netsh.yml
@@ -1,32 +1,30 @@
-name: Processes launching netsh
-id: b89919ed-fe5f-492c-b139-95dbb162040e
-version: 4
-date: '2021-09-16'
 author: Michael Haag, Josef Kuepker, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-16'
 description: This search looks for processes launching netsh.exe. Netsh is a command-line
   scripting utility that allows you to, either locally or remotely, display or modify
   the network configuration of a computer that is currently running. Netsh can be
   used as a persistence proxy technique to execute a helper DLL when netsh.exe is
   executed. In this search, we are looking for processes spawned by netsh.exe and
   executing commands via the command line.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: b89919ed-fe5f-492c-b139-95dbb162040e
+known_false_positives: Some VPN applications are known to launch netsh.exe. Outside
+  of these instances, it is unusual for an executable to launch netsh.exe and run
+  commands.
+name: Processes launching netsh
+references: []
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   AS Processes.process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where `process_netsh` by Processes.parent_process_name Processes.parent_process
   Processes.original_file_name Processes.process_name Processes.user Processes.dest
   |`drop_dm_object_name("Processes")` |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)`
   |`processes_launching_netsh_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Some VPN applications are known to launch netsh.exe. Outside
-  of these instances, it is unusual for an executable to launch netsh.exe and run
-  commands.
-references: []
 tags:
   analytic_story:
   - Netsh Abuse
@@ -55,26 +53,29 @@ tags:
   - DE.CM
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.user
-  - Processes.dest
   risk_score: 42
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 4
diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml
index db1f7434ed..5f700ae4eb 100644
--- a/detections/endpoint/ransomware_notes_bulk_creation.yml
+++ b/detections/endpoint/ransomware_notes_bulk_creation.yml
@@ -1,29 +1,26 @@
-name: Ransomware Notes bulk creation
-id: eff7919a-8330-11eb-83f8-acde48001122
-version: 1
-date: '2021-03-12'
 author: Teoderick Contreras
-type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-03-12'
 description: The following analytics identifies a big number of instance of ransomware
   notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This
   behavior is a good sensor if the ransomware note filename is quite new for security
   industry or the ransomware note filename is not in your ransomware lookup table
   list for monitoring.
+how_to_implement: You must be ingesting data that records the filesystem activity
+  from your hosts to populate the Endpoint file-system data model node. If you are
+  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
+  you want to collect data.
+id: eff7919a-8330-11eb-83f8-acde48001122
+known_false_positives: unknown
+name: Ransomware Notes bulk creation
+references:
+- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
+- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
 search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time
   span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename)
   as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer
   Image file_name | where unique_readme_path_count >= 15 | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `ransomware_notes_bulk_creation_filter`'
-how_to_implement: You must be ingesting data that records the filesystem activity
-  from your hosts to populate the Endpoint file-system data model node. If you are
-  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
-  you want to collect data.
-known_false_positives: unknown
-references:
-- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
-- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
 tags:
   analytic_story:
   - Clop Ransomware
@@ -45,24 +42,25 @@ tags:
   - T1486
   observable:
   - name: Computer
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - EventCode
-  - file_name
-  - _time
-  - TargetFilename
   - Computer
+  - EventCode
   - Image
-  - user
+  - TargetFilename
+  - _time
+  - file_name
   risk_score: 81
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
index f05c0a88d0..5a1d56cb0f 100644
--- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
+++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml
@@ -1,30 +1,28 @@
-name: Recursive Delete of Directory In Batch CMD
-id: ba570b3a-d356-11eb-8358-acde48001122
-version: 2
-date: '2021-06-22'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-06-22'
 description: This search is to detect a suspicious commandline designed to delete
   files or directory recursive using batch command. This technique was seen in ransomware
   (reddot) where it it tries to delete the files in recycle bin to impaire user from
   recovering deleted files.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: ba570b3a-d356-11eb-8358-acde48001122
+known_false_positives: network operator may use this batch command to delete recursively
+  a directory or files within directory
+name: Recursive Delete of Directory In Batch CMD
+references:
+- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*/c*  Processes.process=*
   rd * Processes.process="*/s*" Processes.process="*/q*" by Processes.user Processes.process_name
   Processes.parent_process_name Processes.parent_process Processes.process Processes.process_id
   Processes.dest |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `recursive_delete_of_directory_in_batch_cmd_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: network operator may use this batch command to delete recursively
-  a directory or files within directory
-references:
-- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
 tags:
   analytic_story:
   - Ransomware
@@ -41,18 +39,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml
index dae747c94c..29c91d2ef5 100644
--- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml
+++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml
@@ -1,13 +1,21 @@
-name: Reg exe Manipulating Windows Services Registry Keys
-id: 8470d755-0c13-45b3-bd63-387a373c10cf
-version: 5
-date: '2020-11-26'
 author: Rico Valdez, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-11-26'
 description: The search looks for reg.exe modifying registry keys that define Windows
   services and their configurations.
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+id: 8470d755-0c13-45b3-bd63-387a373c10cf
+known_false_positives: It is unusual for a service to be created or modified by directly
+  manipulating the registry. However, there may be legitimate instances of this behavior.
+  It is important to validate and investigate, as appropriate.
+name: Reg exe Manipulating Windows Services Registry Keys
+references: []
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name)
   as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes
@@ -15,16 +23,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process=*Services* by Processes.process_id Processes.dest Processes.process
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `reg_exe_manipulating_windows_services_registry_keys_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: It is unusual for a service to be created or modified by directly
-  manipulating the registry. However, there may be legitimate instances of this behavior.
-  It is important to validate and investigate, as appropriate.
-references: []
 tags:
   analytic_story:
   - Windows Service Abuse
@@ -58,26 +56,28 @@ tags:
   - DE.CM
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.parent_process_name
-  - Processes.user
-  - Processes.process
-  - Processes.process_id
-  - Processes.dest
   risk_score: 45
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 5
diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml
index 1c3534eb54..4b98c0e2a4 100644
--- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml
+++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml
@@ -1,12 +1,20 @@
-name: Registry Keys for Creating SHIM Databases
-id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb
-version: 4
-date: '2020-01-28'
 author: Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk
-type: TTP
-datamodel: []
+datamodel:
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2020-01-28'
 description: This search looks for registry activity associated with application compatibility
   shims, which can be leveraged by attackers for various nefarious purposes.
+how_to_implement: To successfully implement this search, you must populate the Change_Analysis
+  data model. This is typically populated via endpoint detection and response product,
+  such as Carbon Black or other endpoint data sources such as Sysmon. The data used
+  for this search is typically generated via logs that report reads and writes to
+  the registry.
+id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb
+known_false_positives: There are many legitimate applications that leverage shim databases
+  for compatibility purposes for legacy applications
+name: Registry Keys for Creating SHIM Databases
+references: []
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
   where Registry.registry_path=*CurrentVersion\\AppCompatFlags\\Custom* OR Registry.registry_path=*CurrentVersion\\AppCompatFlags\\InstalledSDB*
   by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
@@ -19,14 +27,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `registry_keys_for_creating_shim_databases_filter`'
-how_to_implement: To successfully implement this search, you must populate the Change_Analysis
-  data model. This is typically populated via endpoint detection and response product,
-  such as Carbon Black or other endpoint data sources such as Sysmon. The data used
-  for this search is typically generated via logs that report reads and writes to
-  the registry.
-known_false_positives: There are many legitimate applications that leverage shim databases
-  for compatibility purposes for legacy applications
-references: []
 tags:
   analytic_story:
   - Suspicious Windows Registry Activities
@@ -55,22 +55,33 @@ tags:
   - DE.CM
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.dest
-  - Registry.user
   risk_score: 56
   security_domain: endpoint
+type: TTP
+version: 4
diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml
index 6958389f31..734d9fa3f0 100644
--- a/detections/endpoint/registry_keys_used_for_persistence.yml
+++ b/detections/endpoint/registry_keys_used_for_persistence.yml
@@ -1,13 +1,21 @@
-name: Registry Keys Used For Persistence
-id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b
-version: 7
-date: '2022-01-26'
 author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-26'
 description: The search looks for modifications to registry keys that can be used
   to launch an application or service at system startup.
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b
+known_false_positives: There are many legitimate applications that must execute on
+  system startup and will use these registry keys to accomplish that task.
+name: Registry Keys Used For Persistence
+references: []
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
   where (Registry.registry_path=*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce
   OR Registry.registry_path=*\\currentversion\\run* OR Registry.registry_path=*\\currentVersion\\Windows\\Appinit_Dlls*
@@ -35,15 +43,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   registry_key_name] | table _time dest user parent_process_name parent_process process_name
   process_path process proc_guid registry_path registry_value_name registry_value_data
   registry_key_name | `registry_keys_used_for_persistence_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: There are many legitimate applications that must execute on
-  system startup and will use these registry keys to accomplish that task.
-references: []
 tags:
   analytic_story:
   - Suspicious Windows Registry Activities
@@ -66,7 +65,6 @@ tags:
   - Privilege Escalation
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/windows-sysmon.log
-  - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/t1547001-runonce.log
   impact: 80
   kill_chain_phases:
   - Actions on Objectives
@@ -80,24 +78,36 @@ tags:
   - DE.AE
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.dest
-  - Registry.user
   risk_score: 76
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 7
diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml
index ef863cb47b..7ee07740f2 100644
--- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml
+++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml
@@ -1,14 +1,24 @@
-name: Registry Keys Used For Privilege Escalation
-id: c9f4b923-f8af-4155-b697-1354f5bcbc5e
-version: 5
-date: '2022-01-26'
 author: David Dorsey, Teoderick Contreras, Splunk
-type: TTP
-datamodel: []
+datamodel:
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-26'
 description: This search looks for modifications to registry keys that can be used
   to elevate privileges. The registry keys under "Image File Execution Options" are
   used to intercept calls to an executable and can be used to attach malicious binaries
   to benign system binaries.
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+id: c9f4b923-f8af-4155-b697-1354f5bcbc5e
+known_false_positives: There are many legitimate applications that must execute upon
+  system startup and will use these registry keys to accomplish that task.
+name: Registry Keys Used For Privilege Escalation
+references:
+- https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
   where (Registry.registry_path="*Microsoft\\Windows NT\\CurrentVersion\\Image File
   Execution Options*") AND (Registry.registry_value_name=GlobalFlag OR Registry.registry_value_name=Debugger)
@@ -24,16 +34,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   _time dest user parent_process_name parent_process process_name process_path process
   proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `registry_keys_used_for_privilege_escalation_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black, or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: There are many legitimate applications that must execute upon
-  system startup and will use these registry keys to accomplish that task.
-references:
-- https://blog.malwarebytes.com/101/2015/12/an-introduction-to-image-file-execution-options/
 tags:
   analytic_story:
   - Windows Privilege Escalation
@@ -62,22 +62,34 @@ tags:
   - DE.CM
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.dest
-  - Registry.user
   risk_score: 76
   security_domain: endpoint
+type: TTP
+version: 5
diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml
index 013a7e4816..3ab4f0f561 100644
--- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml
+++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml
@@ -1,33 +1,31 @@
-name: Regsvr32 Silent and Install Param Dll Loading
-id: f421c250-24e7-11ec-bc43-acde48001122
-version: 1
-date: '2021-10-04'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-10-04'
 description: This analytic is to detect a loading of dll using regsvr32 application
   with silent parameter and dllinstall execution. This technique was seen in several
   RAT malware similar to remcos, njrat and adversaries to load their malicious DLL
   on the compromised machine. This TTP may executed by normal 3rd party application
   so it is better to pivot by the parent process, parent command-line and command-line
   of the file that execute this regsvr32.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: f421c250-24e7-11ec-bc43-acde48001122
+known_false_positives: Other third part application may used this parameter but not
+  so common in base windows environment.
+name: Regsvr32 Silent and Install Param Dll Loading
+references:
+- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#
+- https://attack.mitre.org/techniques/T1218/010/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` AND Processes.process="*/i*"
   by Processes.dest Processes.parent_process Processes.process Processes.parent_process_name
   Processes.process_name Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where
   match(process,"(?i)[\-|\/][Ss]{1}") | `regsvr32_silent_and_install_param_dll_loading_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Other third part application may used this parameter but not
-  so common in base windows environment.
-references:
-- https://app.any.run/tasks/dc93ee63-050c-4ff8-b07e-8277af9ab939/#
-- https://attack.mitre.org/techniques/T1218/010/
 tags:
   analytic_story:
   - Suspicious Regsvr32 Activity
@@ -51,39 +49,37 @@ tags:
   - T1218.010
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 36
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml
index 9a2eec50d2..7416a66552 100644
--- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml
+++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml
@@ -1,11 +1,7 @@
-name: Regsvr32 with Known Silent Switch Cmdline
-id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122
-version: 2
-date: '2021-07-27'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-07-27'
 description: The following analytic identifies Regsvr32.exe utilizing the silent switch
   to load DLLs. This technique has most recently been seen in IcedID campaigns to
   load its initial dll that will download the 2nd stage loader that will download
@@ -14,22 +10,24 @@ description: The following analytic identifies Regsvr32.exe utilizing the silent
   are more switch types that may be used. \ During triage, review parallel processes
   and capture any artifacts that may have landed on disk. Isolate and contain the
   endpoint as necessary.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122
+known_false_positives: minimal. but network operator can use this application to load
+  dll.
+name: Regsvr32 with Known Silent Switch Cmdline
+references:
+- https://app.any.run/tasks/56680cba-2bbc-4b34-8633-5f7878ddf858/
+- https://regexr.com/699e2
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` by Processes.user
   Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name
   Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | where match(process,"(?i)[\-|\/][Ss]{1}")
   | `regsvr32_with_known_silent_switch_cmdline_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: minimal. but network operator can use this application to load
-  dll.
-references:
-- https://app.any.run/tasks/56680cba-2bbc-4b34-8633-5f7878ddf858/
-- https://regexr.com/699e2
 tags:
   analytic_story:
   - IcedID
@@ -52,39 +50,37 @@ tags:
   - T1218.010
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: Anomaly
+version: 2
diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml
index 17c83f11a9..c0e1d92b87 100644
--- a/detections/endpoint/remcos_client_registry_install_entry.yml
+++ b/detections/endpoint/remcos_client_registry_install_entry.yml
@@ -1,13 +1,19 @@
-name: Remcos client registry install entry
-id: f2a1615a-1d63-11ec-97d2-acde48001122
-version: 2
-date: '2022-01-26'
 author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-26'
 description: This search detects registry key license at host where Remcos RAT agent
   is installed.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: f2a1615a-1d63-11ec-97d2-acde48001122
+known_false_positives: unknown
+name: Remcos client registry install entry
+references:
+- https://attack.mitre.org/software/S0332/
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
   where (Registry.registry_key_name=*\\Software\\Remcos*) by _time span=1h Registry.dest
   Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data
@@ -20,13 +26,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data |`remcos_client_registry_install_entry_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: unknown
-references:
-- https://attack.mitre.org/software/S0332/
 tags:
   analytic_story:
   - Remcos
@@ -45,21 +44,32 @@ tags:
   - T1112
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.process_id
-  - Registry.dest
-  - Registry.user
   risk_score: 90
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml
index 1184bd9ade..a4a717ab39 100644
--- a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml
+++ b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml
@@ -1,28 +1,26 @@
-name: Remcos RAT File Creation in Remcos Folder
-id: 25ae862a-1ac3-11ec-94a1-acde48001122
-version: 1
-date: '2021-09-21'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2021-09-21'
 description: This search is to detect file creation in remcos folder in appdata which
   is the keylog and clipboard logs that will be send to its c2 server. This is really
   a good TTP indicator that there is a remcos rat in the system that do keylogging,
   clipboard grabbing and audio recording.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 25ae862a-1ac3-11ec-94a1-acde48001122
+known_false_positives: unknown
+name: Remcos RAT File Creation in Remcos Folder
+references:
+- https://success.trendmicro.com/solution/1123281-remcos-malware-information
+- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/
 search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.dat")
   Filesystem.file_path = "*\\remcos\\*" by _time Filesystem.file_name Filesystem.file_path
   Filesystem.dest Filesystem.file_create_time | `drop_dm_object_name(Processes)` |
   `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remcos_rat_file_creation_in_remcos_folder_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: unknown
-references:
-- https://success.trendmicro.com/solution/1123281-remcos-malware-information
-- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/
 tags:
   analytic_story:
   - Remcos
@@ -41,14 +39,18 @@ tags:
   - T1113
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
   - _time
   - dest
   - file_create_time
@@ -56,3 +58,5 @@ tags:
   - file_path
   risk_score: 100
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
index 4a7362585c..4b74691f70 100644
--- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml
@@ -1,30 +1,28 @@
-name: Remote Process Instantiation via DCOM and PowerShell
-id: d4f42098-4680-11ec-ad07-3e22fbd008af
-version: 1
-date: '2021-11-15'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-15'
 description: This analytic looks for the execution of `powershell.exe` with arguments
   utilized to start a process on a remote endpoint by abusing the DCOM protocol. Specifically,
   this search looks for the abuse of ShellExecute and ExecuteShellCommand. Red Teams
   and adversaries alike may abuse DCOM and `powershell.exe` for lateral movement and
   remote code execution.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+id: d4f42098-4680-11ec-ad07-3e22fbd008af
+known_false_positives: Administrators may leverage DCOM to start a process on remote
+  systems, but this activity is usually limited to a small set of hosts or users.
+name: Remote Process Instantiation via DCOM and PowerShell
+references:
+- https://attack.mitre.org/techniques/T1021/003/
+- https://www.cybereason.com/blog/dcom-lateral-movement-techniques
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Document.ActiveView.ExecuteShellCommand*"
   OR Processes.process="*Document.Application.ShellExecute*") by Processes.dest Processes.user
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `remote_process_instantiation_via_dcom_and_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
-known_false_positives: Administrators may leverage DCOM to start a process on remote
-  systems, but this activity is usually limited to a small set of hosts or users.
-references:
-- https://attack.mitre.org/techniques/T1021/003/
-- https://www.cybereason.com/blog/dcom-lateral-movement-techniques
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -45,27 +43,25 @@ tags:
   - T1021.003
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
index fff1f18412..bfe68b51e2 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml
@@ -1,31 +1,29 @@
-name: Remote Process Instantiation via WinRM and PowerShell
-id: ba24cda8-4716-11ec-8009-3e22fbd008af
-version: 1
-date: '2021-11-16'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-16'
 description: This analytic looks for the execution of `powershell.exe` with arguments
   utilized to start a process on a remote endpoint by abusing the WinRM protocol.
   Specifically, this search looks for the abuse of the `Invoke-Command` commandlet.
   Red Teams and adversaries alike may abuse WinRM and `powershell.exe` for lateral
   movement and remote code execution.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+id: ba24cda8-4716-11ec-8009-3e22fbd008af
+known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start
+  a process on remote systems for system administration or automation use cases. However,
+  this activity is usually limited to a small set of hosts or users.
+name: Remote Process Instantiation via WinRM and PowerShell
+references:
+- https://attack.mitre.org/techniques/T1021/006/
+- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Invoke-Command*"
   AND Processes.process="*-ComputerName*") by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `remote_process_instantiation_via_winrm_and_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
-known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start
-  a process on remote systems for system administration or automation use cases. However,
-  this activity is usually limited to a small set of hosts or users.
-references:
-- https://attack.mitre.org/techniques/T1021/006/
-- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -46,27 +44,25 @@ tags:
   - T1021.006
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 45
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
index 2abcf01122..d342d1d5e6 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml
@@ -1,30 +1,28 @@
-name: Remote Process Instantiation via WinRM and Winrs
-id: 0dd296a2-4338-11ec-ba02-3e22fbd008af
-version: 1
-date: '2021-11-11'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-11'
 description: This analytic looks for the execution of `winrs.exe` with command-line
   arguments utilized to start a process on a remote endpoint. Red Teams and adversaries
   alike may abuse the WinRM protocol and this binary for lateral movement and remote
   code execution.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+id: 0dd296a2-4338-11ec-ba02-3e22fbd008af
+known_false_positives: Administrators may leverage WinRM and WinRs to start a process
+  on remote systems, but this activity is usually limited to a small set of hosts
+  or users.
+name: Remote Process Instantiation via WinRM and Winrs
+references:
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/winrs
+- https://attack.mitre.org/techniques/T1021/006/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=winrs.exe
   OR Processes.original_file_name=winrs.exe) (Processes.process="*-r:*" OR Processes.process="*-remote:*")
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_winrm_and_winrs_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
-known_false_positives: Administrators may leverage WinRM and WinRs to start a process
-  on remote systems, but this activity is usually limited to a small set of hosts
-  or users.
-references:
-- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/winrs
-- https://attack.mitre.org/techniques/T1021/006/
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -44,27 +42,26 @@ tags:
   - T1021.006
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml
index 2f68f5492b..84597a6896 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml
@@ -1,31 +1,29 @@
-name: Remote Process Instantiation via WMI
-id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da
-version: 7
-date: '2021-11-12'
 author: Rico Valdez, Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-12'
 description: This analytic identifies wmic.exe being launched with parameters to spawn
   a process on a remote system. Red Teams and adversaries alike may abuse WMI and
   this binary for lateral movement and remote code execution.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da
+known_false_positives: The wmic.exe utility is a benign Windows application. It may
+  be used legitimately by Administrators with these parameters for remote system administration,
+  but it's relatively uncommon.
+name: Remote Process Instantiation via WMI
+references:
+- https://attack.mitre.org/techniques/T1047/
+- https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/create-method-in-class-win32-process
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_wmic` (Processes.process="*/node:*"
   AND Processes.process="*process*" AND Processes.process="*call*" AND  Processes.process="*create*")
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: The wmic.exe utility is a benign Windows application. It may
-  be used legitimately by Administrators with these parameters for remote system administration,
-  but it's relatively uncommon.
-references:
-- https://attack.mitre.org/techniques/T1047/
-- https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/create-method-in-class-win32-process
 tags:
   analytic_story:
   - Ransomware
@@ -56,31 +54,29 @@ tags:
   - PR.IP
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 7
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
index d9ff14079a..54dfe0df48 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml
@@ -1,30 +1,28 @@
-name: Remote Process Instantiation via WMI and PowerShell
-id: 112638b4-4634-11ec-b9ab-3e22fbd008af
-version: 1
-date: '2021-11-15'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-15'
 description: This analytic looks for the execution of `powershell.exe` leveraging
   the `Invoke-WmiMethod` commandlet complemented with arguments utilized to start
   a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may
   abuse WMI and `powershell.exe` for lateral movement and remote code execution.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+id: 112638b4-4634-11ec-b9ab-3e22fbd008af
+known_false_positives: Administrators may leverage WWMI and powershell.exe to start
+  a process on remote systems, but this activity is usually limited to a small set
+  of hosts or users.
+name: Remote Process Instantiation via WMI and PowerShell
+references:
+- https://attack.mitre.org/techniques/T1047/
+- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Invoke-WmiMethod*"
   AND Processes.process="*-CN*" AND Processes.process="*-Class Win32_Process*" AND  Processes.process="*-Name
   create*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_and_powershell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
-known_false_positives: Administrators may leverage WWMI and powershell.exe to start
-  a process on remote systems, but this activity is usually limited to a small set
-  of hosts or users.
-references:
-- https://attack.mitre.org/techniques/T1047/
-- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -44,27 +42,25 @@ tags:
   - T1047
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/remote_system_discovery_with_dsquery.yml b/detections/endpoint/remote_system_discovery_with_dsquery.yml
index 5d6a595a25..c7023f4e71 100644
--- a/detections/endpoint/remote_system_discovery_with_dsquery.yml
+++ b/detections/endpoint/remote_system_discovery_with_dsquery.yml
@@ -1,29 +1,27 @@
-name: Remote System Discovery with Dsquery
-id: 9fb562f4-42f8-4139-8e11-a82edf7ed718
-version: 1
-date: '2021-08-31'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-31'
 description: This analytic looks for the execution of `dsquery.exe` with command-line
   arguments utilized to discover remote systems. The `computer` argument returns a
   list of all computers registered in the domain. Red Teams and adversaries alike
   engage in remote system discovery for situational awareness and Active Directory
   Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 9fb562f4-42f8-4139-8e11-a82edf7ed718
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Remote System Discovery with Dsquery
+references:
+- https://attack.mitre.org/techniques/T1018/
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732952(v=ws.11)
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dsquery.exe")
   (Processes.process="*computer*") by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `remote_system_discovery_with_dsquery_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1018/
-- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc732952(v=ws.11)
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -43,24 +41,22 @@ tags:
   - T1018
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/remote_system_discovery_with_net.yml b/detections/endpoint/remote_system_discovery_with_net.yml
index 34d963c52f..e655101e24 100644
--- a/detections/endpoint/remote_system_discovery_with_net.yml
+++ b/detections/endpoint/remote_system_discovery_with_net.yml
@@ -1,16 +1,20 @@
-name: Remote System Discovery with Net
-id: 9df16706-04a2-41e2-bbfe-9b38b34409d3
-version: 1
-date: '2021-08-30'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-30'
 description: This analytic looks for the execution of `net.exe` or `net1.exe` with
   command-line arguments utilized to discover remote systems. The argument `domain
   computers /domain` returns a list of all domain computers. Red Teams and adversaries
   alike use net.exe to identify remote systems for situational awareness and Active
   Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 9df16706-04a2-41e2-bbfe-9b38b34409d3
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Remote System Discovery with Net
+references:
+- https://attack.mitre.org/techniques/T1018/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe"
   OR Processes.process_name="net1.exe") (Processes.process="*domain computers*" AND
@@ -18,12 +22,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_system_discovery_with_net_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1018/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -43,24 +41,22 @@ tags:
   - T1018
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/remote_system_discovery_with_wmic.yml b/detections/endpoint/remote_system_discovery_with_wmic.yml
index 092c163d81..501484d397 100644
--- a/detections/endpoint/remote_system_discovery_with_wmic.yml
+++ b/detections/endpoint/remote_system_discovery_with_wmic.yml
@@ -1,16 +1,21 @@
-name: Remote System Discovery with Wmic
-id: d82eced3-b1dc-42ab-859e-a2fc98827359
-version: 1
-date: '2021-09-01'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-01'
 description: This analytic looks for the execution of `wmic.exe` with command-line
   arguments utilized to discover remote systems. The arguments utilized in this command
   return a list of all the systems registered in the domain. Red Teams and adversaries
   alike may leverage WMI and wmic.exe to identify remote systems for situational awareness
   and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: d82eced3-b1dc-42ab-859e-a2fc98827359
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Remote System Discovery with Wmic
+references:
+- https://attack.mitre.org/techniques/T1018/
+- https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmic
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe")
   (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap* AND Processes.process=*ds_computer*
@@ -18,13 +23,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `remote_system_discovery_with_wmic_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1018/
-- https://docs.microsoft.com/en-us/windows/win32/wmisdk/wmic
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -44,26 +42,24 @@ tags:
   - T1018
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 15
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml
index b88e03dead..39b524d9b6 100644
--- a/detections/endpoint/remote_wmi_command_attempt.yml
+++ b/detections/endpoint/remote_wmi_command_attempt.yml
@@ -1,31 +1,29 @@
-name: Remote WMI Command Attempt
-id: 272df6de-61f1-4784-877c-1fbc3e2d0838
-version: 4
-date: '2018-12-03'
 author: Rico Valdez, Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2018-12-03'
 description: The following analytic identifies usage of `wmic.exe` spawning a local
   or remote process, identified by the `node` switch. During triage, review parallel
   processes for additional commands executed. Look for any file modifications before
   and after `wmic.exe` execution. In addition, identify the remote endpoint and confirm
   execution or file modifications. Contain and isolate the endpoint as needed.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process=*node*
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_wmi_command_attempt_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product. Deprecated because duplicate of Remote Process Instantiation via
   WMI.
+id: 272df6de-61f1-4784-877c-1fbc3e2d0838
 known_false_positives: Administrators may use this legitimately to gather info from
   remote systems. Filter as needed.
+name: Remote WMI Command Attempt
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process=*node*
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_wmi_command_attempt_filter`'
 tags:
   analytic_story:
   - Suspicious WMI Use
@@ -54,27 +52,29 @@ tags:
   - PR.IP
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.user
-  - Processes.process_name
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.parent_process
-  - Processes.parent_process_id
-  - Processes.process_id
   risk_score: 36
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 4
diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml
index ecbd7e4c63..df0742fe47 100644
--- a/detections/endpoint/resize_shadowstorage_volume.yml
+++ b/detections/endpoint/resize_shadowstorage_volume.yml
@@ -1,17 +1,26 @@
-name: Resize ShadowStorage volume
-id: bc760ca6-8336-11eb-bcbb-acde48001122
-version: 1
-date: '2021-03-12'
 author: Teoderick Contreras
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-03-12'
 description: The following analytics identifies the resizing of shadowstorage by ransomware
   malware to avoid the shadow volumes being made again. this technique is an alternative
   by ransomware attacker than deleting the shadowstorage which is known alert in defensive
   team. one example of ransomware that use this technique is CLOP ransomware where
   it drops a .bat file that will resize the shadowstorage to minimum size as much
   as possible
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: bc760ca6-8336-11eb-bcbb-acde48001122
+known_false_positives: network admin can resize the shadowstorage for valid purposes.
+name: Resize ShadowStorage volume
+references:
+- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
+- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
+- https://redcanary.com/blog/blackbyte-ransomware/
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin-resize-shadowstorage
 search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline
   values(Processes.parent_process_name) as parent_process values(Processes.process_name)
   as process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
@@ -22,17 +31,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.parent_process Processes.process_name Processes.process Processes.dest
   Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `resize_shadowstorage_volume_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: network admin can resize the shadowstorage for valid purposes.
-references:
-- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
-- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
-- https://redcanary.com/blog/blackbyte-ransomware/
-- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/vssadmin-resize-shadowstorage
 tags:
   analytic_story:
   - Clop Ransomware
@@ -52,26 +50,30 @@ tags:
   - T1490
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.process
-  - Process.parent_process_name
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.parent_process
-  - Processes.dest
-  - Processes.user
   risk_score: 72
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml
index b48aa0033c..49e56f7e8d 100644
--- a/detections/endpoint/revil_common_exec_parameter.yml
+++ b/detections/endpoint/revil_common_exec_parameter.yml
@@ -1,13 +1,20 @@
-name: Revil Common Exec Parameter
-id: 85facebe-c382-11eb-9c3e-acde48001122
-version: 2
-date: '2021-06-02'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-06-02'
 description: This analytic identifies suspicious commandline parameter that are commonly
   used by REVIL ransomware to encrypts the compromise machine.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 85facebe-c382-11eb-9c3e-acde48001122
+known_false_positives: third party tool may have same command line parameters as revil
+  ransomware.
+name: Revil Common Exec Parameter
+references:
+- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
+- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process = "* -nolan
   *" OR Processes.process = "* -nolocal *" OR Processes.process = "* -fast *" OR Processes.process
@@ -15,15 +22,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `revil_common_exec_parameter_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: third party tool may have same command line parameters as revil
-  ransomware.
-references:
-- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
-- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
 tags:
   analytic_story:
   - Ransomware
@@ -44,28 +42,30 @@ tags:
   - T1204
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.dest
-  - Processes.user
-  - Processes.process_id
-  - Processes.process_guid
   risk_score: 54
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml
index d24975ae03..3997f64661 100644
--- a/detections/endpoint/revil_registry_entry.yml
+++ b/detections/endpoint/revil_registry_entry.yml
@@ -1,16 +1,22 @@
-name: Revil Registry Entry
-id: e3d3f57a-c381-11eb-9e35-acde48001122
-version: 2
-date: '2021-01-26'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2021-01-26'
 description: This analytic identifies suspicious modification in registry entry to
   keep some malware data during its infection. This technique seen in several apt
   implant, malware and ransomware like REVIL where it keep some information like the
   random generated file extension it uses for all the encrypted files and ransomware
   notes file name in the compromised host.
+how_to_implement: to successfully implement this search, you need to be ingesting
+  logs with the Image, TargetObject registry key, registry Details from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+id: e3d3f57a-c381-11eb-9e35-acde48001122
+known_false_positives: unknown
+name: Revil Registry Entry
+references:
+- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
+- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
 search: '| tstats `security_content_summariesonly` count  FROM datamodel=Endpoint.Registry
   where (Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\Facebook_Assistant\\*"
   OR Registry.registry_path="*\\SOFTWARE\\WOW6432Node\\BlackLivesMatter*") by _time
@@ -24,13 +30,6 @@ search: '| tstats `security_content_summariesonly` count  FROM datamodel=Endpoin
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `revil_registry_entry_filter`'
-how_to_implement: to successfully implement this search, you need to be ingesting
-  logs with the Image, TargetObject registry key, registry Details from your endpoints.
-  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: unknown
-references:
-- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
-- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
 tags:
   analytic_story:
   - Ransomware
@@ -51,25 +50,35 @@ tags:
   - T1112
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_value_name
-  - Registry.registry_path
-  - Registry.registry_key_name
   risk_score: 60
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml
index d73d45add5..16ef1d3335 100644
--- a/detections/endpoint/rubeus_command_line_parameters.yml
+++ b/detections/endpoint/rubeus_command_line_parameters.yml
@@ -1,11 +1,7 @@
-name: Rubeus Command Line Parameters
-id: cca37478-8377-11ec-b59a-acde48001122
-version: 1
-date: '2022-02-01'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-02-01'
 description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is
   heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs MakeMeEnterpriseAdmin
   project. This analytic looks for the use of Rubeus command line arguments utilized
@@ -15,6 +11,18 @@ description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It
   networks. Defenders should be aware that adversaries may customize the source code
   of Rubeus and modify the command line parameters. This would effectively bypass
   this analytic.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: cca37478-8377-11ec-b59a-acde48001122
+known_false_positives: Although unlikely, legitimate applications may use the same
+  command line parameters as Rubeus. Filter as needed.
+name: Rubeus Command Line Parameters
+references:
+- https://github.com/GhostPack/Rubeus
+- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
+- https://attack.mitre.org/techniques/T1550/003/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*ptt /ticket*"
   OR Processes.process = "* monitor*" OR Processes.process ="* asktgt* /user:*" OR
@@ -26,16 +34,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `rubeus_command_line_parameters_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: Although unlikely, legitimate applications may use the same
-  command line parameters as Rubeus. Filter as needed.
-references:
-- https://github.com/GhostPack/Rubeus
-- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
-- https://attack.mitre.org/techniques/T1550/003/
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
@@ -57,30 +55,32 @@ tags:
   - T1558.004
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
-  - Processes.parent_process_name
   risk_score: 36
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
index 3558058c97..a54bf3083f 100644
--- a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
+++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml
@@ -1,10 +1,6 @@
-name: Rubeus Kerberos Ticket Exports Through Winlogon Access
-id: 5ed8c50a-8869-11ec-876f-acde48001122
-version: 1
-date: '2022-02-07'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel: []
+date: '2022-02-07'
 description: The following analytic looks for a process accessing the winlogon.exe
   system process. The Splunk Threat Research team identified this behavior when using
   the Rubeus tool to monitor for and export kerberos tickets from memory. Before being
@@ -15,6 +11,19 @@ description: The following analytic looks for a process accessing the winlogon.e
   tickets to move laterally within an environment, bypassing normal system access
   controls. Defenders should be aware that adversaries may customize the source code
   of Rubeus to potentially bypass this analytic.
+how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which
+  includes EventCode 10. This search uses an input macro named `sysmon`. We strongly
+  recommend that you specify your environment-specific configurations (index, source,
+  sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations
+  for your Splunk environment.
+id: 5ed8c50a-8869-11ec-876f-acde48001122
+known_false_positives: Legitimate applications may obtain a handle for winlogon.exe.
+  Filter as needed
+name: Rubeus Kerberos Ticket Exports Through Winlogon Access
+references:
+- https://github.com/GhostPack/Rubeus
+- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
+- https://attack.mitre.org/techniques/T1550/003/
 search: ' `sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe (GrantedAccess=0x1f3fff)
   (SourceImage!=C:\\Windows\\system32\\svchost.exe AND SourceImage!=C:\\Windows\\system32\\lsass.exe
   AND SourceImage!=C:\\Windows\\system32\\LogonUI.exe AND SourceImage!=C:\\Windows\\system32\\smss.exe
@@ -22,17 +31,6 @@ search: ' `sysmon` EventCode=10 TargetImage=C:\\Windows\\system32\\winlogon.exe
   as firstTime max(_time) as lastTime by Computer, SourceImage, SourceProcessId, TargetImage,
   TargetProcessId, EventCode, GrantedAccess | rename Computer as dest | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `rubeus_kerberos_ticket_exports_through_winlogon_access_filter`'
-how_to_implement: This search needs Sysmon Logs and a sysmon configuration, which
-  includes EventCode 10. This search uses an input macro named `sysmon`. We strongly
-  recommend that you specify your environment-specific configurations (index, source,
-  sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations
-  for your Splunk environment.
-known_false_positives: Legitimate applications may obtain a handle for winlogon.exe.
-  Filter as needed
-references:
-- https://github.com/GhostPack/Rubeus
-- http://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
-- https://attack.mitre.org/techniques/T1550/003/
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
@@ -52,25 +50,26 @@ tags:
   - T1550.003
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: TargetImage
-    type: Process
     role:
     - Target
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - EventCode
-  - TargetImage
-  - CallTrace
   - Computer
-  - TargetProcessId
+  - EventCode
   - SourceImage
   - SourceProcessId
+  - TargetImage
+  - TargetProcessId
+  - _time
   risk_score: 36
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/runas_execution_in_commandline.yml b/detections/endpoint/runas_execution_in_commandline.yml
index d7fefc7c3e..2e28caf940 100644
--- a/detections/endpoint/runas_execution_in_commandline.yml
+++ b/detections/endpoint/runas_execution_in_commandline.yml
@@ -1,33 +1,31 @@
-name: Runas Execution in CommandLine
-id: 4807e716-43a4-11ec-a0e7-acde48001122
-version: 1
-date: '2021-11-12'
 author: Teoderick Contreras, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-12'
 description: This analytic look for a spawned runas.exe process with a administrator
   user option parameter. This parameter was abused by adversaries, malware author
   or even red teams to gain elevated privileges in target host. This is a good hunting
   query to figure out privilege escalation tactics that may used for different stages
   like lateral movement but take note that administrator may use this command in purpose
   so its better to see other event context before and after this analytic.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 4807e716-43a4-11ec-a0e7-acde48001122
+known_false_positives: A network operator or systems administrator may utilize an
+  automated or manual execute this command that may generate false positives. filter
+  is needed.
+name: Runas Execution in CommandLine
+references:
+- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_runas` AND Processes.process
   = "*/user:*" AND Processes.process = "*admin*" by Processes.dest Processes.user
   Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `runas_execution_in_commandline_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: A network operator or systems administrator may utilize an
-  automated or manual execute this command that may generate false positives. filter
-  is needed.
-references:
-- https://app.any.run/tasks/ad4c3cda-41f2-4401-8dba-56cc2d245488/#
 tags:
   analytic_story:
   - Windows Privilege Escalation
@@ -47,22 +45,24 @@ tags:
   - T1134.001
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml
index 3e2e0dfb3b..15a8aef847 100644
--- a/detections/endpoint/rundll32_control_rundll_hunt.yml
+++ b/detections/endpoint/rundll32_control_rundll_hunt.yml
@@ -1,11 +1,7 @@
-name: Rundll32 Control RunDLL Hunt
-id: c8e7ced0-10c5-11ec-8b03-acde48001122
-version: 1
-date: '2021-09-08'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-08'
 description: The following hunting detection identifies rundll32.exe with `control_rundll`
   within the command-line, loading a .cpl or another file type. Developed in relation
   to CVE-2021-40444. Rundll32.exe can also be used to execute Control Panel Item files
@@ -13,19 +9,15 @@ description: The following hunting detection identifies rundll32.exe with `contr
   Double-clicking a .cpl file also causes rundll32.exe to execute. \ This is written
   to be a bit more broad by not including .cpl. \ During triage, review parallel processes
   to identify any further suspicious behavior.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*Control_RunDLL*  by
-  Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `rundll32_control_rundll_hunt_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: c8e7ced0-10c5-11ec-8b03-acde48001122
 known_false_positives: This is a hunting detection, meant to provide a understanding
   of how voluminous control_rundll is within the environment.
+name: Rundll32 Control RunDLL Hunt
 references:
 - https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
 - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
@@ -33,6 +25,12 @@ references:
 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
 - https://redcanary.com/blog/intelligence-insights-december-2021/
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*Control_RunDLL*  by
+  Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `rundll32_control_rundll_hunt_filter`'
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity
@@ -56,36 +54,35 @@ tags:
   - T1218.011
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
index e22be31c8a..f3854f4cb9 100644
--- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
+++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
@@ -1,11 +1,7 @@
-name: Rundll32 Control RunDLL World Writable Directory
-id: 1adffe86-10c3-11ec-8ce6-acde48001122
-version: 1
-date: '2021-09-08'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-08'
 description: The following detection identifies rundll32.exe with `control_rundll`
   within the command-line, loading a .cpl or another file type from windows\temp,
   programdata, or appdata. Developed in relation to CVE-2021-40444. Rundll32.exe can
@@ -14,20 +10,15 @@ description: The following detection identifies rundll32.exe with `control_rundl
   .cpl file also causes rundll32.exe to execute. This is written to be a bit more
   broad by not including .cpl. The paths are specified, add more as needed. During
   triage, review parallel processes to identify any further suspicious behavior.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*Control_RunDLL*
-  AND Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*")  by
-  Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `rundll32_control_rundll_world_writable_directory_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: 1adffe86-10c3-11ec-8ce6-acde48001122
 known_false_positives: This may be tuned, or a new one related, by adding .cpl to
   command-line. However, it's important to look for both. Tune/filter as needed.
+name: Rundll32 Control RunDLL World Writable Directory
 references:
 - https://strontic.github.io/xcyclopedia/library/rundll32.exe-111474C61232202B5B588D2B512CBB25.html
 - https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/
@@ -35,6 +26,13 @@ references:
 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml
 - https://redcanary.com/blog/intelligence-insights-december-2021/
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*Control_RunDLL*
+  AND Processes.process IN ("*\\appdata\\*", "*\\windows\\temp\\*", "*\\programdata\\*")  by
+  Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `rundll32_control_rundll_world_writable_directory_filter`'
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity
@@ -58,38 +56,37 @@ tags:
   - T1218.011
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml
index aef668eded..c0ee5fe8fc 100644
--- a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml
+++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml
@@ -1,26 +1,23 @@
-name: Rundll32 Create Remote Thread To A Process
-id: 2dbeee3a-f067-11eb-96c0-acde48001122
-version: 1
-date: '2021-07-29'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-07-29'
 description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe
   process to cmd.exe process. This technique was seen in IcedID malware to execute
   its malicious code in normal process for defense evasion and to steal sensitive
   information the the compromised host. browser process.
-search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage = "*.exe"
-  | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage
-  TargetProcessId SourceProcessId StartAddress EventCode Computer | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `rundll32_create_remote_thread_to_a_process_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the SourceImage, TargetImage, and EventCode executions from your endpoints
   related to create remote thread or injecting codes. If you are using Sysmon, you
   must have at least version 6.0.4 of the Sysmon TA.
+id: 2dbeee3a-f067-11eb-96c0-acde48001122
 known_false_positives: unknown
+name: Rundll32 Create Remote Thread To A Process
 references:
 - https://www.joesandbox.com/analysis/380662/0/html
+search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage = "*.exe"
+  | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage
+  TargetProcessId SourceProcessId StartAddress EventCode Computer | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `rundll32_create_remote_thread_to_a_process_filter`'
 tags:
   analytic_story:
   - IcedID
@@ -40,13 +37,13 @@ tags:
   - T1055
   observable:
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: SourceImage
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -62,3 +59,5 @@ tags:
   - Computer
   risk_score: 56
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/endpoint/rundll32_createremotethread_in_browser.yml
index 5c16b5d6d6..90cdc473d3 100644
--- a/detections/endpoint/rundll32_createremotethread_in_browser.yml
+++ b/detections/endpoint/rundll32_createremotethread_in_browser.yml
@@ -1,27 +1,24 @@
-name: Rundll32 CreateRemoteThread In Browser
-id: f8a22586-ee2d-11eb-a193-acde48001122
-version: 1
-date: '2021-07-26'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-07-26'
 description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe
   process to "firefox.exe" and "chrome.exe" browser. This technique was seen in IcedID
   malware where it hooks the browser to parse banking information as user used the
   targetted browser process.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the SourceImage, TargetImage, and EventCode executions from your endpoints
+  related to create remote thread or injecting codes. If you are using Sysmon, you
+  must have at least version 6.0.4 of the Sysmon TA.
+id: f8a22586-ee2d-11eb-a193-acde48001122
+known_false_positives: unknown
+name: Rundll32 CreateRemoteThread In Browser
+references:
+- https://www.joesandbox.com/analysis/380662/0/html
 search: '`sysmon` EventCode=8 SourceImage = "*\\rundll32.exe" TargetImage IN ("*\\firefox.exe",
   "*\\chrome.exe", "*\\iexplore.exe","*\\microsoftedgecp.exe") | stats count min(_time)
   as firstTime max(_time) as lastTime by SourceImage TargetImage TargetProcessId SourceProcessId
   StartAddress EventCode Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `rundll32_createremotethread_in_browser_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the SourceImage, TargetImage, and EventCode executions from your endpoints
-  related to create remote thread or injecting codes. If you are using Sysmon, you
-  must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: unknown
-references:
-- https://www.joesandbox.com/analysis/380662/0/html
 tags:
   analytic_story:
   - IcedID
@@ -41,13 +38,13 @@ tags:
   - T1055
   observable:
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: SourceImage
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -63,3 +60,5 @@ tags:
   - Computer
   risk_score: 70
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml
index cfb2f9d846..947878804a 100644
--- a/detections/endpoint/rundll32_dnsquery.yml
+++ b/detections/endpoint/rundll32_dnsquery.yml
@@ -1,26 +1,23 @@
-name: Rundll32 DNSQuery
-id: f1483f5e-ee29-11eb-9d23-acde48001122
-version: 2
-date: '2022-02-18'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2022-02-18'
 description: This search is to detect a suspicious rundll32.exe process having a http
   connection and do a dns query in some web domain. This technique was seen in IcedID
   malware where the rundll32 that execute its payload will contact amazon.com to check
   internet connect and to communicate to its C&C server to download config and other
   file component.
-search: '`sysmon` EventCode=22 process_name="rundll32.exe" | stats count min(_time)
-  as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId  Computer
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_dnsquery_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name and eventcode = 22 dnsquery executions from your endpoints.
   If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
   Tune and filter known instances where renamed rundll32.exe may be used.
+id: f1483f5e-ee29-11eb-9d23-acde48001122
 known_false_positives: unknown
+name: Rundll32 DNSQuery
 references:
 - https://any.run/malware-trends/icedid
+search: '`sysmon` EventCode=22 process_name="rundll32.exe" | stats count min(_time)
+  as firstTime max(_time) as lastTime by Image QueryName QueryStatus ProcessId  Computer
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `rundll32_dnsquery_filter`'
 tags:
   analytic_story:
   - IcedID
@@ -41,13 +38,13 @@ tags:
   - T1218.011
   observable:
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -61,3 +58,5 @@ tags:
   - Computer
   risk_score: 56
   security_domain: endpoint
+type: TTP
+version: 2
diff --git a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml
index b23c0499f3..19a9b6e9f6 100644
--- a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml
+++ b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml
@@ -1,26 +1,23 @@
-name: Rundll32 Process Creating Exe Dll Files
-id: 6338266a-ee2a-11eb-bf68-acde48001122
-version: 1
-date: '2021-07-26'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-07-26'
 description: This search is to detect a suspicious rundll32 process that drops executable
   (.exe or .dll) files. this behavior seen in rundll32 process of IcedID that tries
   to drop copy of itself in temp folder or download executable drop it either appdata
   or programdata as part of its execution.
-search: '`sysmon` EventCode=11 process_name="rundll32.exe" TargetFilename IN ("*.exe",
-  "*.dll",) | stats count min(_time) as firstTime max(_time) as lastTime by Image
-  TargetFilename ProcessGuid dest user_id | `security_content_ctime(firstTime)` |
-  `security_content_ctime(lastTime)` | `rundll32_process_creating_exe_dll_files_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, TargetFilename, and eventcode 11 executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+id: 6338266a-ee2a-11eb-bf68-acde48001122
 known_false_positives: unknown
+name: Rundll32 Process Creating Exe Dll Files
 references:
 - https://any.run/malware-trends/icedid
+search: '`sysmon` EventCode=11 process_name="rundll32.exe" TargetFilename IN ("*.exe",
+  "*.dll",) | stats count min(_time) as firstTime max(_time) as lastTime by Image
+  TargetFilename ProcessGuid dest user_id | `security_content_ctime(firstTime)` |
+  `security_content_ctime(lastTime)` | `rundll32_process_creating_exe_dll_files_filter`'
 tags:
   analytic_story:
   - IcedID
@@ -40,13 +37,13 @@ tags:
   - T1218.011
   observable:
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -60,3 +57,5 @@ tags:
   - user_id
   risk_score: 80
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml
index 845bd66115..ff8ab92534 100644
--- a/detections/endpoint/rundll32_shimcache_flush.yml
+++ b/detections/endpoint/rundll32_shimcache_flush.yml
@@ -1,30 +1,28 @@
-name: Rundll32 Shimcache Flush
-id: a913718a-25b6-11ec-96d3-acde48001122
-version: 1
-date: '2021-10-05'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-10-05'
 description: This analytic is to detect a suspicious rundll32 commandline to clear
   shim cache. This technique is a anti-forensic technique to clear the cache taht
   are one important artifacts in terms of digital forensic during attacks or incident.
   This TTP is a good indicator that someone tries to evade some tools and clear foothold
   on the machine.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: a913718a-25b6-11ec-96d3-acde48001122
+known_false_positives: unknown
+name: Rundll32 Shimcache Flush
+references:
+- https://blueteamops.medium.com/shimcache-flush-89daff28d15e
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where  `process_rundll32` AND Processes.process
   = "*apphelp.dll,ShimFlushCache*" by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `rundll32_shimcache_flush_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: unknown
-references:
-- https://blueteamops.medium.com/shimcache-flush-89daff28d15e
 tags:
   analytic_story:
   - Unusual Processes
@@ -43,31 +41,30 @@ tags:
   - T1112
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
index 632a790430..13d16993cc 100644
--- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
+++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
@@ -1,11 +1,8 @@
-name: Rundll32 with no Command Line Arguments with Network
-id: 35307032-a12d-11eb-835f-acde48001122
-version: 3
-date: '2021-10-13'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Ports
+- Endpoint.Processes
+date: '2021-10-13'
 description: The following analytic identifies rundll32.exe with no command line arguments
   and performing a network connection. It is unusual for rundll32.exe to execute with
   no command line arguments present. This particular behavior is common with malicious
@@ -13,6 +10,22 @@ description: The following analytic identifies rundll32.exe with no command line
   and parallel processes. Identify any suspicious module loads related to credential
   dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and
   C:\Windows\syswow64.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node.
+  To successfully implement this search you need to be ingesting information on process
+  that include the name of the process responsible for the changes from your endpoints
+  into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the
+  latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+id: 35307032-a12d-11eb-835f-acde48001122
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of rundll32, triggering a false positive.
+name: Rundll32 with no Command Line Arguments with Network
+references:
+- https://attack.mitre.org/techniques/T1218/011/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
+- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
+- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where `process_rundll32` by _time span=1h  Processes.process_guid Processes.process_name
   Processes.dest Processes.process_path Processes.process Processes.parent_process_name
@@ -22,20 +35,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)`
   | rename  dest as connection_to_CNC] | table _time dest parent_process_name process_name
   process_path process process_guid connection_to_CNC dest_port | `rundll32_with_no_command_line_arguments_with_network_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node.
-  To successfully implement this search you need to be ingesting information on process
-  that include the name of the process responsible for the changes from your endpoints
-  into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the
-  latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: Although unlikely, some legitimate applications may use a moved
-  copy of rundll32, triggering a false positive.
-references:
-- https://attack.mitre.org/techniques/T1218/011/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
-- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
-- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity
@@ -60,31 +59,32 @@ tags:
   - T1218.011
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: processname
     role:
     - Attacker
+    type: processname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Ports.dest
+  - Endpoint.Ports.dest_port
+  - Endpoint.Ports.process_guid
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 70
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 3
diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
index 39ea9b205b..35a5feaea3 100644
--- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml
+++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml
@@ -1,17 +1,25 @@
-name: RunDLL Loading DLL By Ordinal
-id: 6c135f8d-5e60-454e-80b7-c56eed739833
-version: 6
-date: '2022-02-08'
 author: Michael Haag, David Dorsey, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-02-08'
 description: The following analytic identifies rundll32.exe loading an export function
   by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious
   code. Using rundll32.exe, vice executing directly, may avoid triggering security
   tools that may not monitor execution of the rundll32.exe process because of allowlists
   or false positives from normal operations. Utilizing ordinal values makes it a bit
   more complicated for analysts to understand the behavior until the DLL is reviewed.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 6c135f8d-5e60-454e-80b7-c56eed739833
+known_false_positives: False positives are possible with native utilities and third
+  party applications. Filtering may be needed based on command-line, or add world
+  writeable paths to restrict query.
+name: RunDLL Loading DLL By Ordinal
+references:
+- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where `process_rundll32` by Processes.dest Processes.user Processes.parent_process_name
@@ -19,16 +27,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | where match(process,"rundll32.+\#\d+") |
   `rundll_loading_dll_by_ordinal_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives are possible with native utilities and third
-  party applications. Filtering may be needed based on command-line, or add world
-  writeable paths to restrict query.
-references:
-- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
 tags:
   analytic_story:
   - Unusual Processes
@@ -56,29 +54,28 @@ tags:
   - DE.CM
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
+type: TTP
+version: 6
diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml
index caa87944dd..7fecd3baff 100644
--- a/detections/endpoint/ryuk_test_files_detected.yml
+++ b/detections/endpoint/ryuk_test_files_detected.yml
@@ -1,23 +1,22 @@
-name: Ryuk Test Files Detected
-id: 57d44d70-28d9-4ed1-acf5-1c80ae2bbce3
-version: 1
-date: '2020-11-06'
 author: Rod Soto, Jose Hernandez, Splunk
-type: TTP
-datamodel: []
+datamodel:
+- Endpoint.Filesystem
+date: '2020-11-06'
 description: The search looks for files that contain the key word *Ryuk* under any
   folder in the C drive, which is consistent with Ryuk propagation.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime FROM datamodel=Endpoint.Filesystem WHERE Filesystem.file_path="C:\\*Ryuk*"
-  BY Filesystem.dest, Filesystem.user, Filesystem.file_path | `drop_dm_object_name(Filesystem)`
-  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ryuk_test_files_detected_filter`'
 how_to_implement: You must be ingesting data that records the filesystem activity
   from your hosts to populate the Endpoint Filesystem data-model object. If you are
   using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
   you want to collect data.
+id: 57d44d70-28d9-4ed1-acf5-1c80ae2bbce3
 known_false_positives: If there are files with this keywoord as file names it might
   trigger false possitives, please make use of our filters to tune out potential FPs.
+name: Ryuk Test Files Detected
 references: []
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem WHERE Filesystem.file_path="C:\\*Ryuk*"
+  BY Filesystem.dest, Filesystem.user, Filesystem.file_path | `drop_dm_object_name(Filesystem)`
+  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ryuk_test_files_detected_filter`'
 tags:
   analytic_story:
   - Ryuk Ransomware
@@ -42,21 +41,23 @@ tags:
   - DE.CM
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.user
   - _time
-  - Filesystem.file_path
-  - Filesystem.dest
-  - Filesystem.user
   risk_score: 70
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml
index 684c485717..55ad14a24e 100644
--- a/detections/endpoint/ryuk_wake_on_lan_command.yml
+++ b/detections/endpoint/ryuk_wake_on_lan_command.yml
@@ -1,11 +1,7 @@
-name: Ryuk Wake on LAN Command
-id: 538d0152-7aaa-11eb-beaa-acde48001122
-version: 1
-date: '2021-03-01'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-03-01'
 description: This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk
   ransomware. The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered
   off devices on a compromised network to have greater success encrypting them. This
@@ -15,20 +11,22 @@ description: This Splunk query identifies the use of Wake-on-LAN utilized by Ryu
   Scheduled Tasks on the isolated endpoint and across the fleet. Suspicious Scheduled
   Tasks will include a path to a unknown binary and those endpoints should be isolated
   until triaged.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 538d0152-7aaa-11eb-beaa-acde48001122
+known_false_positives: Limited to no known false positives.
+name: Ryuk Wake on LAN Command
+references:
+- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/
+- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-now-self-spreads-to-other-windows-lan-devices/
+- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process="*8 LAN*"
   OR Processes.process="*9 REP*") by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `ryuk_wake_on_lan_command_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Limited to no known false positives.
-references:
-- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-uses-wake-on-lan-to-encrypt-offline-devices/
-- https://www.bleepingcomputer.com/news/security/ryuk-ransomware-now-self-spreads-to-other-windows-lan-devices/
-- https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf
 tags:
   analytic_story:
   - Ryuk Ransomware
@@ -50,28 +48,29 @@ tags:
   - T1059.003
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/sam_database_file_access_attempt.yml b/detections/endpoint/sam_database_file_access_attempt.yml
index 4df51115be..3bb20e0837 100644
--- a/detections/endpoint/sam_database_file_access_attempt.yml
+++ b/detections/endpoint/sam_database_file_access_attempt.yml
@@ -1,26 +1,20 @@
-name: SAM Database File Access Attempt
-id: 57551656-ebdb-11eb-afdf-acde48001122
-version: 1
-date: '2021-07-23'
 author: Michael Haag, Mauricio Velazco, Splunk
-type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-07-23'
 description: The following analytic identifies access to SAM, SYSTEM or SECURITY databases'
   within the file path of `windows\system32\config` using Windows Security EventCode
   4663. This particular behavior is related to credential access, an attempt to either
   use a Shadow Copy or recent CVE-2021-36934 to access the SAM database. The Security
   Account Manager (SAM) is a database file in Windows XP, Windows Vista, Windows 7,
   8.1 and 10 that stores users' passwords.
-search: '`wineventlog_security` (EventCode=4663)  process_name!=*\\dllhost.exe Object_Name
-  IN ("*\\Windows\\System32\\config\\SAM*","*\\Windows\\System32\\config\\SYSTEM*","*\\Windows\\System32\\config\\SECURITY*")
-  | stats values(Accesses) count by process_name Object_Name  dest user | `sam_database_file_access_attempt_filter`'
 how_to_implement: To successfully implement this search, you must ingest Windows Security
   Event logs and track event code 4663. For 4663, enable "Audit Object Access" in
   Group Policy. Then check the two boxes listed for both "Success" and "Failure."
+id: 57551656-ebdb-11eb-afdf-acde48001122
 known_false_positives: Natively, `dllhost.exe` will access the files. Every environment
   will have additional native processes that do as well. Filter by process_name. As
   an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`.
+name: SAM Database File Access Attempt
 references:
 - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4663
 - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
@@ -28,6 +22,9 @@ references:
 - https://github.com/GossiTheDog/HiveNightmare
 - https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions
 - https://en.wikipedia.org/wiki/Security_Account_Manager
+search: '`wineventlog_security` (EventCode=4663)  process_name!=*\\dllhost.exe Object_Name
+  IN ("*\\Windows\\System32\\config\\SAM*","*\\Windows\\System32\\config\\SYSTEM*","*\\Windows\\System32\\config\\SECURITY*")
+  | stats values(Accesses) count by process_name Object_Name  dest user | `sam_database_file_access_attempt_filter`'
 tags:
   analytic_story:
   - Credential Dumping
@@ -49,30 +46,31 @@ tags:
   - T1003
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   - name: Object_Name
-    type: File
     role:
     - Other
+    type: File
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - process_name
   - Object_Name
   - dest
+  - process_name
   - user
   risk_score: 80
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml
index 17516b0b39..5ec5c40c17 100644
--- a/detections/endpoint/samsam_test_file_write.yml
+++ b/detections/endpoint/samsam_test_file_write.yml
@@ -1,24 +1,22 @@
-name: Samsam Test File Write
-id: 493a879d-519d-428f-8f57-a06a0fdc107e
-version: 1
-date: '2018-12-14'
 author: Rico Valdez, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+date: '2018-12-14'
 description: The search looks for a file named "test.txt" written to the windows system
   directory tree, which is consistent with Samsam propagation.
+how_to_implement: You must be ingesting data that records the file-system activity
+  from your hosts to populate the Endpoint file-system data-model node. If you are
+  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
+  you want to collect data.
+id: 493a879d-519d-428f-8f57-a06a0fdc107e
+known_false_positives: No false positives have been identified.
+name: Samsam Test File Write
+references: []
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_name)
   as file_name from datamodel=Endpoint.Filesystem where Filesystem.file_path=*\\windows\\system32\\test.txt
   by Filesystem.file_path | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)`
   | `security_content_ctime(firstTime)` | `samsam_test_file_write_filter`'
-how_to_implement: You must be ingesting data that records the file-system activity
-  from your hosts to populate the Endpoint file-system data-model node. If you are
-  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
-  you want to collect data.
-known_false_positives: No false positives have been identified.
-references: []
 tags:
   analytic_story:
   - SamSam Ransomware
@@ -43,24 +41,26 @@ tags:
   - DE.CM
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.user
   - _time
-  - Filesystem.user
-  - Filesystem.dest
-  - Filesystem.file_name
-  - Filesystem.file_path
   risk_score: 12
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml
index daec04b402..556ab3129f 100644
--- a/detections/endpoint/sc_exe_manipulating_windows_services.yml
+++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml
@@ -1,26 +1,24 @@
-name: Sc exe Manipulating Windows Services
-id: f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d
-version: 4
-date: '2020-07-21'
 author: Rico Valdez, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-07-21'
 description: This search looks for arguments to sc.exe indicating the creation or
   modification of a Windows service.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d
+known_false_positives: Using sc.exe to manipulate Windows services is uncommon. However,
+  there may be legitimate instances of this behavior. It is important to validate
+  and investigate as appropriate.
+name: Sc exe Manipulating Windows Services
+references: []
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where Processes.process_name = sc.exe (Processes.process="* create *" OR Processes.process="*
   config *") by Processes.process_name Processes.parent_process_name Processes.dest
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `sc_exe_manipulating_windows_services_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Using sc.exe to manipulate Windows services is uncommon. However,
-  there may be legitimate instances of this behavior. It is important to validate
-  and investigate as appropriate.
-references: []
 tags:
   analytic_story:
   - Windows Service Abuse
@@ -58,25 +56,27 @@ tags:
   - DE.CM
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.user
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 4
diff --git a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml
index d627f66d3c..0c6b82af9f 100644
--- a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml
+++ b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml
@@ -1,11 +1,6 @@
-name: SchCache Change By App Connect And Create ADSI Object
-id: 991eb510-0fc6-11ec-82d3-acde48001122
-version: 1
-date: '2021-09-07'
 author: Teoderick Contreras, Splunk
-type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-09-07'
 description: This analytic is to detect an application try to connect and create ADSI
   Object to do LDAP query. Every time an application connects to the directory and
   attempts to create an ADSI object, the Active Directory Schema is checked for changes.
@@ -15,20 +10,22 @@ description: This analytic is to detect an application try to connect and create
   application like blackmatter ransomware that use ADS object api to execute ldap
   query. having a good list of ldap or normal AD query tool used within the network
   is a good start to reduce the noise.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 991eb510-0fc6-11ec-82d3-acde48001122
+known_false_positives: normal application like mmc.exe and other ldap query tool may
+  trigger this detections.
+name: SchCache Change By App Connect And Create ADSI Object
+references:
+- https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac
+- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
 search: '`sysmon` EventCode=11  TargetFilename = "*\\Windows\\SchCache\\*" TargetFilename
   = "*.sch*" NOT (Image IN ("*\\Windows\\system32\\mmc.exe")) |stats count min(_time)
   as firstTime max(_time) as lastTime by Image TargetFilename EventCode process_id  process_name
   Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `schcache_change_by_app_connect_and_create_adsi_object_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: normal application like mmc.exe and other ldap query tool may
-  trigger this detections.
-references:
-- https://docs.microsoft.com/en-us/windows/win32/adsi/adsi-and-uac
-- https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/
 tags:
   analytic_story:
   - blackMatter ransomware
@@ -48,9 +45,9 @@ tags:
   - T1087
   observable:
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -65,3 +62,5 @@ tags:
   - Computer
   risk_score: 25
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/schedule_task_with_http_command_arguments.yml b/detections/endpoint/schedule_task_with_http_command_arguments.yml
index 955ca654b2..5883380127 100644
--- a/detections/endpoint/schedule_task_with_http_command_arguments.yml
+++ b/detections/endpoint/schedule_task_with_http_command_arguments.yml
@@ -1,11 +1,6 @@
-name: Schedule Task with HTTP Command Arguments
-id: 523c2684-a101-11eb-916b-acde48001122
-version: 1
-date: '2021-04-19'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-04-19'
 description: The following query utilizes Windows Security EventCode 4698, `A scheduled
   task was created`, to identify suspicious tasks registered on Windows either via
   schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry
@@ -20,16 +15,18 @@ description: The following query utilizes Windows Security EventCode 4698, `A sc
   Review the job created and the Command to be executed. Capture any artifacts on
   disk and review. Identify any parallel processes within the same timeframe to identify
   source.'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and
+  filter known instances of Task schedule used in your environment.
+id: 523c2684-a101-11eb-916b-acde48001122
+known_false_positives: unknown
+name: Schedule Task with HTTP Command Arguments
+references:
+- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/
 search: '`wineventlog_security` EventCode=4698 | xmlkv Message| search Arguments IN
   ("*http*") | stats count min(_time) as firstTime max(_time) as lastTime by dest,
   Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `schedule_task_with_http_command_arguments_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and
-  filter known instances of Task schedule used in your environment.
-known_false_positives: unknown
-references:
-- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/
 tags:
   analytic_story:
   - Windows Persistence Techniques
@@ -51,13 +48,13 @@ tags:
   - T1053
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: Arguments
-    type: Arguments
     role:
     - Attacker
+    type: Arguments
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -73,3 +70,5 @@ tags:
   - Arguments
   risk_score: 63
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml
index 9e00f1bc79..ad425e3f0e 100644
--- a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml
+++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml
@@ -1,11 +1,6 @@
-name: Schedule Task with Rundll32 Command Trigger
-id: 75b00fd8-a0ff-11eb-8b31-acde48001122
-version: 1
-date: '2021-04-19'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-04-19'
 description: The following query utilizes Windows Security EventCode 4698, `A scheduled
   task was created`, to identify suspicious tasks registered on Windows either via
   schtasks.exe OR TaskService with a command to be executed with a Rundll32. This
@@ -20,17 +15,19 @@ description: The following query utilizes Windows Security EventCode 4698, `A sc
   Review the job created and the Command to be executed. Capture any artifacts on
   disk and review. Identify any parallel processes within the same timeframe to identify
   source.'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and
+  filter known instances of Task schedule used in your environment.
+id: 75b00fd8-a0ff-11eb-8b31-acde48001122
+known_false_positives: unknown
+name: Schedule Task with Rundll32 Command Trigger
+references:
+- https://labs.vipre.com/trickbot-and-its-modules/
+- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
 search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN
   ("*rundll32*") | stats count min(_time) as firstTime max(_time) as lastTime by dest,
   Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `schedule_task_with_rundll32_command_trigger_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and
-  filter known instances of Task schedule used in your environment.
-known_false_positives: unknown
-references:
-- https://labs.vipre.com/trickbot-and-its-modules/
-- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
 tags:
   analytic_story:
   - Windows Persistence Techniques
@@ -52,13 +49,13 @@ tags:
   - T1053
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: Arguments
-    type: Arguments
     role:
     - Attacker
+    type: Arguments
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -74,3 +71,5 @@ tags:
   - Arguments
   risk_score: 70
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
index 1a20a684f4..594bf25c63 100644
--- a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
+++ b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml
@@ -1,11 +1,7 @@
-name: Scheduled Task Creation on Remote Endpoint using At
-id: 4be54858-432f-11ec-8209-3e22fbd008af
-version: 1
-date: '2021-11-11'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-11'
 description: This analytic looks for the execution of `at.exe` with command-line arguments
   utilized to create a Scheduled Task on a remote endpoint. Red Teams and adversaries
   alike may abuse the Task Scheduler for lateral movement and remote code execution.
@@ -13,20 +9,22 @@ description: This analytic looks for the execution of `at.exe` with command-line
   with Windows 8 and Windows Server 2012 but may still work on previous versions of
   Windows. Furthermore, attackers may enable this protocol on demand by changing a
   sytem registry key.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+id: 4be54858-432f-11ec-8209-3e22fbd008af
+known_false_positives: Administrators may create scheduled tasks on remote systems,
+  but this activity is usually limited to a small set of hosts or users.
+name: Scheduled Task Creation on Remote Endpoint using At
+references:
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/at
+- https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob?redirectedfrom=MSDN
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=at.exe
   OR Processes.original_file_name=at.exe) (Processes.process=*\\\\*) by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_creation_on_remote_endpoint_using_at_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
-known_false_positives: Administrators may create scheduled tasks on remote systems,
-  but this activity is usually limited to a small set of hosts or users.
-references:
-- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/at
-- https://docs.microsoft.com/en-us/windows/win32/cimwin32prov/win32-scheduledjob?redirectedfrom=MSDN
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -46,27 +44,26 @@ tags:
   - T1053.002
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
index 72b31f9060..4156492745 100644
--- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
+++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
@@ -1,30 +1,28 @@
-name: Scheduled Task Deleted Or Created via CMD
-id: d5af132c-7c17-439c-9d31-13d55340f36c
-version: 6
-date: '2022-02-22'
 author: Bhavin Patel, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-02-22'
 description: The following analytic identifies the creation or deletion of a scheduled
   task using schtasks.exe with flags - create or delete being passed on the command-line.
   This has been associated with the Dragonfly threat actor, and the SUNBURST attack
   against Solarwinds. This analytic replaces "Scheduled Task used in BadRabbit Ransomware".
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: d5af132c-7c17-439c-9d31-13d55340f36c
+known_false_positives: It is possible scripts or administrators may trigger this analytic.
+  Filter as needed based on parent process, application.
+name: Scheduled Task Deleted Or Created via CMD
+references:
+- https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
   (Processes.process=*delete* OR Processes.process=*create*) by Processes.user Processes.process_name
   Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_deleted_or_created_via_cmd_filter` '
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: It is possible scripts or administrators may trigger this analytic.
-  Filter as needed based on parent process, application.
-references:
-- https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
 tags:
   analytic_story:
   - DHS Report TA18-074A
@@ -54,26 +52,28 @@ tags:
   - PR.IP
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.dest
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 6
diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml
index 8860f35c80..4056cbe813 100644
--- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml
+++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml
@@ -1,29 +1,27 @@
-name: Scheduled Task Initiation on Remote Endpoint
-id: 95cf4608-4302-11ec-8194-3e22fbd008af
-version: 1
-date: '2021-11-11'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-11'
 description: This analytic looks for the execution of `schtasks.exe` with command-line
   arguments utilized to start a Scheduled Task on a remote endpoint. Red Teams and
   adversaries alike may abuse the Task Scheduler for lateral movement and remote code
   execution.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+id: 95cf4608-4302-11ec-8194-3e22fbd008af
+known_false_positives: Administrators may start scheduled tasks on remote systems,
+  but this activity is usually limited to a small set of hosts or users.
+name: Scheduled Task Initiation on Remote Endpoint
+references:
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks
+- https://attack.mitre.org/techniques/T1053/005/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=schtasks.exe
   OR Processes.original_file_name=schtasks.exe) (Processes.process=*/s* AND Processes.process=*/run*)
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_initiation_on_remote_endpoint_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
-known_false_positives: Administrators may start scheduled tasks on remote systems,
-  but this activity is usually limited to a small set of hosts or users.
-references:
-- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks
-- https://attack.mitre.org/techniques/T1053/005/
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -43,27 +41,26 @@ tags:
   - T1053.005
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml
index 263758ac10..47939a604e 100644
--- a/detections/endpoint/schtasks_run_task_on_demand.yml
+++ b/detections/endpoint/schtasks_run_task_on_demand.yml
@@ -1,29 +1,27 @@
-name: Schtasks Run Task On Demand
-id: bb37061e-af1f-11eb-a159-acde48001122
-version: 1
-date: '2021-05-07'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-05-07'
 description: This analytic identifies an on demand run of a Windows Schedule Task
   through shell or command-line. This technique has been used by adversaries that
   force to run their created Schedule Task as their persistence mechanism or for lateral
   movement as part of their malicious attack to the compromised machine.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed schtasks.exe may be used.
+id: bb37061e-af1f-11eb-a159-acde48001122
+known_false_positives: Administrators may use to debug Schedule Task entries. Filter
+  as needed.
+name: Schtasks Run Task On Demand
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
   as lastTime  from datamodel=Endpoint.Processes where Processes.process_name = "schtasks.exe"
   Processes.process = "*/run*" by Processes.process_name Processes.parent_process_name
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `schtasks_run_task_on_demand_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances where renamed schtasks.exe may be used.
-known_false_positives: Administrators may use to debug Schedule Task entries. Filter
-  as needed.
-references:
-- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
 tags:
   analytic_story:
   - XMRig
@@ -45,26 +43,28 @@ tags:
   - T1053
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.process_id
-  - Processes.process_name
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.user
   risk_score: 48
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
index a7d455035f..21a72ebc5b 100644
--- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
+++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml
@@ -1,30 +1,28 @@
-name: Schtasks scheduling job on remote system
-id: 1297fb80-f42a-4b4a-9c8a-88c066237cf6
-version: 5
-date: '2021-11-11'
 author: David Dorsey, Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-11'
 description: This analytic looks for the execution of `schtasks.exe` with command-line
   arguments utilized to create a Scheduled Task on a remote endpoint. Red Teams and
   adversaries alike may abuse the Task Scheduler for lateral movement and remote code
   execution.
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+id: 1297fb80-f42a-4b4a-9c8a-88c066237cf6
+known_false_positives: Administrators may create scheduled tasks on remote systems,
+  but this activity is usually limited to a small set of hosts or users. It is important
+  to validate and investigate as appropriate.
+name: Schtasks scheduling job on remote system
+references: []
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = schtasks.exe
   OR Processes.original_file_name=schtasks.exe) (Processes.process="*/create*" AND
   Processes.process="*/s*") by Processes.process_name Processes.process Processes.parent_process_name
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `schtasks_scheduling_job_on_remote_system_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
-known_false_positives: Administrators may create scheduled tasks on remote systems,
-  but this activity is usually limited to a small set of hosts or users. It is important
-  to validate and investigate as appropriate.
-references: []
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -53,25 +51,28 @@ tags:
   - PR.IP
   observable:
   - name: Processes.dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: Processes.user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.user
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 5
diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
index 053b428c8e..4bce8d5155 100644
--- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
+++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml
@@ -1,27 +1,25 @@
-name: Schtasks used for forcing a reboot
-id: 1297fb80-f42a-4b4a-9c8a-88c066437cf6
-version: 4
-date: '2020-12-07'
 author: Bhavin Patel, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-12-07'
 description: This search looks for flags passed to schtasks.exe on the command-line
   that indicate that a forced reboot of system is scheduled.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 1297fb80-f42a-4b4a-9c8a-88c066437cf6
+known_false_positives: Administrators may create jobs on systems forcing reboots to
+  perform updates, maintenance, etc.
+name: Schtasks used for forcing a reboot
+references: []
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where Processes.process_name=schtasks.exe Processes.process="*shutdown*" Processes.process="*/create
   *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `schtasks_used_for_forcing_a_reboot_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Administrators may create jobs on systems forcing reboots to
-  perform updates, maintenance, etc.
-references: []
 tags:
   analytic_story:
   - Windows Persistence Techniques
@@ -50,25 +48,27 @@ tags:
   - PR.IP
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.process_name
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.user
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 4
diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml
index 003016f8c8..11a3375aba 100644
--- a/detections/endpoint/screensaver_event_trigger_execution.yml
+++ b/detections/endpoint/screensaver_event_trigger_execution.yml
@@ -1,32 +1,30 @@
-name: Screensaver Event Trigger Execution
-id: 58cea3ec-1f6d-11ec-8560-acde48001122
-version: 1
-date: '2021-09-27'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Registry
+date: '2021-09-27'
 description: This analytic is developed to detect possible event trigger execution
   through screensaver registry entry modification for persistence or privilege escalation.
   This technique was seen in several APT and malware where they put the malicious
   payload path to the SCRNSAVE.EXE registry key to redirect the execution to their
   malicious payload path. This TTP is a good indicator that some attacker may modify
   this entry for their persistence and privilege escalation.
-search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
-  max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control
-  Panel\\Desktop\\SCRNSAVE.EXE*") by Registry.dest Registry.user Registry.registry_path
-  Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)`
-  | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `screensaver_event_trigger_execution_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response
   product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
   used for this search is typically generated via logs that report reads and writes
   to the registry.
+id: 58cea3ec-1f6d-11ec-8560-acde48001122
 known_false_positives: unknown
+name: Screensaver Event Trigger Execution
 references:
 - https://attack.mitre.org/techniques/T1546/002/
 - https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/screensaver
+search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where (Registry.registry_path="*\\Control
+  Panel\\Desktop\\SCRNSAVE.EXE*") by Registry.dest Registry.user Registry.registry_path
+  Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `screensaver_event_trigger_execution_filter`'
 tags:
   analytic_story:
   - Windows Persistence Techniques
@@ -47,25 +45,27 @@ tags:
   - T1546.002
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
   risk_score: 72
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml
index ac87865b4c..a5d8818f3c 100644
--- a/detections/endpoint/script_execution_via_wmi.yml
+++ b/detections/endpoint/script_execution_via_wmi.yml
@@ -1,25 +1,23 @@
-name: Script Execution via WMI
-id: aa73f80d-d728-4077-b226-81ea0c8be589
-version: 4
-date: '2020-03-16'
 author: Rico Valdez, Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-03-16'
 description: This search looks for scripts launched via WMI.
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints to populate the Endpoint
+  data model in the Processes node. The command-line arguments are mapped to the "process"
+  field in the Endpoint data model.
+id: aa73f80d-d728-4077-b226-81ea0c8be589
+known_false_positives: Although unlikely, administrators may use wmi to launch scripts
+  for legitimate purposes. Filter as needed.
+name: Script Execution via WMI
+references:
+- https://redcanary.com/blog/child-processes/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=scrcons.exe
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `script_execution_via_wmi_filter` '
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. The command-line arguments are mapped to the "process"
-  field in the Endpoint data model.
-known_false_positives: Although unlikely, administrators may use wmi to launch scripts
-  for legitimate purposes. Filter as needed.
-references:
-- https://redcanary.com/blog/child-processes/
 tags:
   analytic_story:
   - Suspicious WMI Use
@@ -47,23 +45,29 @@ tags:
   - PR.IP
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.user
-  - Processes.dest
   risk_score: 36
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 4
diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml
index cf395a7332..62c270a24f 100644
--- a/detections/endpoint/sdclt_uac_bypass.yml
+++ b/detections/endpoint/sdclt_uac_bypass.yml
@@ -1,15 +1,22 @@
-name: Sdclt UAC Bypass
-id: d71efbf6-da63-11eb-8c6e-acde48001122
-version: 2
-date: '2020-01-28'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2020-01-28'
 description: This search is to detect a suspicious sdclt.exe registry modification.
   This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe
   application by modifying some registry that sdclt.exe tries to open or query with
   payload file path on it to be executed.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: d71efbf6-da63-11eb-8c6e-acde48001122
+known_false_positives: Limited to no false positives are expected.
+name: Sdclt UAC Bypass
+references:
+- https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
+- https://github.com/hfiref0x/UACME
+- https://www.cyborgsecurity.com/cyborg_labs/threat-hunt-deep-dives-user-account-control-bypass-via-registry-modification/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\Windows\\CurrentVersion\\App
   Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*")
@@ -26,14 +33,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   _time dest user parent_process_name parent_process process_name process_path process
   proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `sdclt_uac_bypass_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Limited to no false positives are expected.
-references:
-- https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
-- https://github.com/hfiref0x/UACME
-- https://www.cyborgsecurity.com/cyborg_labs/threat-hunt-deep-dives-user-account-control-bypass-via-registry-modification/
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -56,20 +55,32 @@ tags:
   - T1548
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/sdelete_application_execution.yml b/detections/endpoint/sdelete_application_execution.yml
index 8b57213736..08509820cb 100644
--- a/detections/endpoint/sdelete_application_execution.yml
+++ b/detections/endpoint/sdelete_application_execution.yml
@@ -1,17 +1,23 @@
-name: Sdelete Application Execution
-id: 31702fc0-2682-11ec-85c3-acde48001122
-version: 1
-date: '2021-10-06'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-10-06'
 description: This analytic is to detect the execution of sdelete.exe application sysinternal
   tools. This tool is one of the most use tool of malware and adversaries to remove
   or clear their tracks and artifact in the targetted host. This tool is designed
   to delete securely a file in file system that remove the forensic evidence on the
   machine. A good TTP query to check why user execute this application which is not
   a common practice.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 31702fc0-2682-11ec-85c3-acde48001122
+known_false_positives: user may execute and use this application
+name: Sdelete Application Execution
+references:
+- https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.parent_process) as parent_process values(Processes.process_id)
   as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
@@ -19,14 +25,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.dest Processes.user Processes.parent_process_name Processes.parent_process
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `sdelete_application_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: user may execute and use this application
-references:
-- https://app.any.run/tasks/956f50be-2c13-465a-ac00-6224c14c5f89/
 tags:
   analytic_story:
   - Masquerading - Rename System Utilities
@@ -47,31 +45,30 @@ tags:
   - T1070
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
index 54f3073620..4f5d7b69ef 100644
--- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
+++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
@@ -1,11 +1,8 @@
-name: SearchProtocolHost with no Command Line with Network
-id: b690df8c-a145-11eb-a38b-acde48001122
-version: 2
-date: '2021-10-13'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Ports
+- Endpoint.Processes
+date: '2021-10-13'
 description: The following analytic identifies searchprotocolhost.exe with no command
   line arguments and with a network connection. It is unusual for searchprotocolhost.exe
   to execute with no command line arguments present. This particular behavior is common
@@ -13,6 +10,15 @@ description: The following analytic identifies searchprotocolhost.exe with no co
   any network connections and parallel processes. Identify any suspicious module loads
   related to credential dumping or file writes. searchprotocolhost.exe is natively
   found in C:\Windows\system32 and C:\Windows\syswow64.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node.
+id: b690df8c-a145-11eb-a38b-acde48001122
+known_false_positives: Limited false positives may be present in small environments.
+  Tuning may be required based on parent process.
+name: SearchProtocolHost with no Command Line with Network
+references:
+- https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where Processes.process_name=searchprotocolhost.exe by _time span=1h  Processes.process_guid
   Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
@@ -22,13 +28,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
   | rename  dest as connection_to_CNC] | table _time dest parent_process_name process_name
   process_path process process_guid connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node.
-known_false_positives: Limited false positives may be present in small environments.
-  Tuning may be required based on parent process.
-references:
-- https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc
 tags:
   analytic_story:
   - Cobalt Strike
@@ -49,23 +48,33 @@ tags:
   - T1055
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: processname
     role:
     - Attacker
+    type: processname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Ports.dest
+  - Endpoint.Ports.dest_port
+  - Endpoint.Ports.process_guid
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
   - _time
-  - process_name
-  - process_id
-  - parent_process_name
   - dest_port
+  - parent_process_name
+  - process_name
   - process_path
   risk_score: 70
   security_domain: endpoint
+type: TTP
+version: 2
diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml
index 9a46d7b579..207e0eeeee 100644
--- a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml
+++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml
@@ -1,15 +1,20 @@
-name: SecretDumps Offline NTDS Dumping Tool
-id: 5672819c-be09-11eb-bbfb-acde48001122
-version: 1
-date: '2021-05-26'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-05-26'
 description: This analytic detects a potential usage of secretsdump.py tool for dumping
   credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry
   hive. This technique was seen in some attacker that dump ntlm hashes offline after
   having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 5672819c-be09-11eb-bbfb-acde48001122
+known_false_positives: unknown
+name: SecretDumps Offline NTDS Dumping Tool
+references:
+- https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "python*.exe"
   Processes.process = "*.py*" Processes.process = "*-ntds*" (Processes.process = "*-system*"
@@ -18,13 +23,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `secretdumps_offline_ntds_dumping_tool_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: unknown
-references:
-- https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py
 tags:
   analytic_story:
   - Credential Dumping
@@ -45,28 +43,30 @@ tags:
   - T1003
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.dest
-  - Processes.user
-  - Processes.process_id
-  - Processes.process_guid
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
index 63098b3965..390a2312b5 100644
--- a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
+++ b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
@@ -1,10 +1,6 @@
-name: ServicePrincipalNames Discovery with PowerShell
-id: 13243068-2d38-11ec-8908-acde48001122
-version: 1
-date: '2021-10-14'
 author: Michael Haag, Splunk
-type: TTP
 datamodel: []
+date: '2021-10-14'
 description: 'The following analytic identifies `powershell.exe` usage, using Script
   Block Logging EventCode 4104, related to querying the domain for Service Principle
   Names. typically, this is a precursor activity related to kerberoasting or the silver
@@ -22,14 +18,12 @@ description: 'The following analytic identifies `powershell.exe` usage, using Sc
   class in PowerShell is the equivelant of using setspn.exe. \
 
   During triage, review parallel processes for further suspicious activity.'
-search: '`powershell` EventCode=4104 Message="*KerberosRequestorSecurityToken*" |
-  stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode ComputerName
-  User EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `serviceprincipalnames_discovery_with_powershell_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+id: 13243068-2d38-11ec-8908-acde48001122
 known_false_positives: False positives should be limited, however filter as needed.
+name: ServicePrincipalNames Discovery with PowerShell
 references:
 - https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names
 - https://docs.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8
@@ -45,6 +39,10 @@ references:
 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+search: '`powershell` EventCode=4104 Message="*KerberosRequestorSecurityToken*" |
+  stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode ComputerName
+  User EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `serviceprincipalnames_discovery_with_powershell_filter`'
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -65,37 +63,28 @@ tags:
   - T1558.003
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
index 8e3be8fa03..f651270705 100644
--- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
+++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml
@@ -1,11 +1,7 @@
-name: ServicePrincipalNames Discovery with SetSPN
-id: ae8b3efc-2d2e-11ec-8b57-acde48001122
-version: 1
-date: '2021-10-14'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-10-14'
 description: 'The following analytic identifies `setspn.exe` usage related to querying
   the domain for Service Principle Names. typically, this is a precursor activity
   related to kerberoasting or the silver ticket attack. \
@@ -29,20 +25,15 @@ description: 'The following analytic identifies `setspn.exe` usage related to qu
   existence of SPN \
 
   During triage, review parallel processes for further suspicious activity.'
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_setspn` (Processes.process="*-t*"
-  AND Processes.process="*-f*") OR (Processes.process="*-q*" AND Processes.process="**/**")
-  OR (Processes.process="*-q*") OR (Processes.process="*-s*") by Processes.dest Processes.user
-  Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `serviceprincipalnames_discovery_with_setspn_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: ae8b3efc-2d2e-11ec-8b57-acde48001122
 known_false_positives: False positives may be caused by Administrators resetting SPNs
   or querying for SPNs. Filter as needed.
+name: ServicePrincipalNames Discovery with SetSPN
 references:
 - https://docs.microsoft.com/en-us/windows/win32/ad/service-principal-names
 - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting
@@ -53,6 +44,13 @@ references:
 - https://blog.zsec.uk/paving-2-da-wholeset/
 - https://msitpros.com/?p=3113
 - https://adsecurity.org/?p=3466
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_setspn` (Processes.process="*-t*"
+  AND Processes.process="*-f*") OR (Processes.process="*-q*" AND Processes.process="**/**")
+  OR (Processes.process="*-q*") OR (Processes.process="*-s*") by Processes.dest Processes.user
+  Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `serviceprincipalnames_discovery_with_setspn_filter`'
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -74,39 +72,38 @@ tags:
   - T1558.003
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/services_escalate_exe.yml b/detections/endpoint/services_escalate_exe.yml
index f1f7aa5fe7..b15e975aa7 100644
--- a/detections/endpoint/services_escalate_exe.yml
+++ b/detections/endpoint/services_escalate_exe.yml
@@ -1,11 +1,7 @@
-name: Services Escalate Exe
-id: c448488c-b7ec-11eb-8253-acde48001122
-version: 1
-date: '2021-05-18'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-05-18'
 description: The following analytic identifies the use of `svc-exe` with Cobalt Strike.
   The behavior typically follows after an adversary has already gained initial access
   and is escalating privileges. Using `svc-exe`, a randomly named binary will be downloaded
@@ -18,20 +14,22 @@ description: The following analytic identifies the use of `svc-exe` with Cobalt
   and may be any process on disk (typically system32/syswow64 binary). The `spawnto_`
   process will also contain a network connection. During triage, review parallel procesess
   and identify any additional file modifications.
+how_to_implement: To successfully implement this search, you will need to ensure that
+  DNS data is populating the Network_Resolution data model.
+id: c448488c-b7ec-11eb-8253-acde48001122
+known_false_positives: False positives should be limited as `services.exe` should
+  never spawn a process from `ADMIN$`. Filter as needed.
+name: Services Escalate Exe
+references:
+- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
+- https://attack.mitre.org/techniques/T1548/
+- https://www.cobaltstrike.com/help-beacon
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe
   Processes.process_path=*admin$* by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `services_escalate_exe_filter`'
-how_to_implement: To successfully implement this search, you will need to ensure that
-  DNS data is populating the Network_Resolution data model.
-known_false_positives: False positives should be limited as `services.exe` should
-  never spawn a process from `ADMIN$`. Filter as needed.
-references:
-- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
-- https://attack.mitre.org/techniques/T1548/
-- https://www.cobaltstrike.com/help-beacon
 tags:
   analytic_story:
   - Cobalt Strike
@@ -53,27 +51,31 @@ tags:
   - T1548
   observable:
   - name: Processes.dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: Processes.user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 76
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml
index 7e4b21420b..0abf058fa6 100644
--- a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml
@@ -1,11 +1,7 @@
-name: Services LOLBAS Execution Process Spawn
-id: ba9e1954-4c04-11ec-8b74-3e22fbd008af
-version: 1
-date: '2021-11-22'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-22'
 description: The following analytic identifies `services.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing the Service Control
   Manager and creating a remote malicious service, the executed command is spawned
@@ -13,6 +9,17 @@ description: The following analytic identifies `services.exe` spawning a LOLBAS
   binaries that can be abused by threat actors to perform tasks like executing malicious
   code. Looking for child processes of services.exe that are part of the LOLBAS project
   can help defenders identify lateral movement activity.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+id: ba9e1954-4c04-11ec-8b74-3e22fbd008af
+known_false_positives: Legitimate applications may trigger this behavior, filter as
+  needed.
+name: Services LOLBAS Execution Process Spawn
+references:
+- https://attack.mitre.org/techniques/T1543/003/
+- https://pentestlab.blog/2020/07/21/lateral-movement-services/
+- https://lolbas-project.github.io/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=services.exe)
   (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe",
@@ -29,15 +36,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `services_lolbas_execution_process_spawn_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
-known_false_positives: Legitimate applications may trigger this behavior, filter as
-  needed.
-references:
-- https://attack.mitre.org/techniques/T1543/003/
-- https://pentestlab.blog/2020/07/21/lateral-movement-services/
-- https://lolbas-project.github.io/
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -57,27 +55,26 @@ tags:
   - T1543.003
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
index abb769c084..5b65bdbd0f 100644
--- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
+++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
@@ -1,28 +1,26 @@
-name: Set Default PowerShell Execution Policy To Unrestricted or Bypass
-id: c2590137-0b08-4985-9ec5-6ae23d92f63d
-version: 7
-date: '2022-02-18'
 author: Patrick Bareiss, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Registry
+date: '2022-02-18'
 description: Monitor for changes of the ExecutionPolicy in the registry to the values
   "unrestricted" or "bypass," which allows the execution of malicious scripts.
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Registry node. You must also be
+  ingesting logs with the fields registry_path, registry_key_name, and registry_value_name
+  from your endpoints.
+id: c2590137-0b08-4985-9ec5-6ae23d92f63d
+known_false_positives: Administrators may attempt to change the default execution
+  policy on a system for a variety of reasons. However, setting the policy to "unrestricted"
+  or "bypass" as this search is designed to identify, would be unusual. Hits should
+  be reviewed and investigated as appropriate.
+name: Set Default PowerShell Execution Policy To Unrestricted or Bypass
+references: []
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell*
   Registry.registry_value_name=ExecutionPolicy (Registry.registry_value_data=Unrestricted
   OR Registry.registry_value_data=Bypass) by Registry.registry_path Registry.registry_value_name
   Registry.registry_value_data Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Registry node. You must also be
-  ingesting logs with the fields registry_path, registry_key_name, and registry_value_name
-  from your endpoints.
-known_false_positives: Administrators may attempt to change the default execution
-  policy on a system for a variety of reasons. However, setting the policy to "unrestricted"
-  or "bypass" as this search is designed to identify, would be unusual. Hits should
-  be reviewed and investigated as appropriate.
-references: []
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -52,24 +50,26 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: registry_path
-    type: RegistryPath
     role:
     - Others
+    type: RegistryPath
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
   - _time
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
   risk_score: 48
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 7
diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml
index a29923fe90..1a2dc98ee4 100644
--- a/detections/endpoint/shim_database_file_creation.yml
+++ b/detections/endpoint/shim_database_file_creation.yml
@@ -1,28 +1,27 @@
-name: Shim Database File Creation
-id: 6e4c4588-ba2f-42fa-97e6-9f6f548eaa33
-version: 3
-date: '2020-12-08'
 author: David Dorsey, Splunk
-type: TTP
-datamodel: []
+datamodel:
+- Endpoint.Filesystem
+date: '2020-12-08'
 description: This search looks for shim database files being written to default directories.
   The sdbinst.exe application is used to install shim database files (.sdb). According
   to Microsoft, a shim is a small library that transparently intercepts an API, changes
   the parameters passed, handles the operation itself, or redirects the operation
   elsewhere.
+how_to_implement: You must be ingesting data that records the filesystem activity
+  from your hosts to populate the Endpoint file-system data model node. If you are
+  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
+  you want to collect data.
+id: 6e4c4588-ba2f-42fa-97e6-9f6f548eaa33
+known_false_positives: Because legitimate shim files are created and used all the
+  time, this event, in itself, is not suspicious. However, if there are other correlating
+  events, it may warrant further investigation.
+name: Shim Database File Creation
+references: []
 search: '| tstats `security_content_summariesonly` count values(Filesystem.action)
   values(Filesystem.file_hash) as file_hash values(Filesystem.file_path) as file_path  min(_time)
   as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*Windows\\AppPatch\\Custom*
   by Filesystem.file_name Filesystem.dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   |`drop_dm_object_name(Filesystem)` | `shim_database_file_creation_filter`'
-how_to_implement: You must be ingesting data that records the filesystem activity
-  from your hosts to populate the Endpoint file-system data model node. If you are
-  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
-  you want to collect data.
-known_false_positives: Because legitimate shim files are created and used all the
-  time, this event, in itself, is not suspicious. However, if there are other correlating
-  events, it may warrant further investigation.
-references: []
 tags:
   analytic_story:
   - Windows Persistence Techniques
@@ -48,22 +47,25 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: file_path
-    type: file path
     role:
     - Others
+    type: file path
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.action
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_hash
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
   - _time
-  - Filesystem.file_hash
-  - Filesystem.file_path
-  - Filesystem.file_name
-  - Filesystem.dest
   risk_score: 56
   security_domain: endpoint
+type: TTP
+version: 3
diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml
index d8ac0829e0..0050e9f342 100644
--- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml
+++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml
@@ -1,28 +1,26 @@
-name: Shim Database Installation With Suspicious Parameters
-id: 404620de-46d8-48b6-90cc-8a8d7b0876a3
-version: 4
-date: '2020-11-23'
 author: David Dorsey, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-11-23'
 description: This search detects the process execution and arguments required to silently
   create a shim database.  The sdbinst.exe application is used to install shim database
   files (.sdb). A shim is a small library which transparently intercepts an API, changes
   the parameters passed, handles the operation itself, or redirects the operation
   elsewhere.
-search: '| tstats `security_content_summariesonly` values(Processes.process) as process
-  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process_name = sdbinst.exe by Processes.process_name Processes.parent_process_name
-  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.
   The command-line arguments are mapped to the "process" field in the Endpoint data
   model.
+id: 404620de-46d8-48b6-90cc-8a8d7b0876a3
 known_false_positives: None identified
+name: Shim Database Installation With Suspicious Parameters
 references: []
+search: '| tstats `security_content_summariesonly` values(Processes.process) as process
+  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.process_name = sdbinst.exe by Processes.process_name Processes.parent_process_name
+  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter`'
 tags:
   analytic_story:
   - Windows Persistence Techniques
@@ -49,24 +47,27 @@ tags:
   - DE.CM
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.user
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 4
diff --git a/detections/endpoint/short_lived_scheduled_task.yml b/detections/endpoint/short_lived_scheduled_task.yml
index 260ed20cce..f3b81b2e7d 100644
--- a/detections/endpoint/short_lived_scheduled_task.yml
+++ b/detections/endpoint/short_lived_scheduled_task.yml
@@ -1,28 +1,26 @@
-name: Short Lived Scheduled Task
-id: 6fa31414-546e-11ec-adfa-acde48001122
-version: 1
-date: '2021-12-03'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel: []
+date: '2021-12-03'
 description: The following analytic leverages Windows Security EventCode 4698, `A
   scheduled task was created` and Windows Security EventCode 4699, `A scheduled task
   was deleted` to identify scheduled tasks created and deleted in less than 30 seconds.
   This behavior may represent a lateral movement attack abusing the Task Scheduler
   to obtain code execution. Red Teams and adversaries alike may abuse the Task Scheduler
   for lateral movement and remote code execution.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also
+  required.
+id: 6fa31414-546e-11ec-adfa-acde48001122
+known_false_positives: Although uncommon, legitimate applications may create and delete
+  a Scheduled Task within 30 seconds. Filter as needed.
+name: Short Lived Scheduled Task
+references:
+- https://attack.mitre.org/techniques/T1053/005/
+- https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler
 search: ' `wineventlog_security` EventCode=4698 OR EventCode=4699 | xmlkv Message
   | transaction Task_Name  startswith=(EventCode=4698) endswith=(EventCode=4699) |
   eval short_lived=case((duration<30),"TRUE") | search  short_lived = TRUE | table
   _time, ComputerName, Account_Name, Command, Task_Name, short_lived | `short_lived_scheduled_task_filter` '
-how_to_implement: To successfully implement this search, you need to be ingesting
-  Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also
-  required.
-known_false_positives: Although uncommon, legitimate applications may create and delete
-  a Scheduled Task within 30 seconds. Filter as needed.
-references:
-- https://attack.mitre.org/techniques/T1053/005/
-- https://docs.microsoft.com/en-us/windows/win32/taskschd/about-the-task-scheduler
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -44,24 +42,24 @@ tags:
   - T1053.005
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: Command
-    type: Command
     role:
     - Target
+    type: Command
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - dest
-  - ComputerName
   - Account_Name
-  - Task_Name
-  - Description
   - Command
+  - ComputerName
+  - Task_Name
+  - _time
   risk_score: 81
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml
index 839c7fb59b..b503c27ae5 100644
--- a/detections/endpoint/short_lived_windows_accounts.yml
+++ b/detections/endpoint/short_lived_windows_accounts.yml
@@ -1,13 +1,17 @@
-name: Short Lived Windows Accounts
-id: b25f6f62-0782-43c1-b403-083231ffd97d
-version: 2
-date: '2020-07-06'
 author: David Dorsey, Splunk
-type: TTP
 datamodel:
-- Change
+- Change.All_Changes
+date: '2020-07-06'
 description: This search detects accounts that were created and deleted in a short
   time period.
+how_to_implement: 'This search requires you to have enabled your Group Management
+  Audit Logs in your Local Windows Security Policy and be ingesting those logs.  More
+  information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/'
+id: b25f6f62-0782-43c1-b403-083231ffd97d
+known_false_positives: It is possible that an administrator created and deleted an
+  account in a short time period.  Verifying activity with an administrator is advised.
+name: Short Lived Windows Accounts
+references: []
 search: '| tstats `security_content_summariesonly` values(All_Changes.result_id) as
   result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change.All_Changes
   where All_Changes.result_id=4720 OR All_Changes.result_id=4726 by _time span=4h
@@ -15,12 +19,6 @@ search: '| tstats `security_content_summariesonly` values(All_Changes.result_id)
   | `drop_dm_object_name("All_Changes")` | search result_id = 4720 result_id=4726
   | transaction user connected=false maxspan=240m | table firstTime lastTime count
   user dest result_id | `short_lived_windows_accounts_filter`'
-how_to_implement: 'This search requires you to have enabled your Group Management
-  Audit Logs in your Local Windows Security Policy and be ingesting those logs.  More
-  information on how to enable them can be found here: http://whatevernetworks.com/auditing-group-membership-changes-in-active-directory/'
-known_false_positives: It is possible that an administrator created and deleted an
-  account in a short time period.  Verifying activity with an administrator is advised.
-references: []
 tags:
   analytic_story:
   - Account Monitoring and Controls
@@ -45,21 +43,23 @@ tags:
   - PR.IP
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Change.All_Changes.dest
+  - Change.All_Changes.result_id
+  - Change.All_Changes.user
   - _time
-  - All_Changes.result_id
-  - All_Changes.user
-  - All_Changes.dest
   risk_score: 63
   security_domain: access
+type: TTP
+version: 2
diff --git a/detections/endpoint/silentcleanup_uac_bypass.yml b/detections/endpoint/silentcleanup_uac_bypass.yml
index c1a9885737..1bbd637be0 100644
--- a/detections/endpoint/silentcleanup_uac_bypass.yml
+++ b/detections/endpoint/silentcleanup_uac_bypass.yml
@@ -1,15 +1,22 @@
-name: SilentCleanup UAC Bypass
-id: 56d7cfcc-da63-11eb-92d4-acde48001122
-version: 2
-date: '2020-01-28'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2020-01-28'
 description: This search is to detect a suspicious modification of registry that may
   related to UAC bypassed. This registry will be trigger once the attacker abuse the
   silentcleanup task schedule to gain high privilege execution that will bypass User
   control account.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: 56d7cfcc-da63-11eb-92d4-acde48001122
+known_false_positives: unknown
+name: SilentCleanup UAC Bypass
+references:
+- https://github.com/hfiref0x/UACME
+- https://www.intezer.com/blog/malware-analysis/klingon-rat-holding-on-for-dear-life/
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path= "*\\Environment\\windir" Registry.registry_value_data
   = "*.exe*" by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
@@ -24,14 +31,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   _time dest user parent_process_name parent_process process_name process_path process
   proc_guid registry_path registry_value_name registry_value_data registry_key_name
   | `silentcleanup_uac_bypass_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: unknown
-references:
-- https://github.com/hfiref0x/UACME
-- https://www.intezer.com/blog/malware-analysis/klingon-rat-holding-on-for-dear-life/
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -54,20 +53,32 @@ tags:
   - T1548
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml
index 2d4277a1f6..2798bda888 100644
--- a/detections/endpoint/single_letter_process_on_endpoint.yml
+++ b/detections/endpoint/single_letter_process_on_endpoint.yml
@@ -1,12 +1,18 @@
-name: Single Letter Process On Endpoint
-id: a4214f0b-e01c-41bc-8cc4-d2b71e3056b4
-version: 3
-date: '2020-12-08'
 author: David Dorsey, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-12-08'
 description: This search looks for process names that consist only of a single letter.
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+id: a4214f0b-e01c-41bc-8cc4-d2b71e3056b4
+known_false_positives: Single-letter executables are not always malicious. Investigate
+  this activity with your normal incident-response process.
+name: Single Letter Process On Endpoint
+references: []
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes by Processes.dest, Processes.user,
   Processes.process, Processes.process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(lastTime)`
@@ -14,14 +20,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   endExe = if(substr(process_name, -4) == ".exe", 1, 0) | search process_name_length=5
   AND endExe=1 | table count, firstTime, lastTime, dest, user, process, process_name
   | `single_letter_process_on_endpoint_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
-known_false_positives: Single-letter executables are not always malicious. Investigate
-  this activity with your normal incident-response process.
-references: []
 tags:
   analytic_story:
   - DHS Report TA18-074A
@@ -47,24 +45,26 @@ tags:
   - PR.DS
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.process
-  - Processes.process_name
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 3
diff --git a/detections/endpoint/slui_runas_elevated.yml b/detections/endpoint/slui_runas_elevated.yml
index fce44aa6e2..731ed49393 100644
--- a/detections/endpoint/slui_runas_elevated.yml
+++ b/detections/endpoint/slui_runas_elevated.yml
@@ -1,34 +1,32 @@
-name: SLUI RunAs Elevated
-id: 8d124810-b3e4-11eb-96c7-acde48001122
-version: 1
-date: '2021-05-13'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-05-13'
 description: The following analytic identifies the Microsoft Software Licensing User
   Interface Tool, `slui.exe`, elevating access using the `-verb runas` function. This
   particular bypass utilizes a registry key/value. Identified by two sources, the
   registry keys are `HKCU\Software\Classes\exefile\shell` and `HKCU\Software\Classes\launcher.Systemsettings\Shell\open\command`.
   To simulate this behavior, multiple POC are available. The analytic identifies the
   use of `runas` by `slui.exe`.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=slui.exe
-  (Processes.process=*-verb* Processes.process=*runas*) by Processes.dest Processes.user
-  Processes.parent_process Processes.process_name Processes.process Processes.process_id
-  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `slui_runas_elevated_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 8d124810-b3e4-11eb-96c7-acde48001122
 known_false_positives: Limited false positives should be present as this is not commonly
   used by legitimate applications.
+name: SLUI RunAs Elevated
 references:
 - https://www.exploit-db.com/exploits/46998
 - https://medium.com/@mattharr0ey/privilege-escalation-uac-bypass-in-changepk-c40b92818d1b
 - https://gist.github.com/r00t-3xp10it/0c92cd554d3156fd74f6c25660ccc466
 - https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/
 - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=slui.exe
+  (Processes.process=*-verb* Processes.process=*runas*) by Processes.dest Processes.user
+  Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `slui_runas_elevated_filter`'
 tags:
   analytic_story:
   - DarkSide Ransomware
@@ -50,27 +48,29 @@ tags:
   - T1548
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: user
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/slui_spawning_a_process.yml b/detections/endpoint/slui_spawning_a_process.yml
index 0fa2eac2c0..10a108ff9d 100644
--- a/detections/endpoint/slui_spawning_a_process.yml
+++ b/detections/endpoint/slui_spawning_a_process.yml
@@ -1,11 +1,7 @@
-name: SLUI Spawning a Process
-id: 879c4330-b3e0-11eb-b1b1-acde48001122
-version: 1
-date: '2021-05-13'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-05-13'
 description: The following analytic identifies the Microsoft Software Licensing User
   Interface Tool, `slui.exe`, spawning a child process. This behavior is associated
   with publicly known UAC bypass. `slui.exe` is commonly associated with software
@@ -13,20 +9,22 @@ description: The following analytic identifies the Microsoft Software Licensing
   not have child processes, and any processes spawning from it will be running with
   elevated privileges. During triage, review the child process and additional parallel
   processes. Identify any file modifications that may have lead to the bypass.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 879c4330-b3e0-11eb-b1b1-acde48001122
+known_false_positives: Certain applications may spawn from `slui.exe` that are legitimate.
+  Filtering will be needed to ensure proper monitoring.
+name: SLUI Spawning a Process
+references:
+- https://www.exploit-db.com/exploits/46998
+- https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/
+- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=slui.exe
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `slui_spawning_a_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Certain applications may spawn from `slui.exe` that are legitimate.
-  Filtering will be needed to ensure proper monitoring.
-references:
-- https://www.exploit-db.com/exploits/46998
-- https://www.rapid7.com/db/modules/exploit/windows/local/bypassuac_sluihijack/
-- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
 tags:
   analytic_story:
   - DarkSide Ransomware
@@ -48,27 +46,30 @@ tags:
   - T1548
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml
index 8f7e3d5acc..95307a578a 100644
--- a/detections/endpoint/spoolsv_spawning_rundll32.yml
+++ b/detections/endpoint/spoolsv_spawning_rundll32.yml
@@ -1,34 +1,32 @@
-name: Spoolsv Spawning Rundll32
-id: 15d905f6-da6b-11eb-ab82-acde48001122
-version: 2
-date: '2021-07-01'
 author: Mauricio Velazco, Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-07-01'
 description: The following analytic identifies a suspicious child process, `rundll32.exe`,
   with no command-line arguments being spawned from `spoolsv.exe`. This was identified
   during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare.
   Typically, this is not normal behavior for `spoolsv.exe` to spawn a process. During
   triage, isolate the endpoint and review for source of exploitation. Capture any
   additional file modification events.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 15d905f6-da6b-11eb-ab82-acde48001122
+known_false_positives: Limited false positives have been identified. There are limited
+  instances where `rundll32.exe` may be spawned by a legitimate print driver.
+name: Spoolsv Spawning Rundll32
+references:
+- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
+- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
+- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=spoolsv.exe
   `process_rundll32` by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `spoolsv_spawning_rundll32_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives have been identified. There are limited
-  instances where `rundll32.exe` may be spawned by a legitimate print driver.
-references:
-- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
-- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
-- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
 tags:
   analytic_story:
   - PrintNightmare CVE-2021-34527
@@ -53,36 +51,36 @@ tags:
   - T1547
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: parent_process_id
-    type: Process
     role:
     - Parent Process
     - Attacker
-  - name: process_id
     type: Process
+  - name: process_id
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 72
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml
index 216dd6aa45..e14f11daaf 100644
--- a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml
+++ b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml
@@ -1,25 +1,22 @@
-name: Spoolsv Suspicious Loaded Modules
-id: a5e451f8-da81-11eb-b245-acde48001122
-version: 1
-date: '2021-07-01'
 author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-07-01'
 description: This search is to detect suspicious loading of dll in specific path relative
   to printnightmare exploitation. In this search we try to detect the loaded modules
   made by spoolsv.exe after the exploitation.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and imageloaded executions from your endpoints. If you
+  are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+id: a5e451f8-da81-11eb-b245-acde48001122
+known_false_positives: unknown
+name: Spoolsv Suspicious Loaded Modules
+references:
+- https://raw.githubusercontent.com/hieuttmmo/sigma/dceb13fe3f1821b119ae495b41e24438bd97e3d0/rules/windows/image_load/sysmon_cve_2021_1675_print_nightmare.yml
 search: '`sysmon` EventCode=7 Image ="*\\spoolsv.exe" ImageLoaded="*\\Windows\\System32\\spool\\drivers\\x64\\*"
   ImageLoaded = "*.dll" | stats dc(ImageLoaded) as countImgloaded values(ImageLoaded)
   as ImgLoaded count min(_time) as firstTime max(_time) as lastTime by Image Computer
   process_id EventCode | where countImgloaded >= 3 | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `spoolsv_suspicious_loaded_modules_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name and imageloaded executions from your endpoints. If you
-  are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: unknown
-references:
-- https://raw.githubusercontent.com/hieuttmmo/sigma/dceb13fe3f1821b119ae495b41e24438bd97e3d0/rules/windows/image_load/sysmon_cve_2021_1675_print_nightmare.yml
 tags:
   analytic_story:
   - PrintNightmare CVE-2021-34527
@@ -44,18 +41,18 @@ tags:
   - T1547
   observable:
   - name: Computer
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: process_id
-    type: Process Name
     role:
     - Parent Process
     - Attacker
+    type: Process Name
   - name: ImageLoaded
-    type: File
     role:
     - Other
+    type: File
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -68,3 +65,5 @@ tags:
   - ImageLoaded
   risk_score: 72
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml
index ba666c3153..ec41cdd329 100644
--- a/detections/endpoint/spoolsv_suspicious_process_access.yml
+++ b/detections/endpoint/spoolsv_suspicious_process_access.yml
@@ -1,31 +1,28 @@
-name: Spoolsv Suspicious Process Access
-id: 799b606e-da81-11eb-93f8-acde48001122
-version: 1
-date: '2021-07-01'
 author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-07-01'
 description: This analytic identifies a suspicious behavior related to PrintNightmare,
   or CVE-2021-34527 previously (CVE-2021-1675),  to gain privilege escalation on the
   vulnerable machine. This exploit attacks a critical Windows Print Spooler Vulnerability
   to elevate privilege. This detection is to look for suspicious process access made
   by the spoolsv.exe that may related to the attack.
-search: '`sysmon` EventCode=10 SourceImage = "*\\spoolsv.exe" CallTrace = "*\\Windows\\system32\\spool\\DRIVERS\\x64\\*"
-  TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess = 0x1fffff |
-  stats  count min(_time) as firstTime max(_time) as lastTime by Computer SourceImage
-  TargetImage GrantedAccess CallTrace  EventCode ProcessID| `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `spoolsv_suspicious_process_access_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with process access event where SourceImage, TargetImage, GrantedAccess and
   CallTrace executions from your endpoints. If you are using Sysmon, you must have
   at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of spoolsv.exe.
+id: 799b606e-da81-11eb-93f8-acde48001122
 known_false_positives: Unknown. Filter as needed.
+name: Spoolsv Suspicious Process Access
 references:
 - https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818
 - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
 - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
 - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
+search: '`sysmon` EventCode=10 SourceImage = "*\\spoolsv.exe" CallTrace = "*\\Windows\\system32\\spool\\DRIVERS\\x64\\*"
+  TargetImage IN ("*\\rundll32.exe", "*\\spoolsv.exe") GrantedAccess = 0x1fffff |
+  stats  count min(_time) as firstTime max(_time) as lastTime by Computer SourceImage
+  TargetImage GrantedAccess CallTrace  EventCode ProcessID| `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `spoolsv_suspicious_process_access_filter`'
 tags:
   analytic_story:
   - PrintNightmare CVE-2021-34527
@@ -49,17 +46,17 @@ tags:
   - T1068
   observable:
   - name: Computer
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: ProcessID
-    type: Process
     role:
     - Parent Process
+    type: Process
   - name: TargetImage
-    type: Process Name
     role:
     - Target
+    type: Process Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -73,3 +70,5 @@ tags:
   - EventCode
   risk_score: 72
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml
index f296a79eee..b50e6c05cb 100644
--- a/detections/endpoint/spoolsv_writing_a_dll.yml
+++ b/detections/endpoint/spoolsv_writing_a_dll.yml
@@ -1,17 +1,25 @@
-name: Spoolsv Writing a DLL
-id: d5bf5cf2-da71-11eb-92c2-acde48001122
-version: 1
-date: '2021-07-01'
 author: Mauricio Velazco, Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+- Endpoint.Processes
+date: '2021-07-01'
 description: The following analytic identifies a `.dll` being written by `spoolsv.exe`.
   This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675)
   or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write
   a `.dll`. Current POC code used will write the suspicious DLL to disk within a path
   of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source
   of exploitation. Capture any additional file modification events.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem`
+  node.
+id: d5bf5cf2-da71-11eb-92c2-acde48001122
+known_false_positives: Unknown.
+name: Spoolsv Writing a DLL
+references:
+- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
+- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
+- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where Processes.process_name=spoolsv.exe by _time Processes.process_id Processes.process_name
   Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
@@ -22,15 +30,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   fields _time dest file_create_time file_name file_path process_name process_path
   process] | dedup file_create_time | table dest file_create_time, file_name, file_path,
   process_name | `spoolsv_writing_a_dll_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem`
-  node.
-known_false_positives: Unknown.
-references:
-- https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
-- https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
-- https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
 tags:
   analytic_story:
   - PrintNightmare CVE-2021-34527
@@ -54,32 +53,33 @@ tags:
   - T1547
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: process_id
-    type: Process
     role:
     - Process
+    type: Process
   - name: file_path
-    type: File
     role:
     - Other
+    type: File
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
   - _time
-  - Filesystem.dest
-  - Filesystem.file_create_time
-  - Filesystem.file_name
-  - Filesystem.file_path
-  - Processes.process_name
-  - Processes.process_id
-  - Processes.process_name
-  - Processes.dest
   risk_score: 72
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml
index 51bddc63a6..23766f5e50 100644
--- a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml
+++ b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml
@@ -1,31 +1,28 @@
-name: Spoolsv Writing a DLL - Sysmon
-id: 347fd388-da87-11eb-836d-acde48001122
-version: 1
-date: '2021-07-01'
 author: Mauricio Velazco, Michael Haag, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-07-01'
 description: The following analytic identifies a `.dll` being written by `spoolsv.exe`.
   This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675)
   or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write
   a `.dll`. Current POC code used will write the suspicious DLL to disk within a path
   of `\spool\drivers\x64\`. During triage, isolate the endpoint and review for source
   of exploitation. Capture any additional file modification events.
-search: '`sysmon` EventID=11 process_name=spoolsv.exe file_path="*\\spool\\drivers\\x64\\*"
-  file_name=*.dll | stats count min(_time) as firstTime max(_time) as lastTime by
-  dest, UserID, process_name, file_path, file_name, TargetFilename, process_id | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `spoolsv_writing_a_dll___sysmon_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+id: 347fd388-da87-11eb-836d-acde48001122
 known_false_positives: Limited false positives. Filter as needed.
+name: Spoolsv Writing a DLL - Sysmon
 references:
 - https://github.com/cube0x0/impacket/commit/73b9466c17761384ece11e1028ec6689abad6818
 - https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/
 - https://blog.truesec.com/2021/06/30/exploitable-critical-rce-vulnerability-allows-regular-users-to-fully-compromise-active-directory-printnightmare-cve-2021-1675/
 - https://www.reddit.com/r/msp/comments/ob6y02/critical_vulnerability_printnightmare_exposes
+search: '`sysmon` EventID=11 process_name=spoolsv.exe file_path="*\\spool\\drivers\\x64\\*"
+  file_name=*.dll | stats count min(_time) as firstTime max(_time) as lastTime by
+  dest, UserID, process_name, file_path, file_name, TargetFilename, process_id | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `spoolsv_writing_a_dll___sysmon_filter`'
 tags:
   analytic_story:
   - PrintNightmare CVE-2021-34527
@@ -50,17 +47,17 @@ tags:
   - T1547
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: process_id
-    type: Process
     role:
     - Process
+    type: Process
   - name: file_path
-    type: File
     role:
     - Other
+    type: File
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -75,3 +72,5 @@ tags:
   - TargetFilename
   risk_score: 72
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/sqlite_module_in_temp_folder.yml b/detections/endpoint/sqlite_module_in_temp_folder.yml
index 4bb923bf27..5a38685668 100644
--- a/detections/endpoint/sqlite_module_in_temp_folder.yml
+++ b/detections/endpoint/sqlite_module_in_temp_folder.yml
@@ -1,27 +1,24 @@
-name: Sqlite Module In Temp Folder
-id: 0f216a38-f45f-11eb-b09c-acde48001122
-version: 1
-date: '2021-08-03'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-08-03'
 description: This search is to detect a suspicious file creation of sqlite3.dll in
   %temp% folder. This behavior was seen in IcedID malware where it download sqlite
   module to parse browser database like for chrome or firefox to stole browser information
   related to bank, credit card or credentials.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 0f216a38-f45f-11eb-b09c-acde48001122
+known_false_positives: unknown
+name: Sqlite Module In Temp Folder
+references:
+- https://www.cisecurity.org/white-papers/security-primer-icedid/
 search: '`sysmon` EventCode=11 (TargetFilename = "*\\sqlite32.dll" OR TargetFilename
   = "*\\sqlite64.dll") (TargetFilename = "*\\temp\\*") |stats count min(_time) as
   firstTime max(_time) as lastTime by process_name TargetFilename EventCode ProcessId
   Image | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `sqlite_module_in_temp_folder_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: unknown
-references:
-- https://www.cisecurity.org/white-papers/security-primer-icedid/
 tags:
   analytic_story:
   - IcedID
@@ -40,13 +37,13 @@ tags:
   - T1005
   observable:
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: SourceImage
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -60,3 +57,5 @@ tags:
   - Image
   risk_score: 9
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/start_up_during_safe_mode_boot.yml b/detections/endpoint/start_up_during_safe_mode_boot.yml
index 7e2e1427db..2ba8ad8219 100644
--- a/detections/endpoint/start_up_during_safe_mode_boot.yml
+++ b/detections/endpoint/start_up_during_safe_mode_boot.yml
@@ -1,14 +1,23 @@
-name: Start Up During Safe Mode Boot
-id: c6149154-c9d8-11eb-9da7-acde48001122
-version: 2
-date: '2022-01-26'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-26'
 description: This search is to detect a modification or registry add to the safeboot
   registry as an autostart mechanism. This technique was seen in some ransomware to
   automatically execute its code upon a safe mode boot.
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+id: c6149154-c9d8-11eb-9da7-acde48001122
+known_false_positives: updated windows application needed in safe boot may used this
+  registry
+name: Start Up During Safe Mode Boot
+references:
+- https://malware.news/t/threat-analysis-unit-tau-threat-intelligence-notification-snatch-ransomware/36365
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
   where Registry.registry_path="*\\System\\CurrentControlSet\\Control\\SafeBoot\\Minimal\*"
   by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name
@@ -21,16 +30,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `start_up_during_safe_mode_boot_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: updated windows application needed in safe boot may used this
-  registry
-references:
-- https://malware.news/t/threat-analysis-unit-tau-threat-intelligence-notification-snatch-ransomware/36365
 tags:
   analytic_story:
   - Ransomware
@@ -51,20 +50,31 @@ tags:
   - T1547
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
   risk_score: 42
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/suspicious_computer_account_name_change.yml b/detections/endpoint/suspicious_computer_account_name_change.yml
index fd5671bb4e..c8332c861b 100644
--- a/detections/endpoint/suspicious_computer_account_name_change.yml
+++ b/detections/endpoint/suspicious_computer_account_name_change.yml
@@ -1,11 +1,6 @@
-name: Suspicious Computer Account Name Change
-id: 35a61ed8-61c4-11ec-bc1e-acde48001122
-version: 1
-date: '2021-12-20'
 author: Mauricio Velazco, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-12-20'
 description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller
   Impersonation (CVE-2021-42287) exploitation chain, adversaries need to create a
   new computer account name and rename it to match the name of a domain controller
@@ -14,17 +9,19 @@ description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain
   of an account was changed`, to identify a computer account rename event with a suspicious
   name that does not terminate with `$`. This behavior could represent an exploitation
   attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
-search: '`wineventlog_security` EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$"
-  | table _time, ComputerName, Account_Name, Old_Account_Name, New_Account_Name |
-  `suspicious_computer_account_name_change_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
+id: 35a61ed8-61c4-11ec-bc1e-acde48001122
 known_false_positives: Renaming a computer account name to a name that not end with
   '$' is highly unsual and may not have any legitimate scenarios.
+name: Suspicious Computer Account Name Change
 references:
 - https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
+search: '`wineventlog_security` EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$"
+  | table _time, ComputerName, Account_Name, Old_Account_Name, New_Account_Name |
+  `suspicious_computer_account_name_change_filter`'
 tags:
   analytic_story:
   - sAMAccountName Spoofing and Domain Controller Impersonation
@@ -48,9 +45,9 @@ tags:
   - T1078.002
   observable:
   - name: ComputerName
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -64,3 +61,5 @@ tags:
   - New_Account_Name
   risk_score: 70
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml
index 790e3c976f..48c197f2f8 100644
--- a/detections/endpoint/suspicious_copy_on_system32.yml
+++ b/detections/endpoint/suspicious_copy_on_system32.yml
@@ -1,16 +1,22 @@
-name: Suspicious Copy on System32
-id: ce633e56-25b2-11ec-9e76-acde48001122
-version: 1
-date: '2021-10-05'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-10-05'
 description: This analytic is to detect a suspicious copy of file from systemroot
   folder of the windows OS. This technique is commonly used by APT or other malware
   as part of execution (LOLBIN) to run its malicious code using the available legitimate
   tool in OS. this type of event may seen or may execute of normal user in some instance
   but this is really a anomaly that needs to be check within the network.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: ce633e56-25b2-11ec-9e76-acde48001122
+known_false_positives: every user may do this event but very un-ussual.
+name: Suspicious Copy on System32
+references:
+- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN("cmd.exe", "powershell*","pwsh.exe", "sqlps.exe", "sqltoolsps.exe", "powershell_ise.exe")
@@ -19,14 +25,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
   `suspicious_copy_on_system32_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: every user may do this event but very un-ussual.
-references:
-- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
 tags:
   analytic_story:
   - Unusual Processes
@@ -46,31 +44,29 @@ tags:
   - T1036
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
index 3e39f5d928..dba9aaef6c 100644
--- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml
@@ -1,32 +1,30 @@
-name: Suspicious DLLHost no Command Line Arguments
-id: ff61e98c-0337-4593-a78f-72a676c56f26
-version: 2
-date: '2021-09-20'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-20'
 description: The following analytic identifies DLLHost.exe with no command line arguments.
   It is unusual for DLLHost.exe to execute with no command line arguments present.
   This particular behavior is common with malicious software, including Cobalt Strike.
   During investigation, identify any network connections and parallel processes. Identify
   any suspicious module loads related to credential dumping or file writes. DLLHost.exe
   is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where `process_dllhost` by _time span=1h  Processes.process_id Processes.process_name
-  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | regex process="(dllhost\.exe.{0,4}$)" | `suspicious_dllhost_no_command_line_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: ff61e98c-0337-4593-a78f-72a676c56f26
 known_false_positives: Limited false positives may be present in small environments.
   Tuning may be required based on parent process.
+name: Suspicious DLLHost no Command Line Arguments
 references:
 - https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile
 - https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where `process_dllhost` by _time span=1h  Processes.process_id Processes.process_name
+  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | regex process="(dllhost\.exe.{0,4}$)" | `suspicious_dllhost_no_command_line_arguments_filter`'
 tags:
   analytic_story:
   - Cobalt Strike
@@ -48,31 +46,28 @@ tags:
   - T1055
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml
index 10a0bada0e..50bee627d0 100644
--- a/detections/endpoint/suspicious_driver_loaded_path.yml
+++ b/detections/endpoint/suspicious_driver_loaded_path.yml
@@ -1,11 +1,6 @@
-name: Suspicious Driver Loaded Path
-id: f880acd4-a8f1-11eb-a53b-acde48001122
-version: 1
-date: '2021-04-29'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-04-29'
 description: This analytic will detect suspicious driver loaded paths. This technique
   is commonly used by malicious software like coin miners (xmrig) to register its
   malicious driver from notable directories where executable or drivers do not commonly
@@ -14,19 +9,21 @@ description: This analytic will detect suspicious driver loaded paths. This tech
   is not normal, but occurs. In addition, review driver loads into `ntoskrnl.exe`
   for possible other drivers of interest. Long tail analyze drivers by path (outside
   of default, and in default) for further review.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the driver loaded and Signature from your endpoints. If you are using
+  Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+id: f880acd4-a8f1-11eb-a53b-acde48001122
+known_false_positives: Limited false positives will be present. Some applications
+  do load drivers
+name: Suspicious Driver Loaded Path
+references:
+- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/
+- https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/
 search: '`sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*",
   "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) |  stats  min(_time) as
   firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature
   Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_driver_loaded_path_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the driver loaded and Signature from your endpoints. If you are using
-  Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: Limited false positives will be present. Some applications
-  do load drivers
-references:
-- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/
-- https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/
 tags:
   analytic_story:
   - XMRig
@@ -47,13 +44,13 @@ tags:
   - T1543
   observable:
   - name: Computer
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: ImageLoaded
-    type: File Name
     role:
     - Attacker
+    type: File Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -68,3 +65,5 @@ tags:
   - Signed
   risk_score: 63
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
index 36e0a60730..9bc67d8373 100644
--- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml
@@ -1,31 +1,29 @@
-name: Suspicious GPUpdate no Command Line Arguments
-id: f308490a-473a-40ef-ae64-dd7a6eba284a
-version: 2
-date: '2021-09-20'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-20'
 description: The following analytic identifies gpupdate.exe with no command line arguments.
   It is unusual for gpupdate.exe to execute with no command line arguments present.
   This particular behavior is common with malicious software, including Cobalt Strike.
   During investigation, identify any network connections and parallel processes. Identify
   any suspicious module loads related to credential dumping or file writes. gpupdate.exe
   is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: f308490a-473a-40ef-ae64-dd7a6eba284a
+known_false_positives: Limited false positives may be present in small environments.
+  Tuning may be required based on parent process.
+name: Suspicious GPUpdate no Command Line Arguments
+references:
+- https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile
+- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where `process_gpupdate` by _time span=1h  Processes.process_id Processes.process_name
   Processes.dest Processes.process_path Processes.process Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | regex process="(gpupdate\.exe.{0,4}$)"  | `suspicious_gpupdate_no_command_line_arguments_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: Limited false positives may be present in small environments.
-  Tuning may be required based on parent process.
-references:
-- https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile
-- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
 tags:
   analytic_story:
   - Cobalt Strike
@@ -47,31 +45,28 @@ tags:
   - T1055
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml
index 8575a27f5d..aca90f4607 100644
--- a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml
+++ b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml
@@ -1,29 +1,27 @@
-name: Suspicious IcedID Rundll32 Cmdline
-id: bed761f8-ee29-11eb-8bf3-acde48001122
-version: 2
-date: '2021-07-26'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-07-26'
 description: This search is to detect a suspicious rundll32.exe commandline to execute
   dll file. This technique was seen in IcedID malware to load its payload dll with
   the following parameter to load encrypted dll payload which is the license.dat.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: bed761f8-ee29-11eb-8bf3-acde48001122
+known_false_positives: limitted. this parameter is not commonly used by windows application
+  but can be used by the network operator.
+name: Suspicious IcedID Rundll32 Cmdline
+references:
+- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*/i:*
   by  Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process
   Processes.process_id Processes.parent_process_id Processes.dest Processes.user |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_icedid_rundll32_cmdline_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: limitted. this parameter is not commonly used by windows application
-  but can be used by the network operator.
-references:
-- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/
 tags:
   analytic_story:
   - IcedID
@@ -43,31 +41,30 @@ tags:
   - T1218.011
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml
index cc90d22e6e..d632a4ebfd 100644
--- a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml
+++ b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml
@@ -1,17 +1,24 @@
-name: Suspicious Image Creation In Appdata Folder
-id: f6f904c4-1ac0-11ec-806b-acde48001122
-version: 1
-date: '2021-09-21'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+- Endpoint.Processes
+date: '2021-09-21'
 description: This search is to detect a suspicious creation of image in appdata folder
   made by process that also has a file reference in appdata folder. This technique
   was seen in remcos rat that capture screenshot of the compromised machine and place
   it in the appdata and will be send to its C2 server. This TTP is really a good indicator
   to check that process because it is in suspicious folder path and image files are
   not commonly created by user in this folder path.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: f6f904c4-1ac0-11ec-806b-acde48001122
+known_false_positives: unknown
+name: Suspicious Image Creation In Appdata Folder
+references:
+- https://success.trendmicro.com/solution/1123281-remcos-malware-information
+- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*"
   by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
@@ -22,14 +29,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` |
   fields _time dest file_create_time file_name file_path process_name process_path
   process] | `suspicious_image_creation_in_appdata_folder_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: unknown
-references:
-- https://success.trendmicro.com/solution/1123281-remcos-malware-information
-- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/
 tags:
   analytic_story:
   - Remcos
@@ -48,25 +47,36 @@ tags:
   - T1113
   observable:
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
   - _time
   - dest
   - file_create_time
   - file_name
   - file_path
+  - process
   - process_name
   - process_path
-  - process
   risk_score: 49
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
index eb1dccb291..e27771f62a 100644
--- a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
+++ b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml
@@ -1,11 +1,6 @@
-name: Suspicious Kerberos Service Ticket Request
-id: 8b1297bc-6204-11ec-b7c4-acde48001122
-version: 1
-date: '2021-12-20'
 author: Mauricio Velazco, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-12-20'
 description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller
   Impersonation (CVE-2021-42287) exploitation chain, adversaries will request and
   obtain a Kerberos Service Ticket (TGS) with a domain controller computer account
@@ -15,21 +10,23 @@ description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain
   where the Account_Name requesting the ticket matches the Service_Name field. This
   behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287
   for privilege escalation.
-search: ' `wineventlog_security` EventCode=4769 | eval isSuspicious = if(lower(Service_Name)
-  = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0) | where isSuspicious = 1 |
-  table _time, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious
-  | `suspicious_kerberos_service_ticket_request_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Domain Controller and Kerberos events. The Advanced Security Audit policy setting
   `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+id: 8b1297bc-6204-11ec-b7c4-acde48001122
 known_false_positives: We have tested this detection logic with ~2 million 4769 events
   and did not identify false positives. However, they may be possible in certain environments.
   Filter as needed.
+name: Suspicious Kerberos Service Ticket Request
 references:
 - https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
 - https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/02636893-7a1f-4357-af9a-b672e3e3de13
+search: ' `wineventlog_security` EventCode=4769 | eval isSuspicious = if(lower(Service_Name)
+  = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0) | where isSuspicious = 1 |
+  table _time, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious
+  | `suspicious_kerberos_service_ticket_request_filter`'
 tags:
   analytic_story:
   - sAMAccountName Spoofing and Domain Controller Impersonation
@@ -52,9 +49,9 @@ tags:
   - T1078.002
   observable:
   - name: ComputerName
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -68,3 +65,5 @@ tags:
   - Failure_Code
   risk_score: 60
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/suspicious_linux_discovery_commands.yml b/detections/endpoint/suspicious_linux_discovery_commands.yml
index 1740cfb0b7..9a1088051a 100644
--- a/detections/endpoint/suspicious_linux_discovery_commands.yml
+++ b/detections/endpoint/suspicious_linux_discovery_commands.yml
@@ -1,11 +1,7 @@
-name: Suspicious Linux Discovery Commands
-id: 0edd5112-56c9-11ec-b990-acde48001122
-version: 1
-date: '2021-12-06'
 author: Bhavin Patel, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-06'
 description: 'This search, detects execution of suspicious bash commands from various
   commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery
   of possible paths of privilege execution, password files, vulnerable directories,
@@ -13,6 +9,19 @@ description: 'This search, detects execution of suspicious bash commands from va
 
   The search logic specifically looks for high number of distinct commands run in
   a short period of time.'
+how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/).
+  Please install this add-on to parse fields correctly and execute detection search.
+  Consider customizing the time window and threshold values according to your environment.
+id: 0edd5112-56c9-11ec-b990-acde48001122
+known_false_positives: Unless an administrator is using these commands to troubleshoot
+  or audit a system, the execution of these commands should be monitored.
+name: Suspicious Linux Discovery Commands
+references:
+- https://attack.mitre.org/matrices/enterprise/linux/
+- https://attack.mitre.org/techniques/T1059/004/
+- https://github.com/IvanGlinkin/AutoSUID
+- https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
+- https://github.com/rebootuser/LinEnum
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   values(Processes.process_name) values(Processes.parent_process_name) dc(Processes.process)
   as distinct_commands dc(Processes.process_name) as distinct_process_names min(_time)
@@ -21,17 +30,6 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   by _time span=5m Processes.user Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| where
   distinct_commands > 40 AND distinct_process_names > 3| `suspicious_linux_discovery_commands_filter`'
-how_to_implement: This detection search is based on Splunk add-on for Microsoft Sysmon-Linux.(https://splunkbase.splunk.com/app/6176/).
-  Please install this add-on to parse fields correctly and execute detection search.
-  Consider customizing the time window and threshold values according to your environment.
-known_false_positives: Unless an administrator is using these commands to troubleshoot
-  or audit a system, the execution of these commands should be monitored.
-references:
-- https://attack.mitre.org/matrices/enterprise/linux/
-- https://attack.mitre.org/techniques/T1059/004/
-- https://github.com/IvanGlinkin/AutoSUID
-- https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
-- https://github.com/rebootuser/LinEnum
 tags:
   analytic_story:
   - Linux Post-Exploitation
@@ -50,18 +48,21 @@ tags:
   - T1059.004
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.parent_process_name
-  - Processes.user
-  - Processes.process_name
   risk_score: 81
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
index 94eaa1d5b8..562ab2465f 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml
@@ -1,33 +1,31 @@
-name: Suspicious microsoft workflow compiler rename
-id: f0db4464-55d9-11eb-ae93-0242ac130002
-version: 3
-date: '2021-09-20'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-20'
 description: The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe.
   Microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319
   and is rarely utilized. When investigating, identify the executed code on disk and
   review. A spawned child process from microsoft.workflow.compiler.exe is uncommon.
   In any instance, microsoft.workflow.compiler.exe spawning from an Office product
   or any living off the land binary is highly suspect.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: f0db4464-55d9-11eb-ae93-0242ac130002
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of microsoft.workflow.compiler.exe, triggering a false positive.
+name: Suspicious microsoft workflow compiler rename
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_microsoftworkflowcompiler`
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_microsoft_workflow_compiler_rename_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Although unlikely, some legitimate applications may use a moved
-  copy of microsoft.workflow.compiler.exe, triggering a false positive.
-references:
-- https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution
 tags:
   analytic_story:
   - Trusted Developer Utilities Proxy Execution
@@ -59,29 +57,28 @@ tags:
   - DE.CM
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
+type: Hunting
+version: 3
diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
index 3b400ef260..a5fa066235 100644
--- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
+++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml
@@ -1,30 +1,28 @@
-name: Suspicious microsoft workflow compiler usage
-id: 9bbc62e8-55d8-11eb-ae93-0242ac130002
-version: 2
-date: '2021-01-12'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-01-12'
 description: The following analytic identifies microsoft.workflow.compiler.exe usage.
   microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319
   and is rarely utilized. When investigating, identify the executed code on disk and
   review. It is not a commonly used process by many applications.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_microsoftworkflowcompiler`
-  by Processes.dest Processes.parent_process Processes.process_name Processes.original_file_name
-  Processes.process Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_usage_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: 9bbc62e8-55d8-11eb-ae93-0242ac130002
 known_false_positives: Although unlikely, limited instances have been identified coming
   from native Microsoft utilities similar to SCCM.
+name: Suspicious microsoft workflow compiler usage
 references:
 - https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md#atomic-test-6---microsoftworkflowcompilerexe-payload-execution
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_microsoftworkflowcompiler`
+  by Processes.dest Processes.parent_process Processes.process_name Processes.original_file_name
+  Processes.process Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `suspicious_microsoft_workflow_compiler_usage_filter`'
 tags:
   analytic_story:
   - Trusted Developer Utilities Proxy Execution
@@ -49,31 +47,28 @@ tags:
   - DE.CM
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml
index a5d11e2305..09e6d451bf 100644
--- a/detections/endpoint/suspicious_msbuild_path.yml
+++ b/detections/endpoint/suspicious_msbuild_path.yml
@@ -1,34 +1,32 @@
-name: Suspicious msbuild path
-id: f5198224-551c-11eb-ae93-0242ac130002
-version: 2
-date: '2021-01-12'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-01-12'
 description: The following analytic identifies msbuild.exe executing from a non-standard
   path. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319
   and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. Instances of Visual Studio
   will run a copy of msbuild.exe. A moved instance of MSBuild is suspicious, however
   there are instances of build applications that will move or use a copy of MSBuild.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: f5198224-551c-11eb-ae93-0242ac130002
+known_false_positives: Some legitimate applications may use a moved copy of msbuild.exe,
+  triggering a false positive. Baselining of MSBuild.exe usage is recommended to better
+  understand it's path usage. Visual Studio runs an instance out of a path that will
+  need to be filtered on.
+name: Suspicious msbuild path
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_msbuild` AND (Processes.process_path!=c:\\windows\\microsoft.net\\framework*\\v*\\*)
   by Processes.dest Processes.original_file_name Processes.parent_process Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
   `suspicious_msbuild_path_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Some legitimate applications may use a moved copy of msbuild.exe,
-  triggering a false positive. Baselining of MSBuild.exe usage is recommended to better
-  understand it's path usage. Visual Studio runs an instance out of a path that will
-  need to be filtered on.
-references:
-- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
 tags:
   analytic_story:
   - Trusted Developer Utilities Proxy Execution MSBuild
@@ -60,31 +58,29 @@ tags:
   - DE.CM
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index fdb7e16f85..98ac7265c8 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -1,32 +1,30 @@
-name: Suspicious MSBuild Rename
-id: 4006adac-5937-11eb-ae93-0242ac130002
-version: 2
-date: '2021-01-12'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-01-12'
 description: The following analytic identifies renamed instances of msbuild.exe executing.
   Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and
   C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify
   the code executed and what is executing a renamed instance of MSBuild.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 4006adac-5937-11eb-ae93-0242ac130002
+known_false_positives: Although unlikely, some legitimate applications may use a moved
+  copy of msbuild, triggering a false positive.
+name: Suspicious MSBuild Rename
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
+- https://github.com/infosecn1nja/MaliciousMacroMSBuild/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_msbuild` by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id Processes.original_file_name |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_msbuild_rename_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Although unlikely, some legitimate applications may use a moved
-  copy of msbuild, triggering a false positive.
-references:
-- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
-- https://github.com/infosecn1nja/MaliciousMacroMSBuild/
 tags:
   analytic_story:
   - Trusted Developer Utilities Proxy Execution MSBuild
@@ -58,31 +56,30 @@ tags:
   - DE.CM
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml
index eb3153be52..c063c11554 100644
--- a/detections/endpoint/suspicious_msbuild_spawn.yml
+++ b/detections/endpoint/suspicious_msbuild_spawn.yml
@@ -1,11 +1,7 @@
-name: Suspicious MSBuild Spawn
-id: a115fba6-5514-11eb-ae93-0242ac130002
-version: 2
-date: '2021-01-12'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-01-12'
 description: The following analytic identifies wmiprvse.exe spawning msbuild.exe.
   This behavior is indicative of a COM object being utilized to spawn msbuild from
   wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using
@@ -13,22 +9,24 @@ description: The following analytic identifies wmiprvse.exe spawning msbuild.exe
   In a malicious instance, MSBuild.exe will spawn from non-standard processes and
   have no command line arguments. For example, MSBuild.exe spawning from explorer.exe,
   powershell.exe is far less common and should be investigated.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: a115fba6-5514-11eb-ae93-0242ac130002
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+name: Suspicious MSBuild Spawn
+references:
+- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=wmiprvse.exe
   AND `process_msbuild` by Processes.dest Processes.parent_process Processes.original_file_name
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_msbuild_spawn_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Although unlikely, some legitimate applications may exhibit
-  this behavior, triggering a false positive.
-references:
-- https://lolbas-project.github.io/lolbas/Binaries/Msbuild/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md
 tags:
   analytic_story:
   - Trusted Developer Utilities Proxy Execution MSBuild
@@ -55,31 +53,29 @@ tags:
   - DE.CM
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml
index 95b4ff024d..20a3235cb5 100644
--- a/detections/endpoint/suspicious_mshta_child_process.yml
+++ b/detections/endpoint/suspicious_mshta_child_process.yml
@@ -1,15 +1,22 @@
-name: Suspicious mshta child process
-id: 60023bb6-5500-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-12'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-01-12'
 description: The following analytic identifies child processes spawning from  "mshta.exe".
   The search will return the first time and last time these command-line arguments
   were used for these executions, as well as the target system, the user, parent process
   "mshta.exe" and its child process.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 60023bb6-5500-11eb-ae93-0242ac130002
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+name: Suspicious mshta child process
+references:
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=mshta.exe
@@ -20,15 +27,6 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   OR Processes.process_name=cmd.exe) by Processes.dest Processes.parent_process Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `suspicious_mshta_child_process_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: Although unlikely, some legitimate applications may exhibit
-  this behavior, triggering a false positive.
-references:
-- https://github.com/redcanaryco/AtomicTestHarnesses
-- https://redcanary.com/blog/introducing-atomictestharnesses/
 tags:
   analytic_story:
   - Suspicious MSHTA Activity
@@ -54,30 +52,32 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: parent_process
-    type: Process Name
     role:
     - Parent Process
+    type: Process Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.parent_process
-  - Processes.user
   risk_score: 40
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/suspicious_mshta_spawn.yml b/detections/endpoint/suspicious_mshta_spawn.yml
index fb276a88f8..d4a12634b6 100644
--- a/detections/endpoint/suspicious_mshta_spawn.yml
+++ b/detections/endpoint/suspicious_mshta_spawn.yml
@@ -1,32 +1,30 @@
-name: Suspicious mshta spawn
-id: 4d33a488-5b5f-11eb-ae93-0242ac130002
-version: 2
-date: '2021-01-20'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-01-20'
 description: The following analytic identifies wmiprvse.exe spawning mshta.exe. This
   behavior is indicative of a DCOM object being utilized to spawn mshta from wmiprvse.exe
   or svchost.exe. In this instance, adversaries may use LethalHTA that will spawn
   mshta.exe from svchost.exe.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 4d33a488-5b5f-11eb-ae93-0242ac130002
+known_false_positives: Although unlikely, some legitimate applications may exhibit
+  this behavior, triggering a false positive.
+name: Suspicious mshta spawn
+references:
+- https://codewhitesec.blogspot.com/2018/07/lethalhta.html
+- https://github.com/redcanaryco/AtomicTestHarnesses
+- https://redcanary.com/blog/introducing-atomictestharnesses/
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe
   OR Processes.parent_process_name=wmiprvse.exe) AND `process_mshta` by Processes.dest
   Processes.parent_process Processes.user Processes.original_file_name| `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_mshta_spawn_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Although unlikely, some legitimate applications may exhibit
-  this behavior, triggering a false positive.
-references:
-- https://codewhitesec.blogspot.com/2018/07/lethalhta.html
-- https://github.com/redcanaryco/AtomicTestHarnesses
-- https://redcanary.com/blog/introducing-atomictestharnesses/
 tags:
   analytic_story:
   - Suspicious MSHTA Activity
@@ -53,27 +51,25 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml
index 5edadd08ce..9f32888a01 100644
--- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml
+++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml
@@ -1,11 +1,6 @@
-name: Suspicious Process DNS Query Known Abuse Web Services
-id: 3cf0dc36-484d-11ec-a6bc-acde48001122
-version: 2
-date: '2022-01-18'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2022-01-18'
 description: This analytic detects a suspicious process making a DNS query via known,
   abused text-paste web services, VoIP, instant messaging, and digital distribution
   platforms used to download external files. This technique is abused by adversaries,
@@ -13,19 +8,21 @@ description: This analytic detects a suspicious process making a DNS query via k
   is a good TTP indicator for possible initial access techniques. A user will experience
   false positives if the following instant messaging is allowed or common applications
   like telegram or discord are allowed in the corporate network.
+how_to_implement: This detection relies on sysmon logs with the Event ID 22, DNS Query.
+  We suggest you run this detection at least once a day over the last 14 days.
+id: 3cf0dc36-484d-11ec-a6bc-acde48001122
+known_false_positives: Noise and false positive can be seen if the following instant
+  messaging is allowed to use within corporate network. In this case, a filter is
+  needed.
+name: Suspicious Process DNS Query Known Abuse Web Services
+references:
+- https://urlhaus.abuse.ch/url/1798923/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 search: '`sysmon` EventCode=22 QueryName IN ("*pastebin*", "*discord*", "*telegram*",
   "*t.me*") process_name IN ("cmd.exe", "*powershell*", "pwsh.exe", "wscript.exe",
   "cscript.exe") | stats count min(_time) as firstTime max(_time) as lastTime by Image
   QueryName QueryStatus process_name QueryResults Computer | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_process_dns_query_known_abuse_web_services_filter`'
-how_to_implement: This detection relies on sysmon logs with the Event ID 22, DNS Query.
-  We suggest you run this detection at least once a day over the last 14 days.
-known_false_positives: Noise and false positive can be seen if the following instant
-  messaging is allowed to use within corporate network. In this case, a filter is
-  needed.
-references:
-- https://urlhaus.abuse.ch/url/1798923/
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Remcos
@@ -46,13 +43,13 @@ tags:
   - T1059
   observable:
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -67,3 +64,5 @@ tags:
   - Computer
   risk_score: 64
   security_domain: endpoint
+type: TTP
+version: 2
diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml
index ce259ece01..e64e88cf70 100644
--- a/detections/endpoint/suspicious_process_file_path.yml
+++ b/detections/endpoint/suspicious_process_file_path.yml
@@ -1,15 +1,21 @@
-name: Suspicious Process File Path
-id: 9be25988-ad82-11eb-a14f-acde48001122
-version: 1
-date: '2021-05-05'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-05-05'
 description: The following analytic will detect a suspicious process running in a
   file path where a process is not commonly seen and is most commonly used by malicious
   software. This behavior has been used by adversaries where they drop and run an
   exe in a path that is accessible without admin privileges.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 9be25988-ad82-11eb-a14f-acde48001122
+known_false_positives: Administrators may allow execution of specific binaries in
+  non-standard paths. Filter as needed.
+name: Suspicious Process File Path
+references:
+- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\windows\\fonts\\*"
@@ -22,14 +28,6 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   = "*\\PerfLogs\\*" by Processes.parent_process_name Processes.parent_process Processes.process_path
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_process_file_path_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators may allow execution of specific binaries in
-  non-standard paths. Filter as needed.
-references:
-- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - XMRig
@@ -53,27 +51,29 @@ tags:
   - T1543
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: Processes.process_path.file_path
-    type: File Name
     role:
     - Attacker
+    type: File Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_path
-  - Processes.dest
-  - Processes.user
   risk_score: 35
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/suspicious_process_with_discord_dns_query.yml b/detections/endpoint/suspicious_process_with_discord_dns_query.yml
index 25b462deef..96758e08fb 100644
--- a/detections/endpoint/suspicious_process_with_discord_dns_query.yml
+++ b/detections/endpoint/suspicious_process_with_discord_dns_query.yml
@@ -1,29 +1,26 @@
-name: Suspicious Process With Discord DNS Query
-id: 4d4332ae-792c-11ec-89c1-acde48001122
-version: 1
-date: '2022-01-19'
 author: Teoderick Contreras, Splunk
-type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
+date: '2022-01-19'
 description: This analytic identifies a process making a DNS query to Discord, a well
   known instant messaging and digital distribution platform. Discord can be abused
   by adversaries, as seen in the WhisperGate campaign, to host and download malicious.
   external files. A process resolving a Discord DNS name could be an indicator of
   malware trying to download files from Discord for further execution.
+how_to_implement: his detection relies on sysmon logs with the Event ID 22, DNS Query.
+id: 4d4332ae-792c-11ec-89c1-acde48001122
+known_false_positives: Noise and false positive can be seen if the following instant
+  messaging is allowed to use within corporate network. In this case, a filter is
+  needed.
+name: Suspicious Process With Discord DNS Query
+references:
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+- https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 search: '`sysmon` EventCode=22 QueryName IN ("*discord*") process_path != "*\\AppData\\Local\\Discord\\*"
   AND process_path != "*\\Program Files*" AND process_name != "discord.exe" | stats
   count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryStatus
   process_name QueryResults Computer process_path | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_process_with_discord_dns_query_filter`'
-how_to_implement: his detection relies on sysmon logs with the Event ID 22, DNS Query.
-known_false_positives: Noise and false positive can be seen if the following instant
-  messaging is allowed to use within corporate network. In this case, a filter is
-  needed.
-references:
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
-- https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - WhisperGate
@@ -49,13 +46,13 @@ tags:
   - DE.CM
   observable:
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -71,3 +68,5 @@ tags:
   - process_path
   risk_score: 64
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml
index fd7c536250..9d327eac7b 100644
--- a/detections/endpoint/suspicious_reg_exe_process.yml
+++ b/detections/endpoint/suspicious_reg_exe_process.yml
@@ -1,14 +1,23 @@
-name: Suspicious Reg exe Process
-id: a6b3ab4e-dd77-4213-95fa-fc94701995e0
-version: 4
-date: '2020-07-22'
 author: David Dorsey, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Processes
+date: '2020-07-22'
 description: This search looks for reg.exe being launched from a command prompt not
   started by the user. When a user launches cmd.exe, the parent process is usually
   explorer.exe. This search filters out those instances.
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+id: a6b3ab4e-dd77-4213-95fa-fc94701995e0
+known_false_positives: It's possible for system administrators to write scripts that
+  exhibit this behavior. If this is the case, the search will need to be modified
+  to filter them out.
+name: Suspicious Reg exe Process
+references:
+- https://car.mitre.org/wiki/CAR-2013-03-001
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name
   != explorer.exe Processes.process_name =cmd.exe by Processes.user Processes.process_name
@@ -19,16 +28,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.dest Processes.process_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | rename parent_process_id as process_id |dedup
   process_id| table process_id dest] | `suspicious_reg_exe_process_filter` '
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
-known_false_positives: It's possible for system administrators to write scripts that
-  exhibit this behavior. If this is the case, the search will need to be modified
-  to filter them out.
-references:
-- https://car.mitre.org/wiki/CAR-2013-03-001
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -56,27 +55,28 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: Processes.process_path.file_path
-    type: File Name
     role:
     - Attacker
+    type: File Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 4
diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
index 656aa2d5cb..52b656d471 100644
--- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
+++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
@@ -1,22 +1,11 @@
-name: Suspicious Regsvr32 Register Suspicious Path
-id: 62732736-6250-11eb-ae93-0242ac130002
-version: 2
-date: '2021-01-28'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-01-28'
 description: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code
   by using non-standard file extensions to load malciious DLLs. Upon investigating,
   look for network connections to remote destinations (internal or external). Review
   additional parrallel processes and child processes for additional activity.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` (Processes.process=*appdata*
-  OR Processes.process=*programdata* OR Processes.process=*windows\temp*) (Processes.process!=*.dll
-  Processes.process!=*.ax Processes.process!=*.ocx) by Processes.dest Processes.user
-  Processes.parent_process Processes.process_name Processes.process Processes.original_file_name
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`'
 how_to_implement: You must be ingesting endpoint data that tracks process activity,
   including parent-child relationships from your endpoints, to populate the Endpoint
   data model in the Processes node. The command-line arguments are mapped to the "process"
@@ -26,14 +15,23 @@ how_to_implement: You must be ingesting endpoint data that tracks process activi
   responsible for the changes from your endpoints into the `Endpoint` datamodel in
   the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is
   installed and the latest TA for the endpoint product.
+id: 62732736-6250-11eb-ae93-0242ac130002
 known_false_positives: Limited false positives with the query restricted to specified
   paths. Add more world writeable paths as tuning continues.
+name: Suspicious Regsvr32 Register Suspicious Path
 references:
 - https://attack.mitre.org/techniques/T1218/010/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.010/T1218.010.md
 - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
 - https://support.microsoft.com/en-us/topic/how-to-use-the-regsvr32-tool-and-troubleshoot-regsvr32-error-messages-a98d960a-7392-e6fe-d90a-3f4e0cb543e5
 - https://any.run/report/f29a7d2ecd3585e1e4208e44bcc7156ab5388725f1d29d03e7699da0d4598e7c/0826458b-5367-45cf-b841-c95a33a01718
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_regsvr32` (Processes.process=*appdata*
+  OR Processes.process=*programdata* OR Processes.process=*windows\temp*) (Processes.process!=*.dll
+  Processes.process!=*.ax Processes.process!=*.ocx) by Processes.dest Processes.user
+  Processes.parent_process Processes.process_name Processes.process Processes.original_file_name
+  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `suspicious_regsvr32_register_suspicious_path_filter`'
 tags:
   analytic_story:
   - Suspicious Regsvr32 Activity
@@ -62,31 +60,30 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: Processes.process_path.file_path
-    type: File Name
     role:
     - Attacker
+    type: File Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
index 19e3560a01..3b67734e38 100644
--- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
+++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml
@@ -1,11 +1,7 @@
-name: Suspicious Rundll32 dllregisterserver
-id: 8c00a385-9b86-4ac0-8932-c9ec3713b159
-version: 2
-date: '2021-02-09'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-02-09'
 description: The following analytic identifies rundll32.exe using dllregisterserver
   on the command line to load a DLL. When a DLL is registered, the DllRegisterServer
   method entry point in the DLL is invoked. This is typically seen when a DLL is being
@@ -13,20 +9,16 @@ description: The following analytic identifies rundll32.exe using dllregisterser
   capture malicious use of it. During investigation, review the parent process and
   parrellel processes executing. Capture the DLL being loaded and inspect further.
   Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*dllregisterserver*
-  by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
-  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `suspicious_rundll32_dllregisterserver_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: 8c00a385-9b86-4ac0-8932-c9ec3713b159
 known_false_positives: This is likely to produce false positives and will require
   some filtering. Tune the query by adding command line paths to known good DLLs,
   or filtering based on parent process names.
+name: Suspicious Rundll32 dllregisterserver
 references:
 - https://attack.mitre.org/techniques/T1218/011/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
@@ -35,6 +27,12 @@ references:
 - https://github.com/pan-unit42/tweets/blob/master/2020-12-10-IOCs-from-Ursnif-infection-with-Delf-variant.txt
 - https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-qakbot-zip-based-campaign/
 - https://msdn.microsoft.com/en-us/library/windows/desktop/ms682162(v=vs.85).aspx
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*dllregisterserver*
+  by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `suspicious_rundll32_dllregisterserver_filter`'
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity
@@ -62,31 +60,30 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: Processes.process_path.file_path
-    type: File Name
     role:
     - Attacker
+    type: File Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml
index b0ddab468c..10840f6048 100644
--- a/detections/endpoint/suspicious_rundll32_plugininit.yml
+++ b/detections/endpoint/suspicious_rundll32_plugininit.yml
@@ -1,29 +1,27 @@
-name: Suspicious Rundll32 PluginInit
-id: 92d51712-ee29-11eb-b1ae-acde48001122
-version: 2
-date: '2021-07-26'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-07-26'
 description: This search is to detect a suspicious rundll32.exe process with plugininit
   parameter. This technique is commonly seen in IceID malware to execute its initial
   dll stager to download another payload to the compromised machine.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 92d51712-ee29-11eb-b1ae-acde48001122
+known_false_positives: third party application may used this dll export name to execute
+  function.
+name: Suspicious Rundll32 PluginInit
+references:
+- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*PluginInit*
   by  Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name
   Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `suspicious_rundll32_plugininit_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: third party application may used this dll export name to execute
-  function.
-references:
-- https://threatpost.com/icedid-banking-trojan-surges-emotet/165314/
 tags:
   analytic_story:
   - IcedID
@@ -43,31 +41,31 @@ tags:
   - T1218.011
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 42
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml
index c5e148e8c0..f3117bb1f3 100644
--- a/detections/endpoint/suspicious_rundll32_startw.yml
+++ b/detections/endpoint/suspicious_rundll32_startw.yml
@@ -1,11 +1,7 @@
-name: Suspicious Rundll32 StartW
-id: 9319dda5-73f2-4d43-a85a-67ce961bddb7
-version: 3
-date: '2021-02-04'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-02-04'
 description: The following analytic identifies rundll32.exe executing a DLL function
   name, Start and StartW, on the command line that is commonly observed with Cobalt
   Strike x86 and x64 DLL payloads. Rundll32.exe is natively found in C:\Windows\system32
@@ -15,25 +11,27 @@ description: The following analytic identifies rundll32.exe executing a DLL func
   execution. Capture and triage the DLL in question. In the instance of Cobalt Strike,
   rundll32.exe is the default process it opens and injects shellcode into. This default
   process can be changed, but typically is not.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*start*
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `suspicious_rundll32_startw_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: 9319dda5-73f2-4d43-a85a-67ce961bddb7
 known_false_positives: Although unlikely, some legitimate applications may use Start
   as a function and call it via the command line. Filter as needed.
+name: Suspicious Rundll32 StartW
 references:
 - https://attack.mitre.org/techniques/T1218/011/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
 - https://www.cobaltstrike.com/help-windows-executable
 - https://lolbas-project.github.io/lolbas/Binaries/Rundll32
 - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*start*
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `suspicious_rundll32_startw_filter`'
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity
@@ -63,31 +61,30 @@ tags:
   - DE.CM
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 3
diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
index ee2bce6a7c..dc7d4181f8 100644
--- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
@@ -1,34 +1,32 @@
-name: Suspicious Rundll32 no Command Line Arguments
-id: e451bd16-e4c5-4109-8eb1-c4c6ecf048b4
-version: 2
-date: '2021-09-20'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-20'
 description: The following analytic identifies rundll32.exe with no command line arguments.
   It is unusual for rundll32.exe to execute with no command line arguments present.
   This particular behavior is common with malicious software, including Cobalt Strike.
   During investigation, identify any network connections and parallel processes. Identify
   any suspicious module loads related to credential dumping or file writes. Rundll32.exe
   is natively found in C:\Windows\system32 and C:\Windows\syswow64.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where `process_rundll32` by _time span=1h  Processes.process_id Processes.process_name
-  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | regex process="(rundll32\.exe.{0,4}$)" | `suspicious_rundll32_no_command_line_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: e451bd16-e4c5-4109-8eb1-c4c6ecf048b4
 known_false_positives: Although unlikely, some legitimate applications may use a moved
   copy of rundll32, triggering a false positive.
+name: Suspicious Rundll32 no Command Line Arguments
 references:
 - https://attack.mitre.org/techniques/T1218/011/
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
 - https://lolbas-project.github.io/lolbas/Binaries/Rundll32
 - https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where `process_rundll32` by _time span=1h  Processes.process_id Processes.process_name
+  Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | regex process="(rundll32\.exe.{0,4}$)" | `suspicious_rundll32_no_command_line_arguments_filter`'
 tags:
   analytic_story:
   - Suspicious Rundll32 Activity
@@ -61,31 +59,28 @@ tags:
   - DE.CM
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
index c663f88758..72c7eee3c6 100644
--- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
+++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
@@ -1,17 +1,22 @@
-name: Suspicious Scheduled Task from Public Directory
-id: 7feb7972-7ac3-11eb-bac8-acde48001122
-version: 1
-date: '2021-03-01'
 author: Michael Haag, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-03-01'
 description: The following detection identifies Scheduled Tasks registering (creating
   a new task) a binary or script to run from a public directory which includes users\public,
   \programdata\ and \windows\temp. Upon triage, review the binary or script in the
   command line for legitimacy, whether an approved binary/script or not. In addition,
   capture the binary or script in question and analyze for further behaviors. Identify
   the source and contain the endpoint.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 7feb7972-7ac3-11eb-bac8-acde48001122
+known_false_positives: Limited false positives may be present. Filter as needed by
+  parent process or command line argument.
+name: Suspicious Scheduled Task from Public Directory
+references:
+- https://attack.mitre.org/techniques/T1053/005/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
   (Processes.process=*\\users\\public\\* OR Processes.process=*\\programdata\\* OR
@@ -19,13 +24,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `suspicious_scheduled_task_from_public_directory_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Limited false positives may be present. Filter as needed by
-  parent process or command line argument.
-references:
-- https://attack.mitre.org/techniques/T1053/005/
 tags:
   analytic_story:
   - Ransomware
@@ -50,28 +48,29 @@ tags:
   - T1053
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
index a804c6b96f..8078d503fb 100644
--- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
@@ -1,11 +1,7 @@
-name: Suspicious SearchProtocolHost no Command Line Arguments
-id: f52d2db8-31f9-4aa7-a176-25779effe55c
-version: 2
-date: '2021-09-20'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-20'
 description: The following analytic identifies searchprotocolhost.exe with no command
   line arguments. It is unusual for searchprotocolhost.exe to execute with no command
   line arguments present. This particular behavior is common with malicious software,
@@ -13,20 +9,22 @@ description: The following analytic identifies searchprotocolhost.exe with no co
   and parallel processes. Identify any suspicious module loads related to credential
   dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32
   and C:\Windows\syswow64.
-search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where Processes.process_name=searchprotocolhost.exe by _time span=1h  Processes.process_id
-  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | regex process="(searchprotocolhost\.exe.{0,4}$)"  | `suspicious_searchprotocolhost_no_command_line_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
+id: f52d2db8-31f9-4aa7-a176-25779effe55c
 known_false_positives: Limited false positives may be present in small environments.
   Tuning may be required based on parent process.
+name: Suspicious SearchProtocolHost no Command Line Arguments
 references:
 - https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc
+search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
+  where Processes.process_name=searchprotocolhost.exe by _time span=1h  Processes.process_id
+  Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | regex process="(searchprotocolhost\.exe.{0,4}$)"  | `suspicious_searchprotocolhost_no_command_line_arguments_filter`'
 tags:
   analytic_story:
   - Cobalt Strike
@@ -48,31 +46,28 @@ tags:
   - T1055
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml
index 9bafa5a48c..8854aa6726 100644
--- a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml
+++ b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml
@@ -1,11 +1,6 @@
-name: Suspicious Ticket Granting Ticket Request
-id: d77d349e-6269-11ec-9cfe-acde48001122
-version: 1
-date: '2021-12-21'
 author: Mauricio Velazco, Splunk
-type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-12-21'
 description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller
   Impersonation (CVE-2021-42287) exploitation chain, adversaries will need to request
   a Kerberos Ticket Granting Ticket (TGT) on behalf of the newly created and renamed
@@ -15,22 +10,24 @@ description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain
   a sequence of events where the new computer account on event id 4781 matches the
   request account on event id 4768. This behavior could represent an exploitation
   attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+id: d77d349e-6269-11ec-9cfe-acde48001122
+known_false_positives: A computer account name change event inmediately followed by
+  a kerberos TGT request with matching fields is unsual. However, legitimate behavior
+  may trigger it. Filter as needed.
+name: Suspicious Ticket Granting Ticket Request
+references:
+- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
 search: ' `wineventlog_security` (EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$")
   OR (EventCode=4768 Account_Name!="*$") | eval RenamedComputerAccount = coalesce(New_Account_Name,
   mvindex(Account_Name,0)) | transaction RenamedComputerAccount startswith=(EventCode=4781)
   endswith=(EventCode=4768) | eval short_lived=case((duration<2),"TRUE") | search
   short_lived = TRUE | table _time, ComputerName, EventCode, Account_Name,RenamedComputerAccount,
   short_lived |`suspicious_ticket_granting_ticket_request_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
-  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
-known_false_positives: A computer account name change event inmediately followed by
-  a kerberos TGT request with matching fields is unsual. However, legitimate behavior
-  may trigger it. Filter as needed.
-references:
-- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
-- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
-- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
 tags:
   analytic_story:
   - sAMAccountName Spoofing and Domain Controller Impersonation
@@ -50,9 +47,9 @@ tags:
   - T1078.002
   observable:
   - name: ComputerName
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -66,3 +63,5 @@ tags:
   - ComputerName
   risk_score: 60
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml
index 977bc81441..6b1cdcfbcf 100644
--- a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml
+++ b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml
@@ -1,17 +1,24 @@
-name: Suspicious WAV file in Appdata Folder
-id: 5be109e6-1ac5-11ec-b421-acde48001122
-version: 1
-date: '2021-09-21'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+- Endpoint.Processes
+date: '2021-09-21'
 description: This analytic is to detect a suspicious creation of .wav file in appdata
   folder. This behavior was seen in Remcos RAT malware where it put the audio recording
   in the appdata\audio folde as part of data collection. this recording can be send
   to its C2 server as part of its exfiltration to the compromised machine. creation
   of wav files in this folder path is not a ussual disk place used by user to save
   audio format file.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, file_name, file_path and command-line
+  executions from your endpoints. If you are using Sysmon, you must have at least
+  version 6.0.4 of the Sysmon TA.
+id: 5be109e6-1ac5-11ec-b421-acde48001122
+known_false_positives: unknown
+name: Suspicious WAV file in Appdata Folder
+references:
+- https://success.trendmicro.com/solution/1123281-remcos-malware-information
+- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*"
   by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
@@ -21,14 +28,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
   Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields file_name file_path
   process_name process_path process dest file_create_time _time ] | `suspicious_wav_file_in_appdata_folder_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, file_name, file_path and command-line
-  executions from your endpoints. If you are using Sysmon, you must have at least
-  version 6.0.4 of the Sysmon TA.
-known_false_positives: unknown
-references:
-- https://success.trendmicro.com/solution/1123281-remcos-malware-information
-- https://blog.malwarebytes.com/threat-intelligence/2021/07/remcos-rat-delivered-via-visual-basic/
 tags:
   analytic_story:
   - Remcos
@@ -47,25 +46,36 @@ tags:
   - T1113
   observable:
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
   - _time
   - dest
   - file_create_time
   - file_name
   - file_path
+  - process
   - process_name
   - process_path
-  - process
   risk_score: 49
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml
index ed1d109a7c..59895ae129 100644
--- a/detections/endpoint/suspicious_wevtutil_usage.yml
+++ b/detections/endpoint/suspicious_wevtutil_usage.yml
@@ -1,14 +1,21 @@
-name: Suspicious wevtutil Usage
-id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f
-version: 4
-date: '2021-10-11'
 author: David Dorsey, Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-10-11'
 description: The wevtutil.exe application is the windows event log utility. This searches
   for wevtutil.exe with parameters for clearing the application, security, setup,
   trace or system event logs.
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f
+known_false_positives: The wevtutil.exe application is a legitimate Windows event
+  log utility. Administrators may use it to manage Windows event logs.
+name: Suspicious wevtutil Usage
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where Processes.process_name=wevtutil.exe Processes.process IN ("* cl *", "*clear-log*")
@@ -16,15 +23,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   OR Processes.process="*Application*" OR Processes.process="*trace*") by Processes.process_name
   Processes.parent_process_name Processes.dest Processes.user| `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `suspicious_wevtutil_usage_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
-known_false_positives: The wevtutil.exe application is a legitimate Windows event
-  log utility. Administrators may use it to manage Windows event logs.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md
 tags:
   analytic_story:
   - Windows Log Manipulation
@@ -57,25 +55,27 @@ tags:
   - DE.AE
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: User
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.process_name
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.user
   risk_score: 28
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 4
diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml
index df4adae9be..a197e492f4 100644
--- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml
+++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml
@@ -1,12 +1,19 @@
-name: Suspicious writes to windows Recycle Bin
-id: b5541828-8ffd-4070-9d95-b3da4de924cb
-version: 4
-date: '2020-07-22'
 author: Rico Valdez, Splunk
-type: TTP
-datamodel: []
+datamodel:
+- Endpoint.Filesystem
+- Endpoint.Processes
+date: '2020-07-22'
 description: This search detects writes to the recycle bin by a process other than
   explorer.exe.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on filesystem and process logs responsible for the changes from your endpoints into
+  the `Endpoint` datamodel in the `Processes` and `Filesystem` nodes.
+id: b5541828-8ffd-4070-9d95-b3da4de924cb
+known_false_positives: Because the Recycle Bin is a hidden folder in modern versions
+  of Windows, it would be unusual for a process other than explorer.exe to write to
+  it. Incidents should be investigated as appropriate.
+name: Suspicious writes to windows Recycle Bin
+references: []
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime values(Filesystem.file_path) as file_path values(Filesystem.file_name)
   as file_name FROM datamodel=Endpoint.Filesystem where Filesystem.file_path = "*$Recycle.Bin*"
@@ -16,13 +23,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   as parent_process_name FROM datamodel=Endpoint.Processes where Processes.process_name
   != "explorer.exe" by Processes.process_id Processes.dest| `drop_dm_object_name("Processes")`
   | table process_id dest] | `suspicious_writes_to_windows_recycle_bin_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on filesystem and process logs responsible for the changes from your endpoints into
-  the `Endpoint` datamodel in the `Processes` and `Filesystem` nodes.
-known_false_positives: Because the Recycle Bin is a hidden folder in modern versions
-  of Windows, it would be unusual for a process other than explorer.exe to write to
-  it. Incidents should be investigated as appropriate.
-references: []
 tags:
   analytic_story:
   - Collection and Staging
@@ -44,27 +44,29 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: Processes.process_name
-    type: Process
     role:
     - Attacker
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.process_id
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Filesystem.file_path
-  - Filesystem.file_name
-  - Filesystem.process_id
-  - Filesystem.dest
-  - Processes.user
-  - Processes.process_name
-  - Processes.parent_process_name
-  - Processes.process_id
-  - Processes.dest
   risk_score: 28
   security_domain: endpoint
+type: TTP
+version: 4
diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
index e4ff7baa92..76f6ba1c29 100644
--- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
@@ -1,11 +1,7 @@
-name: Svchost LOLBAS Execution Process Spawn
-id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af
-version: 1
-date: '2021-11-22'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-22'
 description: The following analytic identifies `svchost.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing the Task Scheduler
   and creating a malicious remote scheduled task, the executed command is spawned
@@ -13,6 +9,17 @@ description: The following analytic identifies `svchost.exe` spawning a LOLBAS e
   binaries that can be abused by threat actors to perform tasks like executing malicious
   code. Looking for child processes of svchost.exe that are part of the LOLBAS project
   can help defenders identify lateral movement activity.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+id: 09e5c72a-4c0d-11ec-aa29-3e22fbd008af
+known_false_positives: Legitimate applications may trigger this behavior, filter as
+  needed.
+name: Svchost LOLBAS Execution Process Spawn
+references:
+- https://attack.mitre.org/techniques/T1053/005/
+- https://www.ired.team/offensive-security/persistence/t1053-schtask
+- https://lolbas-project.github.io/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=svchost.exe)
   (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe",
@@ -28,15 +35,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   "Msconfig.exe")) by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `svchost_lolbas_execution_process_spawn_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
-known_false_positives: Legitimate applications may trigger this behavior, filter as
-  needed.
-references:
-- https://attack.mitre.org/techniques/T1053/005/
-- https://www.ired.team/offensive-security/persistence/t1053-schtask
-- https://lolbas-project.github.io/
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -56,25 +54,24 @@ tags:
   - T1053.005
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml
index 25f594ec14..435d53b151 100644
--- a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml
+++ b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml
@@ -1,11 +1,7 @@
-name: System Info Gathering Using Dxdiag Application
-id: f92d74f2-4921-11ec-b685-acde48001122
-version: 1
-date: '2021-11-19'
 author: Teoderick Contreras, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-19'
 description: This analytic is to detect a suspicious dxdiag.exe process command-line
   execution. Dxdiag is used to collect the system info of the target host. This technique
   has been used by Remcos RATS, various actors, and other malware to collect information
@@ -14,21 +10,23 @@ description: This analytic is to detect a suspicious dxdiag.exe process command-
   to audit host machine specifications. Thus in some rare cases, this detection will
   contain false positives in its results. To triage further, analyze what commands
   were passed after it pipes out the result to a file for further processing.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem`
+  node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
+  latest TA for the endpoint product.
+id: f92d74f2-4921-11ec-b685-acde48001122
+known_false_positives: This commandline can be used by a network administrator to
+  audit host machine specifications. Thus, a filter is needed.
+name: System Info Gathering Using Dxdiag Application
+references:
+- https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_dxdiag` AND Processes.process
   = "* /t *" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `system_info_gathering_using_dxdiag_application_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem`
-  node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
-  latest TA for the endpoint product.
-known_false_positives: This commandline can be used by a network administrator to
-  audit host machine specifications. Thus, a filter is needed.
-references:
-- https://app.any.run/tasks/df0baf9f-8baf-4c32-a452-16562ecb19be/
 tags:
   analytic_story:
   - Remcos
@@ -47,29 +45,28 @@ tags:
   - T1592
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml
index cba2897e4b..27456744da 100644
--- a/detections/endpoint/system_information_discovery_detection.yml
+++ b/detections/endpoint/system_information_discovery_detection.yml
@@ -1,13 +1,17 @@
-name: System Information Discovery Detection
-id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
-version: 2
-date: '2021-09-07'
 author: Patrick Bareiss, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-07'
 description: Detect system information discovery techniques used by attackers to understand
   configurations of the system to further exploit it.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
+known_false_positives: Administrators debugging servers
+name: System Information Discovery Detection
+references:
+- https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*"
   OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user
@@ -16,12 +20,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   by dest | where dc_processes_by_dest > 2 | stats values(process) as process min(firstTime)
   as firstTime max(lastTime) as lastTime by user, dest parent_process_name | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `system_information_discovery_detection_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators debugging servers
-references:
-- https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation
 tags:
   analytic_story:
   - Discovery Techniques
@@ -47,24 +45,27 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: User
-    type: User
     role:
     - Attacker
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.user
-  - Processes.process_name
-  - Processes.dest
   risk_score: 15
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml
index 09b9bc2061..b9d6bfa975 100644
--- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml
+++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml
@@ -1,11 +1,7 @@
-name: System Processes Run From Unexpected Locations
-id: a34aae96-ccf8-4aef-952c-3ea21444444d
-version: 6
-date: '2020-12-08'
 author: David Dorsey, Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-12-08'
 description: 'This search looks for system processes that typically execute from `C:\Windows\System32\`
   or `C:\Windows\SysWOW64`.  This may indicate a malicious process that is trying
   to hide as a legitimate process.\
@@ -16,6 +12,16 @@ description: 'This search looks for system processes that typically execute from
   During triage, review the parallel processes - what process moved the native Windows
   binary? identify any artifacts on disk and review. If a remote destination is contacted,
   what is the reputation?'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: a34aae96-ccf8-4aef-952c-3ea21444444d
+known_false_positives: This detection may require tuning based on third party applications
+  utilizing native Windows binaries in non-standard paths.
+name: System Processes Run From Unexpected Locations
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
+- https://attack.mitre.org/techniques/T1036/003/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*"
   Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.dest Processes.user
@@ -23,14 +29,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file`
   | `system_processes_run_from_unexpected_locations_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: This detection may require tuning based on third party applications
-  utilizing native Windows binaries in non-standard paths.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
-- https://attack.mitre.org/techniques/T1036/003/
 tags:
   analytic_story:
   - Suspicious Command-Line Executions
@@ -60,27 +58,31 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: Processes.process_name
-    type: Process
     role:
     - Attacker
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_hash
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_path
-  - Processes.user
-  - Processes.dest
-  - Processes.process_name
-  - Processes.process_id
-  - Processes.parent_process_name
-  - Processes.process_hash
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 6
diff --git a/detections/endpoint/system_user_discovery_with_query.yml b/detections/endpoint/system_user_discovery_with_query.yml
index f5f1790f84..542604cf49 100644
--- a/detections/endpoint/system_user_discovery_with_query.yml
+++ b/detections/endpoint/system_user_discovery_with_query.yml
@@ -1,27 +1,25 @@
-name: System User Discovery With Query
-id: ad03bfcf-8a91-4bc2-a500-112993deba87
-version: 1
-date: '2021-09-13'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-13'
 description: This analytic looks for the execution of `query.exe` with command-line
   arguments utilized to discover the logged user. Red Teams and adversaries alike
   may leverage `query.exe` to identify system users on a compromised endpoint for
   situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: ad03bfcf-8a91-4bc2-a500-112993deba87
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: System User Discovery With Query
+references:
+- https://attack.mitre.org/techniques/T1033/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe")
   (Processes.process=*user*) by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `system_user_discovery_with_query_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1033/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -41,25 +39,23 @@ tags:
   - T1033
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/system_user_discovery_with_whoami.yml b/detections/endpoint/system_user_discovery_with_whoami.yml
index 2091cb5a3d..51ebabfedd 100644
--- a/detections/endpoint/system_user_discovery_with_whoami.yml
+++ b/detections/endpoint/system_user_discovery_with_whoami.yml
@@ -1,26 +1,24 @@
-name: System User Discovery With Whoami
-id: 894fc43e-6f50-47d5-a68b-ee9ee23e18f4
-version: 1
-date: '2021-09-13'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-13'
 description: This analytic looks for the execution of `whoami.exe` without any arguments.
   This windows native binary prints out the current logged user. Red Teams and adversaries
   alike may leverage `whoami.exe` to identify system users on a compromised endpoint
   for situational awareness and Active Directory Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 894fc43e-6f50-47d5-a68b-ee9ee23e18f4
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: System User Discovery With Whoami
+references:
+- https://attack.mitre.org/techniques/T1033/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="whoami.exe")
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_user_discovery_with_whoami_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1033/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -40,25 +38,23 @@ tags:
   - T1033
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml
index 42cbd1ab82..02a98aa68f 100644
--- a/detections/endpoint/time_provider_persistence_registry.yml
+++ b/detections/endpoint/time_provider_persistence_registry.yml
@@ -1,16 +1,25 @@
-name: Time Provider Persistence Registry
-id: 5ba382c4-2105-11ec-8d8f-acde48001122
-version: 2
-date: '2022-01-26'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-01-26'
 description: This analytic is to detect a suspicious modification of time provider
   registry for persistence and autostart. This technique can allow the attacker to
   persist on the compromised host and autostart as soon as the machine boot up. This
   TTP can be a good indicator of suspicious behavior since this registry is not commonly
   modified by normal user or even an admin.
+how_to_implement: To successfully implement this search, you must be ingesting data
+  that records registry activity from your hosts to populate the endpoint data model
+  in the registry node. This is typically populated via endpoint detection-and-response
+  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  used for this search is typically generated via logs that report reads and writes
+  to the registry.
+id: 5ba382c4-2105-11ec-8d8f-acde48001122
+known_false_positives: unknown
+name: Time Provider Persistence Registry
+references:
+- https://pentestlab.blog/2019/10/22/persistence-time-providers/
+- https://attack.mitre.org/techniques/T1547/003/
 search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
   max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
   ="*\\CurrentControlSet\\Services\\W32Time\\TimeProviders*" by _time span=1h Registry.dest
@@ -24,16 +33,6 @@ search: '| tstats `security_content_summariesonly` count  min(_time) as firstTim
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `time_provider_persistence_registry_filter`'
-how_to_implement: To successfully implement this search, you must be ingesting data
-  that records registry activity from your hosts to populate the endpoint data model
-  in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
-  used for this search is typically generated via logs that report reads and writes
-  to the registry.
-known_false_positives: unknown
-references:
-- https://pentestlab.blog/2019/10/22/persistence-time-providers/
-- https://attack.mitre.org/techniques/T1547/003/
 tags:
   analytic_story:
   - Windows Persistence Techniques
@@ -54,25 +53,35 @@ tags:
   - T1547
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/trickbot_named_pipe.yml b/detections/endpoint/trickbot_named_pipe.yml
index 29ba31c3c0..41e2b3121b 100644
--- a/detections/endpoint/trickbot_named_pipe.yml
+++ b/detections/endpoint/trickbot_named_pipe.yml
@@ -1,25 +1,22 @@
-name: Trickbot Named Pipe
-id: 1804b0a4-a682-11eb-8f68-acde48001122
-version: 1
-date: '2021-04-26'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-04-26'
 description: this search is to detect potential trickbot infection through the create/connected
   named pipe to the system. This technique is used by trickbot to communicate to its
   c2 to post or get command during infection.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and pipename from your endpoints. If you are using Sysmon,
+  you must have at least version 6.0.4 of the Sysmon TA. .
+id: 1804b0a4-a682-11eb-8f68-acde48001122
+known_false_positives: unknown
+name: Trickbot Named Pipe
+references:
+- https://labs.vipre.com/trickbot-and-its-modules/
+- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
 search: '`sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe" | stats  min(_time)
   as firstTime max(_time) as lastTime count by Computer user_id EventCode PipeName
   signature Image process_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `trickbot_named_pipe_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name and pipename from your endpoints. If you are using Sysmon,
-  you must have at least version 6.0.4 of the Sysmon TA. .
-known_false_positives: unknown
-references:
-- https://labs.vipre.com/trickbot-and-its-modules/
-- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
 tags:
   analytic_story:
   - Trickbot
@@ -39,13 +36,13 @@ tags:
   - T1055
   observable:
   - name: Computer
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: Image
-    type: Process
     role:
     - Attacker
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -61,3 +58,5 @@ tags:
   - process_id
   risk_score: 42
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml
index 6949009607..bf27729aad 100644
--- a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml
+++ b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml
@@ -1,27 +1,24 @@
-name: UAC Bypass MMC Load Unsigned Dll
-id: 7f04349c-e30d-11eb-bc7f-acde48001122
-version: 1
-date: '2021-07-12'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-07-12'
 description: This search is to detect a suspicious loaded unsigned dll by MMC.exe
   application. This technique is commonly seen in attacker that tries to bypassed
   UAC feature or gain privilege escalation. This is done by modifying some CLSID registry
   that will trigger the mmc.exe to load the dll path
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and imageloaded executions from your endpoints. If you
+  are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+id: 7f04349c-e30d-11eb-bc7f-acde48001122
+known_false_positives: unknown. all of the dll loaded by mmc.exe is microsoft signed
+  dll.
+name: UAC Bypass MMC Load Unsigned Dll
+references:
+- https://offsec.almond.consulting/UAC-bypass-dotnet.html
 search: '`sysmon` EventCode=7  ImageLoaded = "*.dll" Image = "*\\mmc.exe" Signed=false
   Company != "Microsoft Corporation" | stats count min(_time) as firstTime max(_time)
   as lastTime by Image ImageLoaded Signed ProcessId OriginalFileName Computer EventCode
   Company | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `uac_bypass_mmc_load_unsigned_dll_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name and imageloaded executions from your endpoints. If you
-  are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: unknown. all of the dll loaded by mmc.exe is microsoft signed
-  dll.
-references:
-- https://offsec.almond.consulting/UAC-bypass-dotnet.html
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -45,9 +42,9 @@ tags:
   - T1548
   observable:
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -64,3 +61,5 @@ tags:
   - Company
   risk_score: 63
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml
index 965e53bb2e..41a1d532b0 100644
--- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml
+++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml
@@ -1,26 +1,23 @@
-name: UAC Bypass With Colorui COM Object
-id: 2bcccd20-fc2b-11eb-8d22-acde48001122
-version: 1
-date: '2021-08-13'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-08-13'
 description: This search is to detect a possible uac bypass using the colorui.dll
   COM Object. this technique was seen in so many malware and ransomware like lockbit
   where it make use of the colorui.dll COM CLSID to bypass UAC.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 2bcccd20-fc2b-11eb-8d22-acde48001122
+known_false_positives: not so common. but 3rd part app may load this dll.
+name: UAC Bypass With Colorui COM Object
+references:
+- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/
 search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe"
   NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as
   firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode
   Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `uac_bypass_with_colorui_com_object_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: not so common. but 3rd part app may load this dll.
-references:
-- https://news.sophos.com/en-us/2020/04/24/lockbit-ransomware-borrows-tricks-to-keep-up-with-revil-and-maze/
 tags:
   analytic_story:
   - Ransomware
@@ -41,17 +38,17 @@ tags:
   - T1218.003
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: ImageLoaded
-    type: Other
     role:
     - Other
+    type: Other
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -67,3 +64,5 @@ tags:
   - ProcessId
   risk_score: 48
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/unified_messaging_service_spawning_a_process.yml b/detections/endpoint/unified_messaging_service_spawning_a_process.yml
index 5cedb020fb..3b7e0589b0 100644
--- a/detections/endpoint/unified_messaging_service_spawning_a_process.yml
+++ b/detections/endpoint/unified_messaging_service_spawning_a_process.yml
@@ -1,11 +1,7 @@
-name: Unified Messaging Service Spawning a Process
-id: f1126df0-7bd5-11eb-988f-acde48001122
-version: 1
-date: '2021-03-02'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-03-02'
 description: This detection identifies Microsoft Exchange Server's Unified Messaging
   services, umworkerprocess.exe and umservice.exe, spawning a child process, indicating
   possible exploitation of CVE-2021-26857 vulnerability. The query filters out werfault.exe
@@ -15,6 +11,18 @@ description: This detection identifies Microsoft Exchange Server's Unified Messa
   processes. Identify any recent out of place file modifications. Review Exchange
   logs following Microsofts guide. To contain, perform egress filtering or restrict
   public access to Exchange. In final, patch the vulnerablity and monitor.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: f1126df0-7bd5-11eb-988f-acde48001122
+known_false_positives: Unknown. Tune out child processes as needed to limit volume
+  of false positives.
+name: Unified Messaging Service Spawning a Process
+references:
+- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
+- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
+- https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="umworkerprocess.exe"
   OR Processes.parent_process_name="UMService.exe" (Processes.process_name!="wermgr.exe"
@@ -22,16 +30,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `unified_messaging_service_spawning_a_process_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: Unknown. Tune out child processes as needed to limit volume
-  of false positives.
-references:
-- https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
-- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
-- https://blog.rapid7.com/2021/03/03/rapid7s-insightidr-enables-detection-and-response-to-microsoft-exchange-0-day/
 tags:
   analytic_story:
   - HAFNIUM Group
@@ -53,23 +51,26 @@ tags:
   - T1190
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/uninstall_app_using_msiexec.yml b/detections/endpoint/uninstall_app_using_msiexec.yml
index 83fa05eb28..f086b61d7b 100644
--- a/detections/endpoint/uninstall_app_using_msiexec.yml
+++ b/detections/endpoint/uninstall_app_using_msiexec.yml
@@ -1,28 +1,26 @@
-name: Uninstall App Using MsiExec
-id: 1fca2b28-f922-11eb-b2dd-acde48001122
-version: 1
-date: '2021-08-09'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-08-09'
 description: This search is to detect a suspicious un-installation of application
   using msiexec. This technique was seen in conti leak tool and script where it tries
   to uninstall AV product using this commandline. This commandline to uninstall product
   is not a common practice in enterprise network.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 1fca2b28-f922-11eb-b2dd-acde48001122
+known_false_positives: unknown.
+name: Uninstall App Using MsiExec
+references:
+- https://threadreaderapp.com/thread/1423361119926816776.html
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=msiexec.exe
   Processes.process= "* /qn *" Processes.process= "*/X*" Processes.process= "*REBOOT=*"
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uninstall_app_using_msiexec_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: unknown.
-references:
-- https://threadreaderapp.com/thread/1423361119926816776.html
 tags:
   analytic_story:
   - Ransomware
@@ -42,28 +40,29 @@ tags:
   - T1218
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: process name
     role:
     - Attacker
+    type: process name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.parent_process_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_id
   risk_score: 30
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml
index 2327a5c01f..867b2b1e7d 100644
--- a/detections/endpoint/unload_sysmon_filter_driver.yml
+++ b/detections/endpoint/unload_sysmon_filter_driver.yml
@@ -1,14 +1,20 @@
-name: Unload Sysmon Filter Driver
-id: c77162d3-f93c-45cc-80c8-22f665664g9f
-version: 3
-date: '2020-07-22'
 author: Bhavin Patel, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2020-07-22'
 description: Attackers often disable security tools to avoid detection. This search
   looks for the usage of process `fltMC.exe` to unload a Sysmon Driver that will stop
   sysmon from collecting the data.
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model. This search is also shipped with `unload_sysmon_filter_driver_filter` macro,
+  update this macro to filter out false positives.
+id: c77162d3-f93c-45cc-80c8-22f665664g9f
+known_false_positives: ''
+name: Unload Sysmon Filter Driver
+references: []
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
   as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fltMC.exe
   AND Processes.process=*unload* AND Processes.process=*SysmonDrv*  by Processes.process_name
@@ -16,14 +22,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
   |`unload_sysmon_filter_driver_filter`| table firstTime lastTime dest user count
   process_name process_id parent_process_name process'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model. This search is also shipped with `unload_sysmon_filter_driver_filter` macro,
-  update this macro to filter out false positives.
-known_false_positives: ''
-references: []
 tags:
   analytic_story:
   - Disabling Security Tools
@@ -48,22 +46,24 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.user
   risk_score: 45
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 3
diff --git a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
index a99d58f466..c0a42ab970 100644
--- a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
+++ b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml
@@ -1,10 +1,6 @@
-name: Unusual Number of Kerberos Service Tickets Requested
-id: eb3e6702-8936-11ec-98fe-acde48001122
-version: 1
-date: '2022-02-08'
 author: Mauricio Velazco, Splunk
-type: Anomaly
 datamodel: []
+date: '2022-02-08'
 description: 'The following hunting analytic leverages Kerberos Event 4769, A Kerberos
   service ticket was requested, to identify a potential kerberoasting attack against
   Active Directory networks. Kerberoasting allows an adversary to request kerberos
@@ -15,22 +11,24 @@ description: 'The following hunting analytic leverages Kerberos Event 4769, A Ke
   3-sigma statistical rule to identify an unusual number service ticket requests.
   To customize this analytic, users can try different combinations of the `bucket`
   span time and the calculation of the `upperBound` field.'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
+  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
+id: eb3e6702-8936-11ec-98fe-acde48001122
+known_false_positives: An single endpoint requesting a large number of kerberos service
+  tickets is not common behavior. Possible false positive scenarios include but are
+  not limited to vulnerability scanners, administration systems and missconfigured
+  systems.
+name: Unusual Number of Kerberos Service Tickets Requested
+references:
+- https://attack.mitre.org/techniques/T1558/003/
+- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting
 search: ' `wineventlog_security` EventCode=4769 Service_Name!="*$" Ticket_Encryption_Type=0x17
   | bucket span=2m _time | stats dc(Service_Name) AS unique_services values(Service_Name)
   as requested_services by _time, Client_Address | eventstats avg(unique_services)
   as comp_avg , stdev(unique_services) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3)
   | eval isOutlier=if(unique_services > 2 and unique_services >= upperBound, 1, 0)
   | search isOutlier=1 | `unusual_number_of_kerberos_service_tickets_requested_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  Domain Controller and Kerberos events. The Advanced Security Audit policy setting
-  `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
-known_false_positives: An single endpoint requesting a large number of kerberos service
-  tickets is not common behavior. Possible false positive scenarios include but are
-  not limited to vulnerability scanners, administration systems and missconfigured
-  systems.
-references:
-- https://attack.mitre.org/techniques/T1558/003/
-- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/t1208-kerberoasting
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
@@ -49,21 +47,20 @@ tags:
   - T1558.003
   observable:
   - name: Client_Address
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - EventCode
-  - Ticket_Options
-  - Ticket_Encryption_Type
-  - dest
-  - Service_Name
-  - service_id
   - Client_Address
+  - EventCode
+  - Service_Name
+  - Ticket_Encryption_Type
+  - _time
   risk_score: 36
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/user_discocvery_with_env_vars_powershell.yml b/detections/endpoint/user_discocvery_with_env_vars_powershell.yml
index b7fef38a56..a2746625e7 100644
--- a/detections/endpoint/user_discocvery_with_env_vars_powershell.yml
+++ b/detections/endpoint/user_discocvery_with_env_vars_powershell.yml
@@ -1,28 +1,26 @@
-name: User Discovery With Env Vars PowerShell
-id: 0cdf318b-a0dd-47d7-b257-c621c0247de8
-version: 1
-date: '2021-09-13'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-13'
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments that leverage PowerShell environment variables to identify the current
   logged user. Red Teams and adversaries may leverage this method to identify the
   logged user on a compromised endpoint for situational awareness and Active Directory
   Discovery.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 0cdf318b-a0dd-47d7-b257-c621c0247de8
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: User Discovery With Env Vars PowerShell
+references:
+- https://attack.mitre.org/techniques/T1033/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
   (Processes.process="*$env:UserName*" OR Processes.process="*[System.Environment]::UserName*")
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `user_discovery_with_env_vars_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1033/
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -42,25 +40,23 @@ tags:
   - T1033
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
index cfa68d3777..970b6da264 100644
--- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
+++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
@@ -1,25 +1,23 @@
-name: User Discovery With Env Vars PowerShell Script Block
-id: 77f41d9e-b8be-47e3-ab35-5776f5ec1d20
-version: 1
-date: '2021-09-13'
 author: Mauricio Velazco, Splunk
-type: Hunting
 datamodel: []
+date: '2021-09-13'
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the use of PowerShell environment variables to identify the current
   logged user. Red Teams and adversaries may leverage this method to identify the
   logged user on a compromised endpoint for situational awareness and Active Directory
   Discovery.
-search: '`powershell` EventCode=4104 (Message = "*$env:UserName*" OR Message = "*[System.Environment]::UserName*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `user_discovery_with_env_vars_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+id: 77f41d9e-b8be-47e3-ab35-5776f5ec1d20
 known_false_positives: Administrators or power users may use this PowerShell commandlet
   for troubleshooting.
+name: User Discovery With Env Vars PowerShell Script Block
 references:
 - https://attack.mitre.org/techniques/T1033/
+search: '`powershell` EventCode=4104 (Message = "*$env:UserName*" OR Message = "*[System.Environment]::UserName*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `user_discovery_with_env_vars_powershell_script_block_filter`'
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -39,20 +37,20 @@ tags:
   - T1033
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - Path
-  - Message
-  - OpCode
   - ComputerName
-  - User
   - EventCode
+  - Message
+  - User
+  - _time
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml
index d02e6ba8a7..37a6b6b8b6 100644
--- a/detections/endpoint/usn_journal_deletion.yml
+++ b/detections/endpoint/usn_journal_deletion.yml
@@ -1,28 +1,26 @@
-name: USN Journal Deletion
-id: b6e0ff70-b122-4227-9368-4cf322ab43c3
-version: 2
-date: '2018-12-03'
 author: David Dorsey, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2018-12-03'
 description: The fsutil.exe application is a legitimate Windows utility used to perform
   tasks related to the file allocation table (FAT) and NTFS file systems. The update
   sequence number (USN) change journal provides a log of all changes made to the files
   on the disk. This search looks for fsutil.exe deleting the USN journal.
+how_to_implement: You must be ingesting data that records process activity from your
+  hosts to populate the Endpoint data model in the Processes node. You must also be
+  ingesting logs with both the process name and command line from your endpoints.
+  The command-line arguments are mapped to the "process" field in the Endpoint data
+  model.
+id: b6e0ff70-b122-4227-9368-4cf322ab43c3
+known_false_positives: None identified
+name: USN Journal Deletion
+references: []
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=fsutil.exe
   by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
   `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | search process="*deletejournal*" AND process="*usn*" | `usn_journal_deletion_filter`'
-how_to_implement: You must be ingesting data that records process activity from your
-  hosts to populate the Endpoint data model in the Processes node. You must also be
-  ingesting logs with both the process name and command line from your endpoints.
-  The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
-known_false_positives: None identified
-references: []
 tags:
   analytic_story:
   - Windows Log Manipulation
@@ -53,22 +51,24 @@ tags:
   - PR.IP
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.dest
   risk_score: 45
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml
index a80dd8e2b8..690496832c 100644
--- a/detections/endpoint/vbscript_execution_using_wscript_app.yml
+++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml
@@ -1,16 +1,22 @@
-name: Vbscript Execution Using Wscript App
-id: 35159940-228f-11ec-8a49-acde48001122
-version: 1
-date: '2021-10-01'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-10-01'
 description: This analytic is to detect a suspicious wscript commandline to execute
   vbscript. This technique was seen in several malware to execute malicious vbs file
   using wscript application. commonly vbs script is associated to cscript process
   and this can be a technique to evade process parent child detections or even some
   av script emulation system.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 35159940-228f-11ec-8a49-acde48001122
+known_false_positives: unknown
+name: Vbscript Execution Using Wscript App
+references:
+- https://www.joesandbox.com/analysis/369332/0/html
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name
   = "wscript.exe" AND Processes.parent_process = "*//e:vbscript*") OR (Processes.process_name
@@ -18,14 +24,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process Processes.process_name Processes.process_id Processes.process
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `vbscript_execution_using_wscript_app_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: unknown
-references:
-- https://www.joesandbox.com/analysis/369332/0/html
 tags:
   analytic_story:
   - FIN7
@@ -46,31 +44,29 @@ tags:
   - T1059
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml
index 103b742d69..d8c4a3be74 100644
--- a/detections/endpoint/verclsid_clsid_execution.yml
+++ b/detections/endpoint/verclsid_clsid_execution.yml
@@ -1,16 +1,24 @@
-name: Verclsid CLSID Execution
-id: 61e9a56a-20fa-11ec-8ba3-acde48001122
-version: 1
-date: '2021-09-29'
 author: Teoderick Contreras, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-29'
 description: This analytic is to detect a possible abuse of verclsid to execute malicious
   file through generate CLSID. This process is a normal application of windows to
   verify the CLSID COM object before it is instantiated by Windows Explorer. This
   hunting query can be a good pivot point to analyze what is he CLSID or COM object
   pointing too to check if it is a valid application or not.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 61e9a56a-20fa-11ec-8ba3-acde48001122
+known_false_positives: windows can used this application for its normal COM object
+  validation.
+name: Verclsid CLSID Execution
+references:
+- https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5
+- https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.parent_process) as parent_process values(Processes.process_id)
   as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
@@ -19,16 +27,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.dest Processes.user Processes.parent_process_name Processes.parent_process
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `verclsid_clsid_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: windows can used this application for its normal COM object
-  validation.
-references:
-- https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5
-- https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
 tags:
   analytic_story:
   - Unusual Processes
@@ -49,29 +47,28 @@ tags:
   - T1218
   observable:
   - name: dest
+    role:
+    - Victim
     type: Hostname
-    role:
-    - Victim
   - name: user
-    type: user
     role:
     - Victim
+    type: user
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml
index 850cdb5cb6..af7d6b185c 100644
--- a/detections/endpoint/w3wp_spawning_shell.yml
+++ b/detections/endpoint/w3wp_spawning_shell.yml
@@ -1,11 +1,7 @@
-name: W3WP Spawning Shell
-id: 0f03423c-7c6a-11eb-bc47-acde48001122
-version: 2
-date: '2021-03-03'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-03-03'
 description: This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from
   W3WP.exe, or IIS. In addition to IIS logs, this behavior with an EDR product will
   capture potential webshell activity, similar to the HAFNIUM Group abusing CVEs,
@@ -14,25 +10,27 @@ description: This query identifies a shell, PowerShell.exe or Cmd.exe, spawning
   and any file modifications that may occur. Identify additional parallel process,
   child processes, that may highlight further commands executed. After triaging, work
   to contain the threat and patch the system that is vulnerable.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 0f03423c-7c6a-11eb-bc47-acde48001122
+known_false_positives: Baseline your environment before production. It is possible
+  build systems using IIS will spawn cmd.exe to perform a software build. Filter as
+  needed.
+name: W3WP Spawning Shell
+references:
+- https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/
+- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
+- https://www.youtube.com/watch?v=FC6iHw258RI
+- https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do
 search: '| tstats `security_content_summariesonly` count values(Processes.process_name)
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=w3wp.exe
   AND `process_cmd` OR `process_powershell` by Processes.dest Processes.parent_process
   Processes.original_file_name Processes.user | `drop_dm_object_name(Processes)` |
   `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `w3wp_spawning_shell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Baseline your environment before production. It is possible
-  build systems using IIS will spawn cmd.exe to perform a software build. Filter as
-  needed.
-references:
-- https://www.microsoft.com/security/blog/2020/02/04/ghost-in-the-shell-investigating-web-shell-attacks/
-- https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
-- https://www.youtube.com/watch?v=FC6iHw258RI
-- https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do
 tags:
   analytic_story:
   - HAFNIUM Group
@@ -58,27 +56,25 @@ tags:
   - T1505.003
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml
index 6f5715c80a..3f225a70a7 100644
--- a/detections/endpoint/wbadmin_delete_system_backups.yml
+++ b/detections/endpoint/wbadmin_delete_system_backups.yml
@@ -1,29 +1,27 @@
-name: WBAdmin Delete System Backups
-id: cd5aed7e-5cea-11eb-ae93-0242ac130002
-version: 1
-date: '2021-01-22'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-01-22'
 description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
   Tool) that delete backup files. This is typically used by ransomware to prevent
   recovery.
+how_to_implement: You must be ingesting endpoint data that tracks process activity,
+  including parent-child relationships from your endpoints to populate the Endpoint
+  data model in the Processes node. Tune based on parent process names.
+id: cd5aed7e-5cea-11eb-ae93-0242ac130002
+known_false_positives: Administrators may modify the boot configuration.
+name: WBAdmin Delete System Backups
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
+- https://thedfirreport.com/2020/10/08/ryuks-return/
+- https://attack.mitre.org/techniques/T1490/
+- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wbadmin.exe
   Processes.process="*delete*" AND (Processes.process="*catalog*" OR Processes.process="*systemstatebackup*")
   by Processes.process_name Processes.process Processes.parent_process_name Processes.dest
   Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`| `wbadmin_delete_system_backups_filter`'
-how_to_implement: You must be ingesting endpoint data that tracks process activity,
-  including parent-child relationships from your endpoints to populate the Endpoint
-  data model in the Processes node. Tune based on parent process names.
-known_false_positives: Administrators may modify the boot configuration.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
-- https://thedfirreport.com/2020/10/08/ryuks-return/
-- https://attack.mitre.org/techniques/T1490/
-- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
 tags:
   analytic_story:
   - Ryuk Ransomware
@@ -48,21 +46,23 @@ tags:
   - PR.IP
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.parent_process_name
-  - Processes.dest
-  - Processes.user
   risk_score: 15
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/wbemprox_com_object_execution.yml b/detections/endpoint/wbemprox_com_object_execution.yml
index 91f61b3952..1d86c6f3a5 100644
--- a/detections/endpoint/wbemprox_com_object_execution.yml
+++ b/detections/endpoint/wbemprox_com_object_execution.yml
@@ -1,27 +1,24 @@
-name: Wbemprox COM Object Execution
-id: 9d911ce0-c3be-11eb-b177-acde48001122
-version: 1
-date: '2021-06-02'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-06-02'
 description: this search is designed to detect potential malicious process loading
   COM object to wbemprox.dll,
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name and imageloaded executions from your endpoints. If you
+  are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+id: 9d911ce0-c3be-11eb-b177-acde48001122
+known_false_positives: legitimate process that are not in the exception list may trigger
+  this event.
+name: Wbemprox COM Object Execution
+references:
+- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
+- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
 search: '`sysmon` EventCode=7  ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll",
   "*\\wbemcomn.dll") NOT (process_name IN ("wmiprvse.exe", "WmiApSrv.exe", "unsecapp.exe"))
   NOT(Image IN("*\\windows\\*","*\\program files*", "*\\wbem\\*")) | stats count min(_time)
   as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode
   Signed ProcessId Hashes IMPHASH | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `wbemprox_com_object_execution_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name and imageloaded executions from your endpoints. If you
-  are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: legitimate process that are not in the exception list may trigger
-  this event.
-references:
-- https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/
-- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/
 tags:
   analytic_story:
   - Ransomware
@@ -42,9 +39,9 @@ tags:
   - T1218.003
   observable:
   - name: Computer
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -62,3 +59,5 @@ tags:
   - IMPHASH
   risk_score: 35
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml
index 4bd094af25..624687f523 100644
--- a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml
+++ b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml
@@ -1,11 +1,6 @@
-name: Wermgr Process Connecting To IP Check Web Services
-id: ed313326-a0f9-11eb-a89c-acde48001122
-version: 1
-date: '2021-04-19'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-04-19'
 description: this search is designed to detect suspicious wermgr.exe process that
   tries to connect to known IP web services. This technique is know for trickbot and
   other trojan spy malware to recon the infected machine and look for its ip address
@@ -13,6 +8,16 @@ description: this search is designed to detect suspicious wermgr.exe process tha
   for error handling process of windows it is really suspicious that this process
   is trying to connect to this IP web services cause that maybe cause of some malicious
   code injection.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, dns query name process path , and query ststus from
+  your endpoints like EventCode 22. If you are using Sysmon, you must have at least
+  version 12 of the Sysmon TA.
+id: ed313326-a0f9-11eb-a89c-acde48001122
+known_false_positives: unknown
+name: Wermgr Process Connecting To IP Check Web Services
+references:
+- https://labs.vipre.com/trickbot-and-its-modules/
+- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
 search: '`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfismyip.com",
   "*checkip.amazonaws.com", "*ipecho.net", "*ipinfo.io", "*api.ipify.org", "*icanhazip.com",
   "*ip.anysrc.com","*api.ip.sb", "ident.me", "www.myexternalip.com", "*zen.spamhaus.org",
@@ -20,14 +25,6 @@ search: '`sysmon` EventCode =22 process_name = wermgr.exe QueryName IN ("*wtfism
   |  stats  min(_time) as firstTime max(_time) as lastTime count by  process_path
   process_name process_id QueryName QueryStatus QueryResults Computer EventCode |
   `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wermgr_process_connecting_to_ip_check_web_services_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, dns query name process path , and query ststus from
-  your endpoints like EventCode 22. If you are using Sysmon, you must have at least
-  version 12 of the Sysmon TA.
-known_false_positives: unknown
-references:
-- https://labs.vipre.com/trickbot-and-its-modules/
-- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
 tags:
   analytic_story:
   - Trickbot
@@ -48,9 +45,9 @@ tags:
   - T1590.005
   observable:
   - name: ComputerName
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -67,3 +64,5 @@ tags:
   - EventCode
   risk_score: 56
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/wermgr_process_create_executable_file.yml b/detections/endpoint/wermgr_process_create_executable_file.yml
index dbcd1ec45c..522f736160 100644
--- a/detections/endpoint/wermgr_process_create_executable_file.yml
+++ b/detections/endpoint/wermgr_process_create_executable_file.yml
@@ -1,29 +1,26 @@
-name: Wermgr Process Create Executable File
-id: ab3bcce0-a105-11eb-973c-acde48001122
-version: 1
-date: '2021-04-19'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-04-19'
 description: this search is designed to detect potential malicious wermgr.exe process
   that drops or create executable file. Since wermgr.exe is an application trigger
   when error encountered in a process, it is really un ussual to this process to drop
   executable file. This technique is commonly seen in trickbot malware where it injects
   it code to this process to execute it malicious behavior like downloading other
   payload
-search: '`sysmon` EventCode=11 process_name = "wermgr.exe" TargetFilename = "*.exe"
-  | stats  min(_time) as firstTime max(_time) as lastTime count by  Image TargetFilename
-  process_name dest EventCode ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `wermgr_process_create_executable_file_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
   Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+id: ab3bcce0-a105-11eb-973c-acde48001122
 known_false_positives: unknown
+name: Wermgr Process Create Executable File
 references:
 - https://labs.vipre.com/trickbot-and-its-modules/
 - https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
+search: '`sysmon` EventCode=11 process_name = "wermgr.exe" TargetFilename = "*.exe"
+  | stats  min(_time) as firstTime max(_time) as lastTime count by  Image TargetFilename
+  process_name dest EventCode ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `wermgr_process_create_executable_file_filter`'
 tags:
   analytic_story:
   - Trickbot
@@ -42,9 +39,9 @@ tags:
   - T1027
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -59,3 +56,5 @@ tags:
   - ProcessId
   risk_score: 56
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
index 371cf2a000..1bacdc584c 100644
--- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
+++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml
@@ -1,15 +1,22 @@
-name: Wermgr Process Spawned CMD Or Powershell Process
-id: e8fc95bc-a107-11eb-a978-acde48001122
-version: 2
-date: '2021-04-19'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-04-19'
 description: This search is designed to detect suspicious cmd and powershell process
   spawned by wermgr.exe process. This suspicious behavior are commonly seen in code
   injection technique technique like trickbot to execute a shellcode, dll modules
   to run malicious behavior.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: e8fc95bc-a107-11eb-a978-acde48001122
+known_false_positives: unknown
+name: Wermgr Process Spawned CMD Or Powershell Process
+references:
+- https://labs.vipre.com/trickbot-and-its-modules/
+- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
 search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where Processes.parent_process_name = "wermgr.exe" `process_cmd` OR `process_powershell`
@@ -17,15 +24,6 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `wermgr_process_spawned_cmd_or_powershell_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: unknown
-references:
-- https://labs.vipre.com/trickbot-and-its-modules/
-- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
 tags:
   analytic_story:
   - Trickbot
@@ -44,27 +42,27 @@ tags:
   - T1059
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 56
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/wget_download_and_bash_execution.yml b/detections/endpoint/wget_download_and_bash_execution.yml
index 4d1a88f5dc..8932814903 100644
--- a/detections/endpoint/wget_download_and_bash_execution.yml
+++ b/detections/endpoint/wget_download_and_bash_execution.yml
@@ -1,14 +1,24 @@
-name: Wget Download and Bash Execution
-id: 35682718-5a85-11ec-b8f7-acde48001122
-version: 1
-date: '2021-12-11'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-11'
 description: The following analytic identifies the use of wget on Linux or MacOS attempting
   to download a file from a remote source and pipe it to bash. This is typically found
   with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is
+  occurring correctly. If the EDR is not parsing the pipe bash in the command-line,
+  modifying the analytic will be required. Add parent process name (Processes.parent_process_name)
+  as needed to filter.
+id: 35682718-5a85-11ec-b8f7-acde48001122
+known_false_positives: False positives should be limited, however filtering may be
+  required.
+name: Wget Download and Bash Execution
+references:
+- https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java
+- https://www.lunasec.io/docs/blog/log4j-zero-day/
+- https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wget
   (Processes.process="*-q *" OR Processes.process="*--quiet*"  AND Processes.process="*-O-
@@ -16,18 +26,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wget_download_and_bash_execution_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon for Linux, you will need to ensure mapping is
-  occurring correctly. If the EDR is not parsing the pipe bash in the command-line,
-  modifying the analytic will be required. Add parent process name (Processes.parent_process_name)
-  as needed to filter.
-known_false_positives: False positives should be limited, however filtering may be
-  required.
-references:
-- https://www.huntress.com/blog/rapid-response-critical-rce-vulnerability-is-affecting-java
-- https://www.lunasec.io/docs/blog/log4j-zero-day/
-- https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890
 tags:
   analytic_story:
   - Ingress Tool Transfer
@@ -49,32 +47,31 @@ tags:
   - T1105
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml
index a4dd560dc1..690605d714 100644
--- a/detections/endpoint/windows_adfind_exe.yml
+++ b/detections/endpoint/windows_adfind_exe.yml
@@ -1,17 +1,23 @@
-name: Windows AdFind Exe
-id: bd3b0187-189b-46c0-be45-f52da2bae67f
-version: 2
-date: '2021-11-03'
 author: Jose Hernandez, Bhavin Patel, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-03'
 description: 'This search looks for the execution of `adfind.exe` with command-line
   arguments that it uses by default. Specifically the filter or search functions.
   It also considers the arguments necessary like objectcategory, see readme for more
   details: https://www.joeware.net/freetools/tools/adfind/usage.htm. This has been
   seen used before by Wizard Spider, FIN6 and actors whom also launched SUNBURST.
   AdFind.exe is usually used a recon tool to enumare a domain controller.'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, and command-line executions from your endpoints. If
+  you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+id: bd3b0187-189b-46c0-be45-f52da2bae67f
+known_false_positives: administrators rarely use adfind, usually not used for legitimate
+  reasons
+name: Windows AdFind Exe
+references:
+- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
+- https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process="* -f *"
   OR Processes.process="* -b *") AND (Processes.process=*objectcategory* OR Processes.process="*
@@ -19,14 +25,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_adfind_exe_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, and command-line executions from your endpoints. If
-  you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: administrators rarely use adfind, usually not used for legitimate
-  reasons
-references:
-- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
-- https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html
 tags:
   analytic_story:
   - NOBELIUM Group
@@ -49,14 +47,16 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Processes.dest
-  - Processes.user
-  - Processes.process_name
-  - Processes.parent_process
-  - Processes.process_id
-  - Processes.parent_process_id
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
index 5f9705d849..8d23dffa73 100644
--- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml
+++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
@@ -1,11 +1,7 @@
-name: Windows Curl Download to Suspicious Path
-id: c32f091e-30db-11ec-8738-acde48001122
-version: 1
-date: '2021-10-19'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-10-19'
 description: 'The following analytic identifies the use of Windows Curl.exe downloading
   a file to a suspicious location. \
 
@@ -14,6 +10,19 @@ description: 'The following analytic identifies the use of Windows Curl.exe down
 
   During triage, review parallel processes for further behavior. In addition, identify
   if the download was successful. If a file was downloaded, capture and analyze.'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: c32f091e-30db-11ec-8738-acde48001122
+known_false_positives: It is possible Administrators or super users will use Curl
+  for legitimate purposes. Filter as needed.
+name: Windows Curl Download to Suspicious Path
+references:
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+- https://attack.mitre.org/techniques/T1105/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process
   IN ("*-O *","*--output*") Processes.process IN ("*\\appdata\\*","*\\programdata\\*","*\\public\\*")
@@ -21,17 +30,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_curl_download_to_suspicious_path_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: It is possible Administrators or super users will use Curl
-  for legitimate purposes. Filter as needed.
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
-- https://attack.mitre.org/techniques/T1105/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
 tags:
   analytic_story:
   - IceID
@@ -52,39 +50,38 @@ tags:
   - T1105
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml
index 65afeffe87..5d47af2022 100644
--- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml
+++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml
@@ -1,11 +1,7 @@
-name: Windows Curl Upload to Remote Destination
-id: 42f8f1a2-4228-11ec-aade-acde48001122
-version: 1
-date: '2021-11-10'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-10'
 description: 'The following analytic identifies the use of Windows Curl.exe uploading
   a file to a remote destination. \
 
@@ -24,23 +20,25 @@ description: 'The following analytic identifies the use of Windows Curl.exe uplo
   what they are attempting to upload (zip vs txt). During triage, review parallel
   processes for further behavior. In addition, identify if the upload was successful
   in network logs. If a file was uploaded, isolate the endpoint and review.'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 42f8f1a2-4228-11ec-aade-acde48001122
+known_false_positives: False positives may be limited to source control applications
+  and may be required to be filtered out.
+name: Windows Curl Upload to Remote Destination
+references:
+- https://everything.curl.dev/usingcurl/uploads
+- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
+- https://twitter.com/d1r4c/status/1279042657508081664?s=20
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process
   IN ("*-T *","*--upload-file *", "*-d *", "*--data *", "*-F *") by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_curl_upload_to_remote_destination_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives may be limited to source control applications
-  and may be required to be filtered out.
-references:
-- https://everything.curl.dev/usingcurl/uploads
-- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
-- https://twitter.com/d1r4c/status/1279042657508081664?s=20
 tags:
   analytic_story:
   - Ingress Tool Transfer
@@ -60,39 +58,38 @@ tags:
   - T1105
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml
index f3a273dcc7..f884498bcd 100644
--- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml
+++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml
@@ -1,17 +1,25 @@
-name: Windows Defender Exclusion Registry Entry
-id: 13395a44-4dd9-11ec-9df7-acde48001122
-version: 1
-date: '2021-11-25'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2021-11-25'
 description: This analytic will detect a suspicious process that modify a registry
   related to windows defender exclusion feature. This registry is abused by adversaries,
   malware author and red teams to bypassed Windows Defender Anti-Virus product by
   excluding folder path, file path, process, extensions and etc. from its real time
   or schedule scan to execute their malicious code. This is a good indicator for a
   defense evasion and to look further for events after this behavior.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: 13395a44-4dd9-11ec-9df7-acde48001122
+known_false_positives: admin or user may choose to use this windows features.
+name: Windows Defender Exclusion Registry Entry
+references:
+- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
+- https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_path = "*\\SOFTWARE\\Policies\\Microsoft\\Windows
   Defender\\Exclusions\\*" by _time span=1h Registry.dest Registry.user Registry.registry_path
@@ -25,15 +33,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name
   parent_process process_name process_path process proc_guid registry_path registry_value_name
   registry_value_data | `windows_defender_exclusion_registry_entry_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: admin or user may choose to use this windows features.
-references:
-- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
-- https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Remcos
@@ -54,26 +53,35 @@ tags:
   - T1562
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.user
-  - Registry.dest
-  - Registry.registry_value_name
-  - Registry.registry_value_data
   risk_score: 64
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml
index 8919734d8e..887be771cb 100644
--- a/detections/endpoint/windows_disable_memory_crash_dump.yml
+++ b/detections/endpoint/windows_disable_memory_crash_dump.yml
@@ -1,17 +1,24 @@
-name: Windows Disable Memory Crash Dump
-id: 59e54602-9680-11ec-a8a6-acde48001122
-version: 1
-date: '2022-02-25'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-02-25'
 description: The following analytic identifies a process that is attempting to disable
   the ability on Windows to generate a memory crash dump. This was recently identified
   being utilized by HermeticWiper. To disable crash dumps, the value must be set to
   0. This feature is typically modified to perform a memory crash dump when a computer
   stops unexpectedly because of a Stop error (also known as a blue screen, system
   crash, or bug check).
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` and `Registry`
+  node.
+id: 59e54602-9680-11ec-a8a6-acde48001122
+known_false_positives: unknown
+name: Windows Disable Memory Crash Dump
+references:
+- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
+- https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry
   where (Registry.registry_path="*\\CurrentControlSet\\Control\\CrashControl\\CrashDumpEnabled")
   AND Registry.registry_value_data="0x00000000" by _time span=1h Registry.dest Registry.user
@@ -25,14 +32,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   registry_value_data registry_key_name] | table _time dest user parent_process_name
   parent_process process_name process_path process process_guid registry_path registry_value_name
   registry_value_data registry_key_name | `windows_disable_memory_crash_dump_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the Filesystem responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Filesystem` and `Registry`
-  node.
-known_false_positives: unknown
-references:
-- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
-- https://docs.microsoft.com/en-us/troubleshoot/windows-server/performance/memory-dump-file-options
 tags:
   analytic_story:
   - Data Destruction
@@ -60,39 +59,42 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Filesystem.file_create_time
-  - Filesystem.process_id
-  - Filesystem.file_name
-  - Filesystem.user
-  - Filesystem.file_path
-  - Filesystem.dest
-  - Processes.process_id
-  - Processes.process_name
-  - Processes.process
-  - Processes.dest
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_guid
   risk_score: 90
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml
index 62174a5077..76806b949e 100644
--- a/detections/endpoint/windows_disableantispyware_reg.yml
+++ b/detections/endpoint/windows_disableantispyware_reg.yml
@@ -1,31 +1,29 @@
-name: Windows DisableAntiSpyware Registry
-id: 23150a40-9301-4195-b802-5bb4f43067fb
-version: 2
-date: '2021-03-02'
 author: Rod Soto, Jose Hernandez, Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Registry
+date: '2021-03-02'
 description: The search looks for the Registry Key DisableAntiSpyware set to disable.
   This is consistent with Ryuk infections across a fleet of endpoints. This particular
   behavior is typically executed when an ransomware actor gains access to an endpoint
   and beings to perform execution. Usually, a batch (.bat) will be executed and multiple
   registry and scheduled task modifications will occur. During triage, review parallel
   processes and identify any further file modifications. Endpoint should be isolated.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node.
+id: 23150a40-9301-4195-b802-5bb4f43067fb
+known_false_positives: It is unusual to turn this feature off a Windows system since
+  it is a default security control, although it is not rare for some policies to disable
+  it. Although no false positives have been identified, use the provided filter macro
+  to tune the search.
+name: Windows DisableAntiSpyware Registry
+references:
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Registry where Registry.registry_value_name="DisableAntiSpyware"
   AND Registry.registry_value_data="0x00000001" by Registry.dest Registry.user Registry.registry_path
   Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)`
   | `security_content_ctime(firstTime)` | `windows_disableantispyware_registry_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node.
-known_false_positives: It is unusual to turn this feature off a Windows system since
-  it is a default security control, although it is not rare for some policies to disable
-  it. Although no false positives have been identified, use the provided filter macro
-  to tune the search.
-references:
-- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
 tags:
   analytic_story:
   - Ryuk Ransomware
@@ -52,21 +50,23 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
-  - Registry.user
-  - Registry.registry_path
   risk_score: 24
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/windows_diskcryptor_usage.yml b/detections/endpoint/windows_diskcryptor_usage.yml
index 930e28b5db..4029b33314 100644
--- a/detections/endpoint/windows_diskcryptor_usage.yml
+++ b/detections/endpoint/windows_diskcryptor_usage.yml
@@ -1,33 +1,31 @@
-name: Windows DiskCryptor Usage
-id: d56fe0c8-4650-11ec-a8fa-acde48001122
-version: 1
-date: '2021-11-15'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-15'
 description: The following analytic identifies DiskCryptor  process name of dcrypt.exe
   or internal name dcinst.exe. This utility has been utilized by adversaries to encrypt
   disks manually during an operation. In addition, during install, a dcrypt.sys driver
   is installed and requires a reboot in order to take effect. There are no command-line
   arguments used.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: d56fe0c8-4650-11ec-a8fa-acde48001122
+known_false_positives: It is possible false positives may be present based on the
+  internal name dcinst.exe, filter as needed. It may be worthy to alert on the service
+  name.
+name: Windows DiskCryptor Usage
+references:
+- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
+- https://github.com/DavidXanatos/DiskCryptor
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dcrypt.exe"
   OR Processes.original_file_name=dcinst.exe) by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_diskcryptor_usage_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: It is possible false positives may be present based on the
-  internal name dcinst.exe, filter as needed. It may be worthy to alert on the service
-  name.
-references:
-- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
-- https://github.com/DavidXanatos/DiskCryptor
 tags:
   analytic_story:
   - Ransomware
@@ -47,37 +45,36 @@ tags:
   - T1486
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 35
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/windows_diskshadow_proxy_execution.yml b/detections/endpoint/windows_diskshadow_proxy_execution.yml
index e14b14e20f..0923671d7a 100644
--- a/detections/endpoint/windows_diskshadow_proxy_execution.yml
+++ b/detections/endpoint/windows_diskshadow_proxy_execution.yml
@@ -1,33 +1,31 @@
-name: Windows Diskshadow Proxy Execution
-id: 58adae9e-8ea3-11ec-90f6-acde48001122
-version: 1
-date: '2022-02-15'
 author: Lou Stella, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-02-15'
 description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server.
   It has a scripting mode intended for complex scripted backup operations. This feature
   also allows for execution of arbitrary unsigned code. This analytic looks for the
   usage of the scripting mode flags in executions of DiskShadow. During triage, compare
   to known backup behavior in your environment and then review the scripts called
   by diskshadow.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on processes that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,confirm
+  the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint
+  product.
+id: 58adae9e-8ea3-11ec-90f6-acde48001122
+known_false_positives: Administrators using the DiskShadow tool in their infrastructure
+  as a main backup tool with scripts will cause false positives that can be filtered
+  with `windows_diskshadow_proxy_execution_filter`
+name: Windows Diskshadow Proxy Execution
+references:
+- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_diskshadow` (Processes.process=*-s*
   OR Processes.process=*/s*) by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_diskshadow_proxy_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on processes that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,confirm
-  the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint
-  product.
-known_false_positives: Administrators using the DiskShadow tool in their infrastructure
-  as a main backup tool with scripts will cause false positives that can be filtered
-  with `windows_diskshadow_proxy_execution_filter`
-references:
-- https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
 tags:
   analytic_story:
   - Living Off The Land
@@ -49,22 +47,23 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process
-  - Porcesses.dest
-  - Processes.user
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process_id
-  - Processes.parent_process_id
-  - Processes.original_file_name
   risk_score: 49
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml
index 9cc4c5bafe..86681426f1 100644
--- a/detections/endpoint/windows_dism_remove_defender.yml
+++ b/detections/endpoint/windows_dism_remove_defender.yml
@@ -1,14 +1,21 @@
-name: Windows DISM Remove Defender
-id: 8567da9e-47f0-11ec-99a9-acde48001122
-version: 1
-date: '2021-11-17'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-17'
 description: The following analytic identifies the use of the Windows Disk Image Utility,
   `dism.exe`, to remove Windows Defender. Adversaries may use `dism.exe` to disable
   Defender before completing their objective.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 8567da9e-47f0-11ec-99a9-acde48001122
+known_false_positives: Some legitimate administrative tools leverage `dism.exe` to
+  manipulate packages and features of the operating system. Filter as needed.
+name: Windows DISM Remove Defender
+references:
+- https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dism.exe
   (Processes.process="*/online*" AND Processes.process="*/disable-feature*" AND Processes.process="*Windows-Defender*"
@@ -16,15 +23,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_dism_remove_defender_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Some legitimate administrative tools leverage `dism.exe` to
-  manipulate packages and features of the operating system. Filter as needed.
-references:
-- https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -45,39 +43,38 @@ tags:
   - T1562
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: access
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
index cb6ed79777..23dca36f40 100644
--- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
+++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml
@@ -1,11 +1,7 @@
-name: Windows DotNet Binary in Non Standard Path
-id: fddf3b56-7933-11ec-98a6-acde48001122
-version: 1
-date: '2022-01-19'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-01-19'
 description: The following analytic identifies native .net binaries within the Windows
   operating system that may be abused by adversaries by moving it to a new directory.
   The analytic identifies the .net binary by using a lookup and compares the process
@@ -14,6 +10,21 @@ description: The following analytic identifies native .net binaries within the W
   name. if one or the other matches an alert will be generated. Adversaries abuse
   these binaries as they are native to windows and native DotNet. Note that not all
   SDK (post install of Windows) are captured in the lookup.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: fddf3b56-7933-11ec-98a6-acde48001122
+known_false_positives: False positives may be present and filtering may be required.
+  Certain utilities will run from non-standard paths based on the third-party application
+  in use.
+name: Windows DotNet Binary in Non Standard Path
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
+- https://attack.mitre.org/techniques/T1036/003/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Processes where NOT (Processes.process_path
   IN ("*\\Windows\\ADWS\\*","*\\Windows\\SysWOW64*", "*\\Windows\\system32*", "*\\Windows\\NetworkController\\*",
@@ -22,19 +33,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process_path Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `is_net_windows_file` | `windows_dotnet_binary_in_non_standard_path_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives may be present and filtering may be required.
-  Certain utilities will run from non-standard paths based on the third-party application
-  in use.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
-- https://attack.mitre.org/techniques/T1036/003/
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
 tags:
   analytic_story:
   - Masquerading - Rename System Utilities
@@ -61,39 +59,39 @@ tags:
   - T1218.004
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_event_for_service_disabled.yml b/detections/endpoint/windows_event_for_service_disabled.yml
index 58405c141f..84d9c4d22d 100644
--- a/detections/endpoint/windows_event_for_service_disabled.yml
+++ b/detections/endpoint/windows_event_for_service_disabled.yml
@@ -1,26 +1,23 @@
-name: Windows Event For Service Disabled
-id: 9c2620a8-94a1-11ec-b40c-acde48001122
-version: 1
-date: '2022-02-23'
 author: Teoderick Contreras, Splunk
-type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
+date: '2022-02-23'
 description: This analytic will identify suspicious system event of services that
   was modified from start to disabled. This technique is seen where the adversary
   attempts to disable security app services, other malware services to evade the defense
   systems on the compromised host
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the Service name, Service File Name Service Start type, and Service Type
+  from your endpoints.
+id: 9c2620a8-94a1-11ec-b40c-acde48001122
+known_false_positives: Windows service update may cause this event. In that scenario,
+  filtering is needed.
+name: Windows Event For Service Disabled
+references:
+- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
 search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from
   demand start to disabled." | stats count min(_time) as firstTime max(_time) as lastTime
   by ComputerName EventCode Message User Sid | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_event_for_service_disabled_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the Service name, Service File Name Service Start type, and Service Type
-  from your endpoints.
-known_false_positives: Windows service update may cause this event. In that scenario,
-  filtering is needed.
-references:
-- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -45,9 +42,9 @@ tags:
   - DE.CM
   observable:
   - name: ComputerName
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -61,3 +58,5 @@ tags:
   - Sid
   risk_score: 36
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/windows_excessive_disabled_services_event.yml b/detections/endpoint/windows_excessive_disabled_services_event.yml
index 35816e80a5..06cc0eea8b 100644
--- a/detections/endpoint/windows_excessive_disabled_services_event.yml
+++ b/detections/endpoint/windows_excessive_disabled_services_event.yml
@@ -1,11 +1,6 @@
-name: Windows Excessive Disabled Services Event
-id: c3f85976-94a5-11ec-9a58-acde48001122
-version: 1
-date: '2022-02-23'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2022-02-23'
 description: This analytic will identify suspicious excessive number of system events
   of services that was modified from start to disabled. This technique is seen where
   the adversary attempts to disable security app services, other malware services
@@ -13,17 +8,19 @@ description: This analytic will identify suspicious excessive number of system e
   system. One good example for this scenario is Olympic destroyer where it disable
   all active services in the compromised host as part of its destructive impact and
   defense evasion.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the Service name, Service File Name Service Start type, and Service Type
+  from your endpoints.
+id: c3f85976-94a5-11ec-9a58-acde48001122
+known_false_positives: Unknown
+name: Windows Excessive Disabled Services Event
+references:
+- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
 search: '`wineventlog_system` EventCode=7040 Message = "*service was changed from
   demand start to disabled." | stats count values(Message) as MessageList dc(Message)
   as MessageCount min(_time) as firstTime max(_time) as lastTime by ComputerName EventCode  User
   Sid | where MessageCount >=10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_excessive_disabled_services_event_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the Service name, Service File Name Service Start type, and Service Type
-  from your endpoints.
-known_false_positives: Unknown
-references:
-- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -48,9 +45,9 @@ tags:
   - DE.CM
   observable:
   - name: ComputerName
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -64,3 +61,5 @@ tags:
   - Sid
   risk_score: 81
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml
index 971856d53c..6ca742574e 100644
--- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml
+++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml
@@ -1,17 +1,22 @@
-name: Windows File Without Extension In Critical Folder
-id: 0dbcac64-963c-11ec-bf04-acde48001122
-version: 1
-date: '2022-02-25'
 author: Teoderick Contreras, Bhavin Patel, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Filesystem
+- Endpoint.Processes
+date: '2022-02-25'
 description: This analytic is to look for suspicious file creation in the critical
   folder like "System32\Drivers" folder without file extension. This artifacts was
   seen in latest hermeticwiper where it drops its driver component in Driver Directory
   both the compressed(without file extension) and the actual driver component (with
   .sys file extension). This TTP is really a good indication that a host might be
   compromised by this destructive malware that wipes the boot sector of the system.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
+id: 0dbcac64-963c-11ec-bf04-acde48001122
+known_false_positives: Unknown at this point
+name: Windows File Without Extension In Critical Folder
+references:
+- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem
   where Filesystem.file_path IN ("*\\System32\\drivers\\*", "*\\syswow64\\drivers\\*")
   by _time span=5m Filesystem.dest Filesystem.user Filesystem.file_name Filesystem.file_path
@@ -23,12 +28,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   as lastTime by dest process_name process_guid file_name file_path file_create_time
   user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_file_without_extension_in_critical_folder_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the Filesystem responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
-known_false_positives: Unknown at this point
-references:
-- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
 tags:
   analytic_story:
   - Data Destruction
@@ -54,24 +53,26 @@ tags:
   - DE.CM
   observable:
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Filesystem.dest
+  - Endpoint.Filesystem.file_create_time
+  - Endpoint.Filesystem.file_name
+  - Endpoint.Filesystem.file_path
+  - Endpoint.Filesystem.process_guid
+  - Endpoint.Filesystem.user
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Filesystem.file_create_time
-  - Filesystem.process_id
-  - Filesystem.file_name
-  - Filesystem.user
-  - Filesystem.file_path
-  - Filesystem.dest
-  - Processes.process_name
-  - Processes.dest
-  - Processes.process_guid
-  - Processes.user
   risk_score: 90
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_high_file_deletion_frequency.yml b/detections/endpoint/windows_high_file_deletion_frequency.yml
index 046a58314f..adc6b5a9cf 100644
--- a/detections/endpoint/windows_high_file_deletion_frequency.yml
+++ b/detections/endpoint/windows_high_file_deletion_frequency.yml
@@ -1,15 +1,20 @@
-name: Windows High File Deletion Frequency
-id: 45b125c4-866f-11eb-a95a-acde48001122
-version: 1
-date: '2021-03-16'
 author: Teoderick Contreras
-type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-03-16'
 description: This search looks for high frequency of file deletion relative to process
   name and process id. These events usually happen when the ransomware tries to encrypt
   the files with the ransomware file extensions and sysmon treat the original files
   to be deleted as soon it was replace as encrypted data.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the deleted target file name, process name and process id  from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+id: 45b125c4-866f-11eb-a95a-acde48001122
+known_false_positives: user may delete bunch of pictures or files in a folder.
+name: Windows High File Deletion Frequency
+references:
+- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
+- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 search: '`sysmon` EventCode=23 TargetFilename IN ("*.cmd", "*.ini","*.gif", "*.jpg",
   "*.jpeg", "*.db", "*.ps1", "*.doc*", "*.xls*", "*.ppt*", "*.bmp","*.zip", "*.rar",
   "*.7z", "*.chm", "*.png", "*.log", "*.vbs", "*.js", "*.vhd", "*.bak", "*.wbcat",
@@ -17,14 +22,6 @@ search: '`sysmon` EventCode=23 TargetFilename IN ("*.cmd", "*.ini","*.gif", "*.j
   min(_time) as firstTime max(_time) as lastTime count by Computer user EventCode
   Image ProcessID |where count >=100 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_high_file_deletion_frequency_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the deleted target file name, process name and process id  from your endpoints.
-  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: user may delete bunch of pictures or files in a folder.
-references:
-- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
-- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Clop Ransomware
@@ -44,17 +41,17 @@ tags:
   - T1485
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: Computer
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: deleted_files
-    type: File Name
     role:
     - Target
+    type: File Name
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -69,3 +66,5 @@ tags:
   - _time
   risk_score: 72
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml
index 3fb5c0f1e1..42236e0978 100644
--- a/detections/endpoint/windows_installutil_credential_theft.yml
+++ b/detections/endpoint/windows_installutil_credential_theft.yml
@@ -1,11 +1,6 @@
-name: Windows InstallUtil Credential Theft
-id: ccfeddec-43ec-11ec-b494-acde48001122
-version: 1
-date: '2021-11-12'
 author: Michael Haag, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-11-12'
 description: 'The following analytic identifies the Windows InstallUtil.exe binary
   loading `vaultcli.dll` and Samlib.dll`. This technique may be used to execute code
   to bypassing application control and capture credentials by utilizing a tool like
@@ -21,18 +16,20 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina
 
   During triage review resulting network connections, file modifications, and parallel
   processes. Capture any artifacts and review further.'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and module loads from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+id: ccfeddec-43ec-11ec-b494-acde48001122
+known_false_positives: Typically this will not trigger as by it's very nature InstallUtil
+  does not need credentials. Filter as needed.
+name: Windows InstallUtil Credential Theft
+references:
+- https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0
 search: '`sysmon` EventCode=7  process_name=installutil.exe ImageLoaded IN ("*\\samlib.dll",
   "*\\vaultcli.dll") | stats count min(_time) as firstTime max(_time) as lastTime
   by Computer, process_name, ImageLoaded, OriginalFileName, process_id | rename Computer
   as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_installutil_credential_theft_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and module loads from your endpoints.
-  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: Typically this will not trigger as by it's very nature InstallUtil
-  does not need credentials. Filter as needed.
-references:
-- https://gist.github.com/xorrior/bbac3919ca2aef8d924bdf3b16cce3d0
 tags:
   analytic_story:
   - Signed Binary Proxy Execution InstallUtil
@@ -55,39 +52,30 @@ tags:
   - T1218
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml
index 1179c42ae8..ab9f70ca91 100644
--- a/detections/endpoint/windows_installutil_in_non_standard_path.yml
+++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml
@@ -1,14 +1,25 @@
-name: Windows InstallUtil in Non Standard Path
-id: dcf74b22-7933-11ec-857c-acde48001122
-version: 1
-date: '2022-01-19'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-01-19'
 description: The following analytic identifies the Windows binary InstallUtil.exe
   running from a non-standard location. The analytic utilizes a macro for InstallUtil
   and identifies both the process_name and original_file_name.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: dcf74b22-7933-11ec-857c-acde48001122
+known_false_positives: False positives may be present and filtering may be required.
+  Certain utilities will run from non-standard paths based on the third-party application
+  in use.
+name: Windows InstallUtil in Non Standard Path
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
+- https://attack.mitre.org/techniques/T1036/003/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Processes where `process_installutil` NOT (Processes.process_path
   IN ("*\\Windows\\ADWS\\*","*\\Windows\\SysWOW64*", "*\\Windows\\system32*", "*\\Windows\\NetworkController\\*",
@@ -17,19 +28,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.original_file_name Processes.process_id Processes.parent_process_id Processes.process_hash
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `windows_installutil_in_non_standard_path_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives may be present and filtering may be required.
-  Certain utilities will run from non-standard paths based on the third-party application
-  in use.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
-- https://attack.mitre.org/techniques/T1036/003/
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
 tags:
   analytic_story:
   - Masquerading - Rename System Utilities
@@ -56,39 +54,40 @@ tags:
   - T1218.004
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_hash
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml
index 74868751a9..0baedff7a2 100644
--- a/detections/endpoint/windows_installutil_remote_network_connection.yml
+++ b/detections/endpoint/windows_installutil_remote_network_connection.yml
@@ -1,11 +1,8 @@
-name: Windows InstallUtil Remote Network Connection
-id: 4fbf9270-43da-11ec-9486-acde48001122
-version: 1
-date: '2021-11-12'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Ports
+- Endpoint.Processes
+date: '2021-11-12'
 description: 'The following analytic identifies the Windows InstallUtil.exe binary
   making a remote network connection. This technique may be used to download and execute
   code while bypassing application control. \
@@ -20,6 +17,18 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina
 
   During triage review resulting network connections, file modifications, and parallel
   processes. Capture any artifacts and review further.'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node.
+  In addition, confirm the latest CIM App 4.20 or higher is installed and the latest
+  TA for the endpoint product.
+id: 4fbf9270-43da-11ec-9486-acde48001122
+known_false_positives: Limited false positives should be present as InstallUtil is
+  not typically used to download remote files. Filter as needed based on Developers
+  requirements.
+name: Windows InstallUtil Remote Network Connection
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where `process_installutil` by _time span=1h  Processes.process_guid Processes.process_name
   Processes.dest Processes.process_path Processes.process Processes.parent_process_name
@@ -29,16 +38,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename  dest as connection_to_CNC]
   | table _time dest parent_process_name process_name process_path process process_guid
   connection_to_CNC dest_port | `windows_installutil_remote_network_connection_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node.
-  In addition, confirm the latest CIM App 4.20 or higher is installed and the latest
-  TA for the endpoint product.
-known_false_positives: Limited false positives should be present as InstallUtil is
-  not typically used to download remote files. Filter as needed based on Developers
-  requirements.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
 tags:
   analytic_story:
   - Signed Binary Proxy Execution InstallUtil
@@ -60,40 +59,38 @@ tags:
   - T1218
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Ports.dest
+  - Endpoint.Ports.dest_port
+  - Endpoint.Ports.process_guid
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  - Ports.process_guid
-  - Ports.dest
-  - Ports.dest_port
   risk_score: 80
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml
index 98a9002831..a11494676b 100644
--- a/detections/endpoint/windows_installutil_uninstall_option.yml
+++ b/detections/endpoint/windows_installutil_uninstall_option.yml
@@ -1,11 +1,7 @@
-name: Windows InstallUtil Uninstall Option
-id: cfa7b9ac-43f0-11ec-9b48-acde48001122
-version: 1
-date: '2021-11-12'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-12'
 description: 'The following analytic identifies the Windows InstallUtil.exe binary.
   This will execute code while bypassing application control using the `/u` (uninstall)
   switch. \
@@ -24,23 +20,25 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina
 
   During triage review resulting network connections, file modifications, and parallel
   processes. Capture any artifacts and review further.'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: cfa7b9ac-43f0-11ec-9b48-acde48001122
+known_false_positives: Limited false positives should be present. Filter as needed
+  by parent process or application.
+name: Windows InstallUtil Uninstall Option
+references:
+- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12
+- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_installutil` Processes.process
   IN ("*/u*", "*uninstall*") by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_installutil_uninstall_option_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives should be present. Filter as needed
-  by parent process or application.
-references:
-- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12
-- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
 tags:
   analytic_story:
   - Signed Binary Proxy Execution InstallUtil
@@ -62,39 +60,38 @@ tags:
   - T1218
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml
index 039a92f7d1..aebdfad03e 100644
--- a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml
+++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml
@@ -1,11 +1,8 @@
-name: Windows InstallUtil Uninstall Option with Network
-id: 1a52c836-43ef-11ec-a36c-acde48001122
-version: 1
-date: '2021-11-12'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Ports
+- Endpoint.Processes
+date: '2021-11-12'
 description: 'The following analytic identifies the Windows InstallUtil.exe binary
   making a remote network connection. This technique may be used to download and execute
   code while bypassing application control using the `/u` (uninstall) switch. \
@@ -24,6 +21,20 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina
 
   During triage review resulting network connections, file modifications, and parallel
   processes. Capture any artifacts and review further.'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node.
+  In addition, confirm the latest CIM App 4.20 or higher is installed and the latest
+  TA for the endpoint product.
+id: 1a52c836-43ef-11ec-a36c-acde48001122
+known_false_positives: Limited false positives should be present as InstallUtil is
+  not typically used to download remote files. Filter as needed based on Developers
+  requirements.
+name: Windows InstallUtil Uninstall Option with Network
+references:
+- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12
+- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time
   span=1h  Processes.process_guid Processes.process_name Processes.dest Processes.process_path
@@ -34,18 +45,6 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   | rename  dest as connection_to_CNC] | table _time dest parent_process_name process_name
   original_file_name process_path process process_guid connection_to_CNC dest_port
   | `windows_installutil_uninstall_option_with_network_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node.
-  In addition, confirm the latest CIM App 4.20 or higher is installed and the latest
-  TA for the endpoint product.
-known_false_positives: Limited false positives should be present as InstallUtil is
-  not typically used to download remote files. Filter as needed based on Developers
-  requirements.
-references:
-- https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html#menu_index_12
-- https://github.com/api0cradle/UltimateAppLockerByPassList/blob/master/md/Installutil.exe.md
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
 tags:
   analytic_story:
   - Signed Binary Proxy Execution InstallUtil
@@ -67,40 +66,37 @@ tags:
   - T1218
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Ports.dest
+  - Endpoint.Ports.dest_port
+  - Endpoint.Ports.process_guid
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  - Ports.process_guid
-  - Ports.dest
-  - Ports.dest_port
   risk_score: 80
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_installutil_url_in_command_line.yml b/detections/endpoint/windows_installutil_url_in_command_line.yml
index b6958ef7af..384fea0923 100644
--- a/detections/endpoint/windows_installutil_url_in_command_line.yml
+++ b/detections/endpoint/windows_installutil_url_in_command_line.yml
@@ -1,11 +1,7 @@
-name: Windows InstallUtil URL in Command Line
-id: 28e06670-43df-11ec-a569-acde48001122
-version: 1
-date: '2021-11-12'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-12'
 description: 'The following analytic identifies the Windows InstallUtil.exe binary
   passing a HTTP request on the command-line. This technique may be used to download
   and execute code while bypassing application control. \
@@ -20,23 +16,25 @@ description: 'The following analytic identifies the Windows InstallUtil.exe bina
 
   During triage review resulting network connections, file modifications, and parallel
   processes. Capture any artifacts and review further.'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 28e06670-43df-11ec-a569-acde48001122
+known_false_positives: Limited false positives should be present as InstallUtil is
+  not typically used to download remote files. Filter as needed based on Developers
+  requirements.
+name: Windows InstallUtil URL in Command Line
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
+- https://gist.github.com/DanielRTeixeira/0fd06ec8f041f34a32bf5623c6dd479d
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_installutil` Processes.process
   IN ("*http://*","*https://*") by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_installutil_url_in_command_line_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Limited false positives should be present as InstallUtil is
-  not typically used to download remote files. Filter as needed based on Developers
-  requirements.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
-- https://gist.github.com/DanielRTeixeira/0fd06ec8f041f34a32bf5623c6dd479d
 tags:
   analytic_story:
   - Signed Binary Proxy Execution InstallUtil
@@ -58,39 +56,38 @@ tags:
   - T1218
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml
index cfc476d77f..8210f23ebb 100644
--- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml
+++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml
@@ -1,11 +1,8 @@
-name: Windows Modify Show Compress Color And Info Tip Registry
-id: b7548c2e-9a10-11ec-99e3-acde48001122
-version: 1
-date: '2022-03-02'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-03-02'
 description: This analytic is to look for suspicious registry modification related
   to file compression color and information tips. This IOC was seen in hermetic wiper
   where it has a thread that will create this registry entry to change the color of
@@ -13,6 +10,14 @@ description: This analytic is to look for suspicious registry modification relat
   tips. This is a good indicator that a process tries to modified one of the registry
   GlobalFolderOptions related to file compression attribution in terms of color in
   NTFS file system.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the Filesystem responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
+id: b7548c2e-9a10-11ec-99e3-acde48001122
+known_false_positives: unknown
+name: Windows Modify Show Compress Color And Info Tip Registry
+references:
+- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path = "*\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced*"
   AND Registry.registry_value_name  IN("ShowCompColor", "ShowInfoTip") by _time span=1h
@@ -26,12 +31,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `windows_modify_show_compress_color_and_info_tip_registry_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the Filesystem responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` and `Registry` node.
-known_false_positives: unknown
-references:
-- https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -56,18 +55,29 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.registry_value_name
-  - Registry.dest Registry.user
   risk_score: 25
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml
index 15669cf7d5..bb44437e09 100644
--- a/detections/endpoint/windows_nirsoft_advancedrun.yml
+++ b/detections/endpoint/windows_nirsoft_advancedrun.yml
@@ -1,16 +1,24 @@
-name: Windows NirSoft AdvancedRun
-id: bb4f3090-7ae4-11ec-897f-acde48001122
-version: 1
-date: '2022-01-21'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-01-21'
 description: The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe
   has similar capabilities as other remote programs like psexec. AdvancedRun may also
   ingest a configuration file with all settings defined and perform its activity.
   The analytic is written in a way to identify a renamed binary and also the common
   command-line arguments.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: bb4f3090-7ae4-11ec-897f-acde48001122
+known_false_positives: False positives should be limited as it is specific to AdvancedRun.
+  Filter as needed based on legitimate usage.
+name: Windows NirSoft AdvancedRun
+references:
+- http://www.nirsoft.net/utils/advanced_run.html
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=advancedrun.exe
   OR Processes.original_file_name=advancedrun.exe) Processes.process IN ("*EXEFilename*","*/cfg*","*RunAs*",
@@ -18,16 +26,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.original_file_name Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `windows_nirsoft_advancedrun_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives should be limited as it is specific to AdvancedRun.
-  Filter as needed based on legitimate usage.
-references:
-- http://www.nirsoft.net/utils/advanced_run.html
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - Unusual Processes
@@ -49,39 +47,38 @@ tags:
   - T1588.002
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 60
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml
index 1fd0c7eb76..a55e602e8c 100644
--- a/detections/endpoint/windows_nirsoft_utilities.yml
+++ b/detections/endpoint/windows_nirsoft_utilities.yml
@@ -1,31 +1,29 @@
-name: Windows NirSoft Utilities
-id: 5b2f4596-7d4c-11ec-88a7-acde48001122
-version: 1
-date: '2022-01-24'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-01-24'
 description: The following hunting analytic assists with identifying the proces execution
   of commonly used utilities from NirSoft. Potentially not adversary behavior, but
   worth identifying to know if the software is present and being used.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 5b2f4596-7d4c-11ec-88a7-acde48001122
+known_false_positives: False positives may be present. Filtering may be required before
+  setting to alert.
+name: Windows NirSoft Utilities
+references:
+- https://www.cisa.gov/uscert/ncas/alerts/TA18-201A
+- http://www.nirsoft.net/
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Processes by Processes.dest Processes.user Processes.parent_process
   Processes.process_name Processes.process Processes.original_file_name Processes.process_path
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `is_nirsoft_software`
   | `windows_nirsoft_utilities_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives may be present. Filtering may be required before
-  setting to alert.
-references:
-- https://www.cisa.gov/uscert/ncas/alerts/TA18-201A
-- http://www.nirsoft.net/
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - WhisperGate
@@ -45,37 +43,37 @@ tags:
   - T1588.002
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml
index 5555c3942c..6c18977b5d 100644
--- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml
+++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml
@@ -1,11 +1,7 @@
-name: Windows Process With NamedPipe CommandLine
-id: e64399d4-94a8-11ec-a9da-acde48001122
-version: 1
-date: '2022-02-23'
 author: Teoderick Contreras, Splunk
-type: Anomaly
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-02-23'
 description: This analytic is to look for process commandline that contains named
   pipe. This technique was seen in some adversaries, threat actor and malware like
   olympic destroyer to communicate to its other child processes after process injection
@@ -14,6 +10,16 @@ description: This analytic is to look for process commandline that contains name
   In that scenario we include common process path we've seen during testing that cause
   false positive which is the program files. False positive may still be arise if
   the normal application is in other folder path.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: e64399d4-94a8-11ec-a9da-acde48001122
+known_false_positives: Normal browser application may use this technique. Please update
+  the filter macros to remove false positives.
+name: Windows Process With NamedPipe CommandLine
+references:
+- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process = "*\\\\.\\pipe\\*"
   NOT (Processes.process_path IN ("*\\program files*")) by Processes.parent_process_name
@@ -21,14 +27,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_id Processes.parent_process_path Processes.process_guid Processes.parent_process_id
   Processes.dest Processes.user Processes.process_path | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_with_namedpipe_commandline_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: Normal browser application may use this technique. Please update
-  the filter macros to remove false positives.
-references:
-- https://blog.talosintelligence.com/2018/02/olympic-destroyer.html
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -52,26 +50,28 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.parent_process_path
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  - Processes.process_guid
   risk_score: 49
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml
index e442e6221c..49d2f4e02c 100644
--- a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml
+++ b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml
@@ -1,31 +1,29 @@
-name: Windows Raccine Scheduled Task Deletion
-id: c9f010da-57ab-11ec-82bd-acde48001122
-version: 1
-date: '2021-12-07'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-12-07'
 description: The following analytic identifies the Raccine Rules Updater scheduled
   task being deleted. Adversaries may attempt to remove this task in order to prevent
   the update of Raccine.  Raccine is a "ransomware vaccine" created by security researcher
   Florian Roth, designed to intercept and prevent precursors and active ransomware
   behavior.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: c9f010da-57ab-11ec-82bd-acde48001122
+known_false_positives: False positives should be limited, however filter as needed.
+name: Windows Raccine Scheduled Task Deletion
+references:
+- https://redcanary.com/blog/blackbyte-ransomware/
+- https://github.com/Neo23x0/Raccine
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
   Processes.process="*delete*" AND Processes.process="*Raccine*" by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raccine_scheduled_task_deletion_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives should be limited, however filter as needed.
-references:
-- https://redcanary.com/blog/blackbyte-ransomware/
-- https://github.com/Neo23x0/Raccine
 tags:
   analytic_story:
   - Ransomware
@@ -45,39 +43,38 @@ tags:
   - T1562.001
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml
index 1478210a41..5823fb68e6 100644
--- a/detections/endpoint/windows_rasautou_dll_execution.yml
+++ b/detections/endpoint/windows_rasautou_dll_execution.yml
@@ -1,33 +1,31 @@
-name: Windows Rasautou DLL Execution
-id: 6f42b8be-8e96-11ec-ad5a-acde48001122
-version: 1
-date: '2022-02-15'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-02-15'
 description: The following analytic identifies the Windows Windows Remote Auto Dialer,
   rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary
   shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review
   parent and child process behavior including file and image loads.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 6f42b8be-8e96-11ec-ad5a-acde48001122
+known_false_positives: False positives will be limited to applications that require
+  Rasautou.exe to load a DLL from disk. Filter as needed.
+name: Windows Rasautou DLL Execution
+references:
+- https://github.com/mandiant/DueDLLigence
+- https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1
+- https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513
+- https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rasautou.exe
   Processes.process="* -d *"AND Processes.process="* -p *" by Processes.dest Processes.user
   Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_rasautou_dll_execution_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives will be limited to applications that require
-  Rasautou.exe to load a DLL from disk. Filter as needed.
-references:
-- https://github.com/mandiant/DueDLLigence
-- https://github.com/MHaggis/notes/blob/master/utilities/Invoke-SPLDLLigence.ps1
-- https://gist.github.com/NickTyrer/c6043e4b302d5424f701f15baf136513
-- https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -48,33 +46,32 @@ tags:
   - T1055
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml
index 0ab9bf0c5b..95a0b8c6c6 100644
--- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml
+++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml
@@ -1,29 +1,26 @@
-name: Windows Raw Access To Disk Volume Partition
-id: a85aa37e-9647-11ec-90c5-acde48001122
-version: 1
-date: '2022-02-25'
 author: Teoderick Contreras, Splunk
-type: Anomaly
-datamodel:
-- Endpoint
+datamodel: []
+date: '2022-02-25'
 description: This analytic is to look for suspicious raw access read to device disk
   partition of the host machine. This technique was seen in several attacks by adversaries
   or threat actor to wipe, encrypt or overwrite the boot sector of each partition
   as part of their impact payload for example the "hermeticwiper" malware. This detection
   is a good indicator that there is a process try to read or write on boot sector.
-search: '`sysmon` EventCode=9 Device = \\Device\\HarddiskVolume* NOT (Image IN("*\\Windows\\System32\\*",
-  "*\\Windows\\SysWOW64\\*")) | stats count min(_time) as firstTime max(_time) as
-  lastTime by Image Device ProcessGuid ProcessId EventDescription EventCode Computer
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raw_access_to_disk_volume_partition_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the raw access read event (like sysmon eventcode 9), process name and
   process guid from your endpoints. If you are using Sysmon, you must have at least
   version 6.0.4 of the Sysmon TA.
+id: a85aa37e-9647-11ec-90c5-acde48001122
 known_false_positives: This event is really notable but we found minimal number of
   normal application from system32 folder like svchost.exe accessing it too. In this
   case we used 'system32' and 'syswow64' path as a filter for this detection.
+name: Windows Raw Access To Disk Volume Partition
 references:
 - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
+search: '`sysmon` EventCode=9 Device = \\Device\\HarddiskVolume* NOT (Image IN("*\\Windows\\System32\\*",
+  "*\\Windows\\SysWOW64\\*")) | stats count min(_time) as firstTime max(_time) as
+  lastTime by Image Device ProcessGuid ProcessId EventDescription EventCode Computer
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raw_access_to_disk_volume_partition_filter`'
 tags:
   analytic_story:
   - Data Destruction
@@ -49,9 +46,9 @@ tags:
   - DE.CM
   observable:
   - name: ComputerName
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -67,3 +64,5 @@ tags:
   - EventCode
   risk_score: 90
   security_domain: endpoint
+type: Anomaly
+version: 1
diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml
index 24a1beac4a..df4771c0de 100644
--- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml
+++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml
@@ -1,31 +1,28 @@
-name: Windows Raw Access To Master Boot Record Drive
-id: 7b83f666-900c-11ec-a2d9-acde48001122
-version: 1
-date: '2022-02-17'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2022-02-17'
 description: This analytic is to look for suspicious raw access read to drive where
   the master boot record is placed. This technique was seen in several attacks by
   adversaries or threat actor to wipe, encrypt or overwrite the master boot record
   code as part of their impact payload. This detection is a good indicator that there
   is a process try to read or write on MBR sector.
-search: '`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("*\\Windows\\System32\\*",
-  "*\\Windows\\SysWOW64\\*")) | stats count min(_time) as firstTime max(_time) as
-  lastTime by Computer Image Device ProcessGuid ProcessId EventDescription EventCode
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raw_access_to_master_boot_record_drive_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the raw access read event (like sysmon eventcode 9), process name and
   process guid from your endpoints. If you are using Sysmon, you must have at least
   version 6.0.4 of the Sysmon TA.
+id: 7b83f666-900c-11ec-a2d9-acde48001122
 known_false_positives: This event is really notable but we found minimal number of
   normal application from system32 folder like svchost.exe accessing it too. In this
   case we used 'system32' and 'syswow64' path as a filter for this detection.
+name: Windows Raw Access To Master Boot Record Drive
 references:
 - https://www.splunk.com/en_us/blog/security/threat-advisory-strt-ta02-destructive-software.html
 - https://www.crowdstrike.com/blog/technical-analysis-of-whispergate-malware/
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+search: '`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("*\\Windows\\System32\\*",
+  "*\\Windows\\SysWOW64\\*")) | stats count min(_time) as firstTime max(_time) as
+  lastTime by Computer Image Device ProcessGuid ProcessId EventDescription EventCode
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_raw_access_to_master_boot_record_drive_filter`'
 tags:
   analytic_story:
   - WhisperGate
@@ -51,9 +48,9 @@ tags:
   - DE.CM
   observable:
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -69,3 +66,5 @@ tags:
   - EventCode
   risk_score: 90
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml
index 723eeca63c..e4d3ea0d90 100644
--- a/detections/endpoint/windows_remote_assistance_spawning_process.yml
+++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml
@@ -1,32 +1,30 @@
-name: Windows Remote Assistance Spawning Process
-id: ced50492-8849-11ec-9f68-acde48001122
-version: 1
-date: '2022-02-07'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-02-07'
 description: The following analytic identifies the use of Microsoft Remote Assistance,
   msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default
   has no command-line arguments and typically spawns itself. It will generate a network
   connection to the remote system that is connected. This behavior is indicative of
   another process injected into msra.exe. Review the parent process or cross process
   events to identify source.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: ced50492-8849-11ec-9f68-acde48001122
+known_false_positives: False positives should be limited, filter as needed. Add additional
+  shells as needed.
+name: Windows Remote Assistance Spawning Process
+references:
+- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=msra.exe
   `windows_shells` by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.original_file_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_remote_assistance_spawning_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives should be limited, filter as needed. Add additional
-  shells as needed.
-references:
-- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
 tags:
   analytic_story:
   - Unusual Processes
@@ -45,33 +43,32 @@ tags:
   - T1055
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml
index aa37903127..ef5f0a04d0 100644
--- a/detections/endpoint/windows_schtasks_create_run_as_system.yml
+++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml
@@ -1,32 +1,30 @@
-name: Windows Schtasks Create Run As System
-id: 41a0e58e-884c-11ec-9976-acde48001122
-version: 1
-date: '2022-02-07'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-02-07'
 description: The following analytic identifies Schtasks.exe creating a new task to
   start and run as an elevated user - SYSTEM. This is commonly used by adversaries
   to spawn a process in an elevated state.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 41a0e58e-884c-11ec-9976-acde48001122
+known_false_positives: False positives will be limited to legitimate applications
+  creating a task to run as SYSTEM. Filter as needed based on parent process, or modify
+  the query to have world writeable paths to restrict it.
+name: Windows Schtasks Create Run As System
+references:
+- https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/
+- https://www.ired.team/offensive-security/persistence/t1053-schtask
+- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_schtasks` Processes.process="*/create
   *" AND Processes.process="*/ru *" AND Processes.process="*system*" by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_schtasks_create_run_as_system_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives will be limited to legitimate applications
-  creating a task to run as SYSTEM. Filter as needed based on parent process, or modify
-  the query to have world writeable paths to restrict it.
-references:
-- https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/
-- https://www.ired.team/offensive-security/persistence/t1053-schtask
-- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
 tags:
   analytic_story:
   - Windows Persistence Techniques
@@ -46,29 +44,28 @@ tags:
   - T1053
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 48
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml
index c1f89a9f2a..e82cdaedf3 100644
--- a/detections/endpoint/windows_security_account_manager_stopped.yml
+++ b/detections/endpoint/windows_security_account_manager_stopped.yml
@@ -1,25 +1,24 @@
-name: Windows Security Account Manager Stopped
-id: 69c12d59-d951-431e-ab77-ec426b8d65e6
-version: 1
-date: '2020-11-06'
 author: Rod Soto, Jose Hernandez, Splunk
-type: TTP
-datamodel: []
+datamodel:
+- Endpoint.Processes
+date: '2020-11-06'
 description: The search looks for a Windows Security Account Manager (SAM) was stopped
   via command-line. This is consistent with Ryuk infections across a fleet of endpoints.
+how_to_implement: You must be ingesting data that records the process-system activity
+  from your hosts to populate the Endpoint Processes data-model object. If you are
+  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
+  you want to collect data.
+id: 69c12d59-d951-431e-ab77-ec426b8d65e6
+known_false_positives: SAM is a critical windows service, stopping it would cause
+  major issues on an endpoint this makes false positive rare. AlthoughNo false positives
+  have been identified.
+name: Windows Security Account Manager Stopped
+references: []
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Processes WHERE (Processes.process_name="net*.exe"
   Processes.process="*stop \"samss\"*") BY Processes.dest, Processes.user, Processes.process
   | `drop_dm_object_name(Processes)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `windows_security_account_manager_stopped_filter`'
-how_to_implement: You must be ingesting data that records the process-system activity
-  from your hosts to populate the Endpoint Processes data-model object. If you are
-  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
-  you want to collect data.
-known_false_positives: SAM is a critical windows service, stopping it would cause
-  major issues on an endpoint this makes false positive rare. AlthoughNo false positives
-  have been identified.
-references: []
 tags:
   analytic_story:
   - Ryuk Ransomware
@@ -45,26 +44,28 @@ tags:
   - DE.CM
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   - name: process
-    type: Process
     role:
     - Target
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.process_name
-  - Processes.process
-  - Processes.dest
-  - Processes.user
   risk_score: 70
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
index e7ee7f4898..0733d1c26c 100644
--- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
+++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
@@ -1,15 +1,22 @@
-name: Windows Service Creation on Remote Endpoint
-id: e0eea4fa-4274-11ec-882b-3e22fbd008af
-version: 1
-date: '2021-11-10'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-10'
 description: This analytic looks for the execution of `sc.exe` with command-line arguments
   utilized to create a Windows Service on a remote endpoint. Red Teams and adversaries
   alike may abuse the Service Control Manager for lateral movement and remote code
   execution.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+id: e0eea4fa-4274-11ec-882b-3e22fbd008af
+known_false_positives: Administrators may create Windows Services on remote systems,
+  but this activity is usually limited to a small set of hosts or users.
+name: Windows Service Creation on Remote Endpoint
+references:
+- https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager
+- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc
+- https://attack.mitre.org/techniques/T1543/003/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe
   OR Processes.original_file_name=sc.exe) (Processes.process=*\\\\* AND Processes.process=*create*
@@ -17,15 +24,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `windows_service_creation_on_remote_endpoint_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
-known_false_positives: Administrators may create Windows Services on remote systems,
-  but this activity is usually limited to a small set of hosts or users.
-references:
-- https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager
-- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc
-- https://attack.mitre.org/techniques/T1543/003/
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -45,27 +43,26 @@ tags:
   - T1543.003
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml
index d9f96b763b..394613a63c 100644
--- a/detections/endpoint/windows_service_creation_using_registry_entry.yml
+++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml
@@ -1,17 +1,24 @@
-name: Windows Service Creation Using Registry Entry
-id: 25212358-948e-11ec-ad47-acde48001122
-version: 1
-date: '2022-02-23'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2022-02-23'
 description: This analytic is to look for suspicious modification or creation of registry
   to have service entry. This technique is abused by adversaries or threat actor to
   persist, gain privileges in the machine or even lateral movement. This technique
   can be executed using reg.exe application or using windows API like for example
   the CrashOveride malware. This detection is a good indicator that a process is trying
   to create a service entry using registry ImagePath.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: 25212358-948e-11ec-ad47-acde48001122
+known_false_positives: Third party tools may used this technique to create services
+  but not so common.
+name: Windows Service Creation Using Registry Entry
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md
 search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
   max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*"
   Registry.registry_value_name = ImagePath by _time span=1h Registry.dest Registry.user
@@ -25,14 +32,6 @@ search: '| tstats `security_content_summariesonly` count  min(_time) as firstTim
   process_path process proc_guid registry_path registry_value_name registry_value_data]
   | table _time dest user parent_process_name parent_process process_name process_path
   process proc_guid registry_path registry_value_name registry_value_data | `windows_service_creation_using_registry_entry_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: Third party tools may used this technique to create services
-  but not so common.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -60,26 +59,29 @@ tags:
   - DE.CM
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_key_name
-  - Registry.registry_path
-  - Registry.user
-  - Registry.dest
-  - Registry.registry_value_name
-  - Processes.process_id
-  - Processes.process_name
-  - Processes.process
-  - Processes.dest
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_guid
   risk_score: 64
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml
index fe79ffa24e..275be18f18 100644
--- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml
+++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml
@@ -1,29 +1,27 @@
-name: Windows Service Initiation on Remote Endpoint
-id: 3f519894-4276-11ec-ab02-3e22fbd008af
-version: 1
-date: '2021-11-10'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-10'
 description: This analytic looks for the execution of `sc.exe` with command-line arguments
   utilized to start a Windows Service on a remote endpoint. Red Teams and adversaries
   alike may abuse the Service Control Manager for lateral movement and remote code
   execution.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+id: 3f519894-4276-11ec-ab02-3e22fbd008af
+known_false_positives: Administrators may start Windows Services on remote systems,
+  but this activity is usually limited to a small set of hosts or users.
+name: Windows Service Initiation on Remote Endpoint
+references:
+- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc
+- https://attack.mitre.org/techniques/T1543/003/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe
   OR Processes.original_file_name=sc.exe) (Processes.process=*\\\\* AND Processes.process=*start*)
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_initiation_on_remote_endpoint_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
-known_false_positives: Administrators may start Windows Services on remote systems,
-  but this activity is usually limited to a small set of hosts or users.
-references:
-- https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc
-- https://attack.mitre.org/techniques/T1543/003/
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -43,27 +41,26 @@ tags:
   - T1543.003
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml
index c8d4f71a4d..d6ef30a4b6 100644
--- a/detections/endpoint/windows_wmi_process_call_create.yml
+++ b/detections/endpoint/windows_wmi_process_call_create.yml
@@ -1,16 +1,22 @@
-name: Windows WMI Process Call Create
-id: 0661c2de-93de-11ec-9833-acde48001122
-version: 1
-date: '2022-02-22'
 author: Teoderick Contreras, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2022-02-22'
 description: This analytic is to look for wmi commandlines to execute or create process.
   This technique was used by adversaries or threat actor to execute their malicious
   payload in local or remote host. This hunting query is a good pivot to start to
   look further which process trigger the wmi or what process it execute locally or
   remotely.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 0661c2de-93de-11ec-9833-acde48001122
+known_false_positives: Administrators may execute this command for testing or auditing.
+name: Windows WMI Process Call Create
+references:
+- https://github.com/NVISOsecurity/sigma-public/blob/master/rules/windows/process_creation/win_susp_wmi_execution.yml
+- https://github.com/redcanaryco/atomic-red-team/blob/2b804d25418004a5f1ba50e9dc637946ab8733c7/atomics/T1047/T1047.md
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process
   = "* process *" Processes.process = "* call *" Processes.process = "* create *"
@@ -19,14 +25,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_guid Processes.parent_process_id Processes.dest Processes.user
   Processes.process_path | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_wmi_process_call_create_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: Administrators may execute this command for testing or auditing.
-references:
-- https://github.com/NVISOsecurity/sigma-public/blob/master/rules/windows/process_creation/win_susp_wmi_execution.yml
-- https://github.com/redcanaryco/atomic-red-team/blob/2b804d25418004a5f1ba50e9dc637946ab8733c7/atomics/T1047/T1047.md
 tags:
   analytic_story:
   - Suspicious WMI Use
@@ -50,30 +48,32 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.parent_process_path
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.process_path
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  - Processes.process_guid
   risk_score: 25
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
index 3f135b0e36..282f728c99 100644
--- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
@@ -1,10 +1,6 @@
-name: WinEvent Scheduled Task Created to Spawn Shell
-id: 203ef0ea-9bd8-11eb-8201-acde48001122
-version: 1
-date: '2021-04-12'
 author: Michael Haag, Splunk
-type: TTP
 datamodel: []
+date: '2021-04-12'
 description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled
   task was created`, to identify suspicious tasks registered on Windows either via
   schtasks.exe OR TaskService with a command to be executed with a native Windows
@@ -24,23 +20,25 @@ description: 'The following query utilizes Windows Security EventCode 4698, `A s
   Review the job created and the Command to be executed. Capture any artifacts on
   disk and review. Identify any parallel processes within the same timeframe to identify
   source.'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also
+  required.
+id: 203ef0ea-9bd8-11eb-8201-acde48001122
+known_false_positives: False positives are possible if legitimate applications are
+  allowed to register tasks that call a shell to be spawned. Filter as needed based
+  on command-line or processes that are used legitimately.
+name: WinEvent Scheduled Task Created to Spawn Shell
+references:
+- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/
+- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698
+- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/
+- https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN
 search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN
   ("*powershell.exe*", "*wscript.exe*", "*cscript.exe*", "*cmd.exe*", "*sh.exe*",
   "*ksh.exe*", "*zsh.exe*", "*bash.exe*", "*scrcons.exe*", "*pwsh.exe*") | stats count
   min(_time) as firstTime max(_time) as lastTime by dest, Task_Name, Command, Author,
   Enabled, Hidden | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `winevent_scheduled_task_created_to_spawn_shell_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also
-  required.
-known_false_positives: False positives are possible if legitimate applications are
-  allowed to register tasks that call a shell to be spawned. Filter as needed based
-  on command-line or processes that are used legitimately.
-references:
-- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/
-- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698
-- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/
-- https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN
 tags:
   analytic_story:
   - Windows Persistence Techniques
@@ -65,22 +63,23 @@ tags:
   - T1053
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: Command
-    type: Command
     role:
     - Target
+    type: Command
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Command
+  - Task_Name
   - _time
   - dest
-  - Task_Name
-  - Description
-  - Command
   risk_score: 70
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
index ff59f2304b..4a4b48d20c 100644
--- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
@@ -1,10 +1,6 @@
-name: WinEvent Scheduled Task Created Within Public Path
-id: 5d9c6eee-988c-11eb-8253-acde48001122
-version: 1
-date: '2021-04-08'
 author: Michael Haag, Splunk
-type: TTP
 datamodel: []
+date: '2021-04-08'
 description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled
   task was created`, to identify suspicious tasks registered on Windows either via
   schtasks.exe OR TaskService with a command to be executed from a user writeable
@@ -24,23 +20,25 @@ description: 'The following query utilizes Windows Security EventCode 4698, `A s
   TaskService. Review the job created and the Command to be executed. Capture any
   artifacts on disk and review. Identify any parallel processes within the same timeframe
   to identify source.'
-search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN
-  ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*",
-  "*\\appdata\\*") | stats count min(_time) as firstTime max(_time) as lastTime by
-  dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_within_public_path_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows Security Event Logs with 4698 EventCode enabled. The Windows TA is also
   required.
+id: 5d9c6eee-988c-11eb-8253-acde48001122
 known_false_positives: False positives are possible if legitimate applications are
   allowed to register tasks in public paths. Filter as needed based on paths that
   are used legitimately.
+name: WinEvent Scheduled Task Created Within Public Path
 references:
 - https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/
 - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698
 - https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/
 - https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN
 - https://app.any.run/tasks/e26f1b2e-befa-483b-91d2-e18636e2faf3/
+search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN
+  ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*",
+  "*\\appdata\\*") | stats count min(_time) as firstTime max(_time) as lastTime by
+  dest, Task_Name, Command, Author, Enabled, Hidden | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `winevent_scheduled_task_created_within_public_path_filter`'
 tags:
   analytic_story:
   - Windows Persistence Techniques
@@ -67,22 +65,23 @@ tags:
   - T1053
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   - name: Command
-    type: Command
     role:
     - Target
+    type: Command
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Command
+  - Task_Name
   - _time
   - dest
-  - Task_Name
-  - Description
-  - Command
   risk_score: 70
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
index 8b49efca42..f345871857 100644
--- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
+++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
@@ -1,11 +1,6 @@
-name: WinEvent Windows Task Scheduler Event Action Started
-id: b3632472-310b-11ec-9aab-acde48001122
-version: 1
-date: '2021-10-19'
 author: Michael Haag, Splunk
-type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-10-19'
 description: The following hunting analytic assists with identifying suspicious tasks
   that have been registered and ran in Windows using EventID 200 (action run) and
   201 (action completed). It is recommended to filter based on ActionName by specifying
@@ -14,19 +9,21 @@ description: The following hunting analytic assists with identifying suspicious
   events related to tasks being scheduled. EventID 106 will generate when a new task
   is generated, however, that does not mean it ran. Capture any files on disk and
   analyze.
-search: '`wineventlog_task_scheduler` EventCode IN ("200","201") | rename ComputerName
-  as dest | stats count min(_time) as firstTime max(_time) as lastTime by Message
-  dest EventCode category | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `winevent_windows_task_scheduler_event_action_started_filter`'
 how_to_implement: Task Scheduler logs are required to be collected. Enable logging
   with inputs.conf by adding a stanza for [WinEventLog://Microsoft-Windows-TaskScheduler/Operational]
   and renderXml=false. Note, not translating it in XML may require a proper extraction
   of specific items in the Message.
+id: b3632472-310b-11ec-9aab-acde48001122
 known_false_positives: False positives will be present. Filter based on ActionName
   paths or specify keywords of interest.
+name: WinEvent Windows Task Scheduler Event Action Started
 references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
+search: '`wineventlog_task_scheduler` EventCode IN ("200","201") | rename ComputerName
+  as dest | stats count min(_time) as firstTime max(_time) as lastTime by Message
+  dest EventCode category | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `winevent_windows_task_scheduler_event_action_started_filter`'
 tags:
   analytic_story:
   - IcedID
@@ -46,19 +43,17 @@ tags:
   - T1053.005
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
   - _time
-  - TaskName
-  - ActionName
-  - EventID
   - dest
-  - ProcessID
   risk_score: 80
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/winhlp32_spawning_a_process.yml b/detections/endpoint/winhlp32_spawning_a_process.yml
index 94331c9531..de5cadab1f 100644
--- a/detections/endpoint/winhlp32_spawning_a_process.yml
+++ b/detections/endpoint/winhlp32_spawning_a_process.yml
@@ -1,11 +1,7 @@
-name: Winhlp32 Spawning a Process
-id: d17dae9e-2618-11ec-b9f5-acde48001122
-version: 1
-date: '2021-10-05'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-10-05'
 description: The following analytic identifies winhlp32.exe, found natively in `c:\windows\`,
   spawning a child process that loads a file out of appdata, programdata, or temp.
   Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added
@@ -16,23 +12,25 @@ description: The following analytic identifies winhlp32.exe, found natively in `
   triage, review parallel processes to identify further suspicious behavior. Review
   module loads for unsuspecting unsigned modules. Capture any file modifications and
   analyze.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: d17dae9e-2618-11ec-b9f5-acde48001122
+known_false_positives: False positives should be limited as winhlp32.exe is typically
+  not used with the latest flavors of Windows OS. However, filter as needed.
+name: Winhlp32 Spawning a Process
+references:
+- https://www.exploit-db.com/exploits/16541
+- https://tria.ge/210929-ap75vsddan
+- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winhlp32.exe
   Processes.process IN ("*\\appdata\\*","*\\programdata\\*", "*\\temp\\*") by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `winhlp32_spawning_a_process_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives should be limited as winhlp32.exe is typically
-  not used with the latest flavors of Windows OS. However, filter as needed.
-references:
-- https://www.exploit-db.com/exploits/16541
-- https://tria.ge/210929-ap75vsddan
-- https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
 tags:
   analytic_story:
   - Remcos
@@ -52,39 +50,38 @@ tags:
   - T1055
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml
index 6edb916edb..50092f8f66 100644
--- a/detections/endpoint/winword_spawning_cmd.yml
+++ b/detections/endpoint/winword_spawning_cmd.yml
@@ -1,11 +1,7 @@
-name: Winword Spawning Cmd
-id: 6fcbaedc-a37b-11eb-956b-acde48001122
-version: 2
-date: '2021-04-22'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-04-22'
 description: The following detection identifies Microsoft Word spawning `cmd.exe`.
   Typically, this is not common behavior and not default with winword.exe. Winword.exe
   will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16`
@@ -14,21 +10,23 @@ description: The following detection identifies Microsoft Word spawning `cmd.exe
   being executed. During triage, review parallel processes and identify any files
   that may have been written. It is possible that COM is utilized to trampoline the
   child process to `explorer.exe` or `wmiprvse.exe`.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 6fcbaedc-a37b-11eb-956b-acde48001122
+known_false_positives: False positives should be limited, but if any are present,
+  filter as needed.
+name: Winword Spawning Cmd
+references:
+- https://app.any.run/tasks/73af0064-a785-4c0a-ab0d-cde593fe16ef/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=winword.exe
   `process_cmd` by Processes.dest Processes.user Processes.parent_process Processes.original_file_name
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `winword_spawning_cmd_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives should be limited, but if any are present,
-  filter as needed.
-references:
-- https://app.any.run/tasks/73af0064-a785-4c0a-ab0d-cde593fe16ef/
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -49,35 +47,35 @@ tags:
   - T1566.001
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   - name: process_name
-    type: Process
     role:
     - Target
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 70
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml
index 46c8cb7d5a..25c4094673 100644
--- a/detections/endpoint/winword_spawning_powershell.yml
+++ b/detections/endpoint/winword_spawning_powershell.yml
@@ -1,11 +1,7 @@
-name: Winword Spawning PowerShell
-id: b2c950b8-9be2-11eb-8658-acde48001122
-version: 2
-date: '2021-04-12'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-04-12'
 description: The following detection identifies Microsoft Word spawning PowerShell.
   Typically, this is not common behavior and not default with winword.exe. Winword.exe
   will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16`
@@ -13,24 +9,26 @@ description: The following detection identifies Microsoft Word spawning PowerShe
   attachment and is actively used. Albeit, the command executed will most likely be
   encoded and captured via another detection. During triage, review parallel processes
   and identify any files that may have been written.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: b2c950b8-9be2-11eb-8658-acde48001122
+known_false_positives: False positives should be limited, but if any are present,
+  filter as needed.
+name: Winword Spawning PowerShell
+references:
+- https://redcanary.com/threat-detection-report/techniques/powershell/
+- https://attack.mitre.org/techniques/T1566/001/
+- https://app.any.run/tasks/b79fa381-f35c-4b3e-8d02-507e7ee7342f/
+- https://app.any.run/tasks/181ac90b-0898-4631-8701-b778a30610ad/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe"
   `process_powershell` by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `winword_spawning_powershell_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives should be limited, but if any are present,
-  filter as needed.
-references:
-- https://redcanary.com/threat-detection-report/techniques/powershell/
-- https://attack.mitre.org/techniques/T1566/001/
-- https://app.any.run/tasks/b79fa381-f35c-4b3e-8d02-507e7ee7342f/
-- https://app.any.run/tasks/181ac90b-0898-4631-8701-b778a30610ad/
 tags:
   analytic_story:
   - Spearphishing Attachments
@@ -51,35 +49,35 @@ tags:
   - T1566.001
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   - name: process_name
-    type: Process
     role:
     - Target
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 70
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml
index 005936b001..360c9b974c 100644
--- a/detections/endpoint/winword_spawning_windows_script_host.yml
+++ b/detections/endpoint/winword_spawning_windows_script_host.yml
@@ -1,11 +1,7 @@
-name: Winword Spawning Windows Script Host
-id: 637e1b5c-9be1-11eb-9c32-acde48001122
-version: 1
-date: '2021-04-12'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-04-12'
 description: The following detection identifies Microsoft Winword.exe spawning Windows
   Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior
   and not default with Winword.exe. Winword.exe will generally be found in the following
@@ -16,19 +12,21 @@ description: The following detection identifies Microsoft Winword.exe spawning W
   be obfuscated and captured via another detection. During triage, review parallel
   processes and identify any files that may have been written. Review the reputation
   of the remote destination and block accordingly.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+id: 637e1b5c-9be1-11eb-9c32-acde48001122
+known_false_positives: There will be limited false positives and it will be different
+  for every environment. Tune by child process or command-line as needed.
+name: Winword Spawning Windows Script Host
+references:
+- https://attack.mitre.org/techniques/T1566/001/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name="winword.exe"
   Processes.process_name IN ("cscript.exe", "wscript.exe") by Processes.dest Processes.user
   Processes.parent_process Processes.process_name Processes.process Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `winword_spawning_windows_script_host_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: There will be limited false positives and it will be different
-  for every environment. Tune by child process or command-line as needed.
-references:
-- https://attack.mitre.org/techniques/T1566/001/
 tags:
   analytic_story:
   - Spearphishing Attachment
@@ -48,28 +46,38 @@ tags:
   - T1566.001
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   - name: process_name
-    type: Process
     role:
     - Target
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - process_name
-  - process_id
-  - parent_process_name
   - dest
-  - user
   - parent_process_id
+  - parent_process_name
+  - process_id
+  - process_name
+  - user
   risk_score: 70
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/wmic_group_discovery.yml b/detections/endpoint/wmic_group_discovery.yml
index 67ccbb4fcb..f560819fc1 100644
--- a/detections/endpoint/wmic_group_discovery.yml
+++ b/detections/endpoint/wmic_group_discovery.yml
@@ -1,11 +1,7 @@
-name: Wmic Group Discovery
-id: 83317b08-155b-11ec-8e00-acde48001122
-version: 1
-date: '2021-09-14'
 author: Michael Haag, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-14'
 description: 'The following hunting analytic identifies the use of `wmic.exe` enumerating
   local groups on the endpoint. \
 
@@ -13,21 +9,23 @@ description: 'The following hunting analytic identifies the use of `wmic.exe` en
   day, endpoint and username. \
 
   During triage, review parallel processes and identify any further suspicious behavior.'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 83317b08-155b-11ec-8e00-acde48001122
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+name: Wmic Group Discovery
+references:
+- https://attack.mitre.org/techniques/T1069/001/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe
   (Processes.process="*group get name*") by Processes.dest Processes.user Processes.parent_process_name
   Processes.process_name Processes.process Processes.original_file_name Processes.process_id
   Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
   `security_content_ctime(lastTime)` | `wmic_group_discovery_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: Administrators or power users may use this command for troubleshooting.
-references:
-- https://attack.mitre.org/techniques/T1069/001/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -48,29 +46,28 @@ tags:
   - T1069.001
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 15
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
index 2f80fb1d75..db7650eb9d 100644
--- a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
+++ b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
@@ -1,11 +1,7 @@
-name: Wmic NonInteractive App Uninstallation
-id: bff0e7a0-317f-11ec-ab4e-acde48001122
-version: 1
-date: '2021-10-20'
 author: Teoderick Contreras, Splunk
-type: Hunting
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-10-20'
 description: This analytic is to detect a suspicious wmic commandlined that uninstall
   application non interactively. This technique was seen in IceID to uninstall av
   products to the compromised host to bypassed and evade detections. This Hunting
@@ -13,6 +9,16 @@ description: This analytic is to detect a suspicious wmic commandlined that unin
   wmic which is not a common behavior. This approach may seen in some script or third
   part appication to uninstall their application but it is a good thing to check what
   it uninstall and why.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: bff0e7a0-317f-11ec-ab4e-acde48001122
+known_false_positives: third party application may use this approach to uninstall
+  there application
+name: Wmic NonInteractive App Uninstallation
+references:
+- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe
   Processes.process="* product *" Processes.process="*where name*" Processes.process="*call
@@ -20,14 +26,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmic_noninteractive_app_uninstallation_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: third party application may use this approach to uninstall
-  there application
-references:
-- https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
   - IceID
@@ -47,33 +45,32 @@ tags:
   - T1562
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   - name: process_name
-    type: Process
     role:
     - Target
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
+type: Hunting
+version: 1
diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml
index 06690c892a..b546de89e9 100644
--- a/detections/endpoint/wmic_xsl_execution_via_url.yml
+++ b/detections/endpoint/wmic_xsl_execution_via_url.yml
@@ -1,11 +1,7 @@
-name: WMIC XSL Execution via URL
-id: 787e9dd0-4328-11ec-a029-acde48001122
-version: 1
-date: '2021-11-11'
 author: Michael Haag, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-11'
 description: The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible
   Stylesheet Language) script. This originally was identified by Casey Smith, dubbed
   Squiblytwo, as an application control bypass. Many adversaries will utilize this
@@ -14,23 +10,25 @@ description: The following analytic identifies `wmic.exe` loading a remote XSL (
   leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in Windows
   Management Instrumentation provided they utilize the /FORMAT switch. Upon identifying
   a suspicious execution, review for confirmed network connnection and script download.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: 787e9dd0-4328-11ec-a029-acde48001122
+known_false_positives: False positives are limited as legitimate applications typically
+  do not download files or xsl using WMIC. Filter as needed.
+name: WMIC XSL Execution via URL
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md
+- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-4---wmic-bypass-using-remote-xsl-file
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process
   IN ("*http://*", "*https://*") Processes.process="*/format:*" by Processes.parent_process_name
   Processes.original_file_name Processes.parent_process Processes.process_name Processes.process_id
   Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmic_xsl_execution_via_url_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
-  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
-  endpoint product.
-known_false_positives: False positives are limited as legitimate applications typically
-  do not download files or xsl using WMIC. Filter as needed.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md
-- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-4---wmic-bypass-using-remote-xsl-file
 tags:
   analytic_story:
   - Suspicious WMI Use
@@ -50,39 +48,38 @@ tags:
   - T1220
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.original_file_name
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 80
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
index 1460ebef98..92d2ca2d50 100644
--- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
@@ -1,11 +1,7 @@
-name: Wmiprsve LOLBAS Execution Process Spawn
-id: 95a455f0-4c04-11ec-b8ac-3e22fbd008af
-version: 1
-date: '2021-11-22'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-22'
 description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution
   process. When adversaries execute code on remote endpoints abusing Windows Management
   Instrumentation (WMI), the executed command is spawned as a child process of `wmiprvse.exe`.
@@ -13,6 +9,17 @@ description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS
   actors to perform tasks like executing malicious code. Looking for child processes
   of wmiprvse.exe that are part of the LOLBAS project can help defenders identify
   lateral movement activity.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+id: 95a455f0-4c04-11ec-b8ac-3e22fbd008af
+known_false_positives: Legitimate applications may trigger this behavior, filter as
+  needed.
+name: Wmiprsve LOLBAS Execution Process Spawn
+references:
+- https://attack.mitre.org/techniques/T1047/
+- https://www.ired.team/offensive-security/lateral-movement/t1047-wmi-for-lateral-movement
+- https://lolbas-project.github.io/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wmiprvse.exe)
   (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe",
@@ -29,15 +36,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmiprsve_lolbas_execution_process_spawn_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
-known_false_positives: Legitimate applications may trigger this behavior, filter as
-  needed.
-references:
-- https://attack.mitre.org/techniques/T1047/
-- https://www.ired.team/offensive-security/lateral-movement/t1047-wmi-for-lateral-movement
-- https://lolbas-project.github.io/
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -56,27 +54,26 @@ tags:
   - T1047
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml
index af04695147..baabe90136 100644
--- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml
+++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml
@@ -1,17 +1,24 @@
-name: Wscript Or Cscript Suspicious Child Process
-id: 1f35e1da-267b-11ec-90a9-acde48001122
-version: 1
-date: '2021-10-06'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-10-06'
 description: This analytic identifies a suspicious spawned process by WScript or CScript
   process. This technique was a common technique used by adversaries and malware to
   execute different LOLBIN, other scripts like PowerShell or spawn a suspended process
   to inject its code as a defense evasion. This TTP may detect some normal script
   that using several application tool that are in the list of the child process it
   detects but a good pivot and indicator that a script is may execute suspicious code.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 1f35e1da-267b-11ec-90a9-acde48001122
+known_false_positives: Administrators may create vbs or js script that use several
+  tool as part of its execution. Filter as needed.
+name: Wscript Or Cscript Suspicious Child Process
+references:
+- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
+- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
   IN ("cscript.exe", "wscript.exe") Processes.process_name IN ("regsvr32.exe", "rundll32.exe","winhlp32.exe","certutil.exe","msbuild.exe","cmd.exe","powershell*","wmic.exe","mshta.exe")
@@ -19,15 +26,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `wscript_or_cscript_suspicious_child_process_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: Administrators may create vbs or js script that use several
-  tool as part of its execution. Filter as needed.
-references:
-- https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
-- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
   - FIN7
@@ -52,31 +50,30 @@ tags:
   - T1134
   observable:
   - name: dest
+    role:
+    - Victim
     type: Endpoint
-    role:
-    - Victim
   - name: user
-    type: User
     role:
     - Victim
+    type: User
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
index a459e91554..e01b0e7c46 100644
--- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
@@ -1,11 +1,7 @@
-name: Wsmprovhost LOLBAS Execution Process Spawn
-id: 2eed004c-4c0d-11ec-93e8-3e22fbd008af
-version: 1
-date: '2021-11-22'
 author: Mauricio Velazco, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-11-22'
 description: The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS
   execution process. When adversaries execute code on remote endpoints abusing the
   Windows Remote Management (WinRm) protocol, the executed command is spawned as a
@@ -13,6 +9,17 @@ description: The following analytic identifies `Wsmprovhost.exe` spawning a LOLB
   binaries that can be abused by threat actors to perform tasks like executing malicious
   code. Looking for child processes of Wsmprovhost.exe that are part of the LOLBAS
   project can help defenders identify lateral movement activity.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+id: 2eed004c-4c0d-11ec-93e8-3e22fbd008af
+known_false_positives: Legitimate applications may trigger this behavior, filter as
+  needed.
+name: Wsmprovhost LOLBAS Execution Process Spawn
+references:
+- https://attack.mitre.org/techniques/T1021/006/
+- https://lolbas-project.github.io/
+- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name=wsmprovhost.exe)
   (Processes.process_name IN ("Regsvcs.exe", "Ftp.exe", "OfflineScannerShell.exe",
@@ -29,15 +36,6 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `wsmprovhost_lolbas_execution_process_spawn_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints.
-known_false_positives: Legitimate applications may trigger this behavior, filter as
-  needed.
-references:
-- https://attack.mitre.org/techniques/T1021/006/
-- https://lolbas-project.github.io/
-- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -57,27 +55,26 @@ tags:
   - T1021.006
   observable:
   - name: dest
-    type: Endpoint
     role:
     - Victim
+    type: Endpoint
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_id
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
   risk_score: 54
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml
index b436925676..ee9475a117 100644
--- a/detections/endpoint/wsreset_uac_bypass.yml
+++ b/detections/endpoint/wsreset_uac_bypass.yml
@@ -1,15 +1,22 @@
-name: WSReset UAC Bypass
-id: 8b5901bc-da63-11eb-be43-acde48001122
-version: 2
-date: '2020-01-28'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+- Endpoint.Registry
+date: '2020-01-28'
 description: This search is to detect a suspicious modification of registry related
   to UAC bypass. This technique is to modify the registry in this detection, create
   a registry value with the path of the payload and run WSreset.exe to bypass User
   account Control.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+id: 8b5901bc-da63-11eb-be43-acde48001122
+known_false_positives: unknown
+name: WSReset UAC Bypass
+references:
+- https://github.com/hfiref0x/UACME
+- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*"
   AND (Registry.registry_value_name = "(Default)" OR Registry.registry_value_name
@@ -25,14 +32,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint
   registry_key_name] | table _time dest user parent_process_name parent_process process_name
   process_path process proc_guid registry_path registry_value_name registry_value_data
   registry_key_name | `wsreset_uac_bypass_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information
-  on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
-  that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: unknown
-references:
-- https://github.com/hfiref0x/UACME
-- https://blog.morphisec.com/trickbot-uses-a-new-windows-10-uac-bypass
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
@@ -56,20 +55,32 @@ tags:
   - T1548
   observable:
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_guid
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Registry.dest
+  - Endpoint.Registry.process_guid
+  - Endpoint.Registry.registry_key_name
+  - Endpoint.Registry.registry_path
+  - Endpoint.Registry.registry_value_data
+  - Endpoint.Registry.registry_value_name
+  - Endpoint.Registry.user
   - _time
-  - Registry.registry_path
-  - Registry.registry_key_name
-  - Registry.registry_value_name
-  - Registry.dest
   risk_score: 63
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 2
diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml
index acadcdf186..78257a90d0 100644
--- a/detections/endpoint/xmrig_driver_loaded.yml
+++ b/detections/endpoint/xmrig_driver_loaded.yml
@@ -1,24 +1,21 @@
-name: XMRIG Driver Loaded
-id: 90080fa6-a8df-11eb-91e4-acde48001122
-version: 1
-date: '2021-04-29'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Endpoint
+datamodel: []
+date: '2021-04-29'
 description: This analytic identifies XMRIG coinminer driver installation on the system.
   The XMRIG driver name by default is `WinRing0x64.sys`. This cpu miner is an open
   source project that is commonly abused by adversaries to infect and mine bitcoin.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the driver loaded and Signature from your endpoints. If you are using
+  Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+id: 90080fa6-a8df-11eb-91e4-acde48001122
+known_false_positives: False positives should be limited.
+name: XMRIG Driver Loaded
+references:
+- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/
 search: '`sysmon` EventCode=6 Signature="Noriyuki MIYAZAKI" OR ImageLoaded= "*\\WinRing0x64.sys"
   |  stats  min(_time) as firstTime max(_time) as lastTime count by  Computer ImageLoaded
   Hashes IMPHASH Signature Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `xmrig_driver_loaded_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the driver loaded and Signature from your endpoints. If you are using
-  Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives: False positives should be limited.
-references:
-- https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/
 tags:
   analytic_story:
   - XMRig
@@ -39,13 +36,13 @@ tags:
   - T1543
   observable:
   - name: Computer
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: ImageLoaded
-    type: ImageLoaded
     role:
     - Attacker
+    type: ImageLoaded
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -60,3 +57,5 @@ tags:
   - Signed
   risk_score: 80
   security_domain: endpoint
+type: TTP
+version: 1
diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml
index 0d1b86a632..34b9df9713 100644
--- a/detections/endpoint/xsl_script_execution_with_wmic.yml
+++ b/detections/endpoint/xsl_script_execution_with_wmic.yml
@@ -1,32 +1,30 @@
-name: XSL Script Execution With WMIC
-id: 004e32e2-146d-11ec-a83f-acde48001122
-version: 1
-date: '2021-09-13'
 author: Teoderick Contreras, Splunk
-type: TTP
 datamodel:
-- Endpoint
+- Endpoint.Processes
+date: '2021-09-13'
 description: This search is to detect a suspicious wmic.exe process or renamed wmic
   process to execute malicious xsl file. This technique was seen in FIN7 to execute
   its malicous jscript using the .xsl as the loader with the help of wmic.exe process.
   This TTP is really a good indicator for you to hunt further for FIN7 or other attacker
   that known to used this technique.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+id: 004e32e2-146d-11ec-a83f-acde48001122
+known_false_positives: unknown
+name: XSL Script Execution With WMIC
+references:
+- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
+- https://attack.mitre.org/groups/G0046/
+- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-3---wmic-bypass-using-local-xsl-file
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process
   = "*os get*" Processes.process="*/format:*" Processes.process = "*.xsl*" by Processes.parent_process_name
   Processes.parent_process Processes.process_name Processes.process_id Processes.process
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `xsl_script_execution_with_wmic_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: unknown
-references:
-- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
-- https://attack.mitre.org/groups/G0046/
-- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-3---wmic-bypass-using-local-xsl-file
 tags:
   analytic_story:
   - FIN7
@@ -47,35 +45,37 @@ tags:
   - T1220
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: parent_process_name
-    type: Parent Process
     role:
     - Parent Process
+    type: Parent Process
   - name: process_name
-    type: Process
     role:
     - Child Process
+    type: Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Endpoint.Processes.dest
+  - Endpoint.Processes.parent_process
+  - Endpoint.Processes.parent_process_name
+  - Endpoint.Processes.process
+  - Endpoint.Processes.process_id
+  - Endpoint.Processes.process_name
+  - Endpoint.Processes.user
   - _time
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.process_name
-  - Processes.process_id
-  - Processes.process
-  - Processes.dest
-  - Processes.user
   risk_score: 49
   security_domain: endpoint
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: TTP
+version: 1
diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml
index 7b385820f2..d2695c73dc 100644
--- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml
+++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml
@@ -1,20 +1,13 @@
-name: Detect hosts connecting to dynamic domain providers
-id: c77162d3-f93c-45cc-80c8-22f6v5464g9f
-version: 3
-date: '2021-01-14'
 author: Bhavin Patel, Splunk
-type: TTP
 datamodel:
-- Network_Resolution
+- Network_Resolution.DNS
+date: '2021-01-14'
 description: Malicious actors often abuse legitimate Dynamic DNS services to host
   malicious payloads or interactive command and control nodes. Attackers will automate
   domain resolution changes by routing dynamic domains to countless IP addresses to
   circumvent firewall blocks, block lists as well as frustrate a network defenders
   analytic and investigative processes. This search will look for DNS queries made
   from within your infrastructure to suspicious dynamic domains.
-search: '| tstats `security_content_summariesonly` count values(DNS.answer) as answer
-  min(_time) as firstTime from datamodel=Network_Resolution.DNS by DNS.query host | `drop_dm_object_name("DNS")`
-  | `security_content_ctime(firstTime)` | `dynamic_dns_providers` | `detect_hosts_connecting_to_dynamic_domain_providers_filter`'
 how_to_implement: 'First, you''ll need to ingest data from your DNS operations. This
   can be done by ingesting logs from your server or data, collected passively by Splunk
   Stream or a similar solution. Specifically, data that contains the domain that is
@@ -40,10 +33,16 @@ how_to_implement: 'First, you''ll need to ingest data from your DNS operations.
 
   Detailed documentation on how to create a new field within Incident Review may be
   found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`'
+id: c77162d3-f93c-45cc-80c8-22f6v5464g9f
 known_false_positives: Some users and applications may leverage Dynamic DNS to reach
   out to some domains on the Internet since dynamic DNS by itself is not malicious,
   however this activity must be verified.
+name: Detect hosts connecting to dynamic domain providers
 references: []
+search: '| tstats `security_content_summariesonly` count values(DNS.answer) as answer
+  min(_time) as firstTime from datamodel=Network_Resolution.DNS by DNS.query host
+  | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | `dynamic_dns_providers`
+  | `detect_hosts_connecting_to_dynamic_domain_providers_filter`'
 tags:
   analytic_story:
   - Data Protection
@@ -79,21 +78,23 @@ tags:
   - DE.CM
   observable:
   - name: host
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: query
-    type: dnsquery
     role:
     - Attacker
+    type: dnsquery
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Network_Resolution.DNS.answer
+  - Network_Resolution.DNS.query
   - _time
-  - DNS.answer
-  - DNS.query
   - host
   risk_score: 56
   security_domain: network
+type: TTP
+version: 3
diff --git a/detections/network/detect_outbound_ldap_traffic.yml b/detections/network/detect_outbound_ldap_traffic.yml
index 97ca0cb956..76d29deede 100644
--- a/detections/network/detect_outbound_ldap_traffic.yml
+++ b/detections/network/detect_outbound_ldap_traffic.yml
@@ -1,16 +1,22 @@
-name: Detect Outbound LDAP Traffic
-id: c77162d3-f91c-45cc-80c8-22f6v546119f
-version: 1
-date: '2021-12-13'
 author: Bhavin Patel, Johan Bjerke, Splunk
-type: Hunting
 datamodel:
-- Network_Traffic
+- Network_Traffic.All_Traffic
+date: '2021-12-13'
 description: Malicious actors often abuse misconfigured LDAP servers or applications
   that use the LDAP servers in organizations. Outbound LDAP traffic should not be
   allowed outbound through your perimeter firewall.  This search will help determine
   if you have any LDAP connections to IP addresses outside of private (RFC1918) address
   space.
+how_to_implement: You must be ingesting Zeek DNS and Zeek Conn data into Splunk. Zeek
+  data should also be getting ingested in JSON format and should be mapped to the
+  Network Traffic datamodels that are in use for this search.
+id: c77162d3-f91c-45cc-80c8-22f6v546119f
+known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be
+  allowed outbound through your perimeter firewall. Please check those servers to
+  verify if the activity is legitimate.
+name: Detect Outbound LDAP Traffic
+references:
+- https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
 search: '| tstats earliest(_time) as earliest_time latest(_time) as latest_time values(All_Traffic.dest_ip)
   as dest_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port
   = 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip = 10.0.0.0/8 OR
@@ -18,14 +24,6 @@ search: '| tstats earliest(_time) as earliest_time latest(_time) as latest_time
   All_Traffic.dest_ip |`drop_dm_object_name("All_Traffic")` | where src_ip != dest_ip
   | `security_content_ctime(latest_time)`  | `security_content_ctime(earliest_time)`
   |`detect_outbound_ldap_traffic_filter`'
-how_to_implement: You must be ingesting Zeek DNS and Zeek Conn data into Splunk. Zeek
-  data should also be getting ingested in JSON format and should be mapped to the
-  Network Traffic datamodels that are in use for this search.
-known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be
-  allowed outbound through your perimeter firewall. Please check those servers to
-  verify if the activity is legitimate.
-references:
-- https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
 tags:
   analytic_story:
   - Log4Shell CVE-2021-44228
@@ -58,21 +56,23 @@ tags:
   - DE.CM
   observable:
   - name: src_ip
-    type: IP Address
     role:
     - Victim
-  - name: dest_ip
     type: IP Address
+  - name: dest_ip
     role:
     - Attacker
+    type: IP Address
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Network_Traffic.All_Traffic.dest_ip
+  - Network_Traffic.All_Traffic.dest_port
+  - Network_Traffic.All_Traffic.src_ip
   - _time
-  - All_Traffic.dest_ip
-  - All_Traffic.dest_port
-  - All_Traffic.src_ip
   risk_score: 56
   security_domain: network
+type: Hunting
+version: 1
diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml
index 2474317aac..f12d6129db 100644
--- a/detections/network/dns_query_length_with_high_standard_deviation.yml
+++ b/detections/network/dns_query_length_with_high_standard_deviation.yml
@@ -1,14 +1,16 @@
-name: DNS Query Length With High Standard Deviation
-id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5
-version: 4
-date: '2021-10-06'
 author: Bhavin Patel, Splunk
-type: Anomaly
 datamodel:
-- Network_Resolution
+- Network_Resolution.DNS
+date: '2021-10-06'
 description: This search allows you to identify DNS requests and compute the standard
   deviation on the length of the names being resolved, then filter on two times the
   standard deviation to show you those queries that are unusually large for your environment.
+how_to_implement: To successfully implement this search, you will need to ensure that
+  DNS data is populating the Network_Resolution data model.
+id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5
+known_false_positives: It's possible there can be long domain names that are legitimate.
+name: DNS Query Length With High Standard Deviation
+references: []
 search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution.DNS
   where NOT DNS.message_type IN("Pointer","PTR") by DNS.query | `drop_dm_object_name("DNS")`
   | eval tlds=split(query,".") | eval tld=mvindex(tlds,-1) | eval tld_len=len(tld)
@@ -16,10 +18,6 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Network_
   record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS
   avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev
   | `dns_query_length_with_high_standard_deviation_filter`'
-how_to_implement: To successfully implement this search, you will need to ensure that
-  DNS data is populating the Network_Resolution data model.
-known_false_positives: It's possible there can be long domain names that are legitimate.
-references: []
 tags:
   analytic_story:
   - Hidden Cobra Malware
@@ -50,21 +48,23 @@ tags:
   - DE.CM
   observable:
   - name: host
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   - name: query
-    type: dnsquery
     role:
     - Attacker
+    type: dnsquery
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
-  - _time
-  - DNS.query
+  - Network_Resolution.DNS.message_type
+  - Network_Resolution.DNS.query
   risk_score: 56
   security_domain: network
   supported_tas:
   - Splunk_TA_microsoft_sysmon
+type: Anomaly
+version: 4
diff --git a/detections/network/multiple_archive_files_http_post_traffic.yml b/detections/network/multiple_archive_files_http_post_traffic.yml
index 5fb5ffc2ba..a76301d04f 100644
--- a/detections/network/multiple_archive_files_http_post_traffic.yml
+++ b/detections/network/multiple_archive_files_http_post_traffic.yml
@@ -1,11 +1,6 @@
-name: Multiple Archive Files Http Post Traffic
-id: 4477f3ea-a28f-11eb-b762-acde48001122
-version: 1
-date: '2021-04-21'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Network_Traffic
+datamodel: []
+date: '2021-04-21'
 description: This search is designed to detect high frequency of archive files data
   exfiltration through HTTP POST method protocol. This are one of the common techniques
   used by APT or trojan spy after doing the data collection like screenshot, recording,
@@ -16,21 +11,23 @@ description: This search is designed to detect high frequency of archive files d
   files transfer to HTTP POST since it checks the request body header. Unfortunately
   this detection cannot support archive that was encrypted or encoded before doing
   the exfiltration.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the stream HTTP logs or network logs that catch network traffic. Make
+  sure that the http-request-body, payload, or request field is enabled in stream
+  http configuration.
+id: 4477f3ea-a28f-11eb-b762-acde48001122
+known_false_positives: Normal archive transfer via HTTP protocol may trip this detection.
+name: Multiple Archive Files Http Post Traffic
+references:
+- https://attack.mitre.org/techniques/T1560/001/
+- https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html
+- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
 search: '`stream_http` http_method=POST |eval archive_hdr1=substr(form_data,1,2) |
   eval archive_hdr2 = substr(form_data,1,4) |stats values(form_data) as http_request_body
   min(_time) as firstTime max(_time) as lastTime count by http_method http_user_agent
   uri_path url bytes_in bytes_out archive_hdr1 archive_hdr2 |where count >20 AND (archive_hdr1
   = "7z" OR archive_hdr1 = "PK" OR archive_hdr2="Rar!") | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `multiple_archive_files_http_post_traffic_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the stream HTTP logs or network logs that catch network traffic. Make
-  sure that the http-request-body, payload, or request field is enabled in stream
-  http configuration.
-known_false_positives: Normal archive transfer via HTTP protocol may trip this detection.
-references:
-- https://attack.mitre.org/techniques/T1560/001/
-- https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html
-- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
 tags:
   analytic_story:
   - Command and Control
@@ -52,13 +49,13 @@ tags:
   - T1048
   observable:
   - name: uri_path
+    role:
+    - Attacker
     type: UriPath
-    role:
-    - Attacker
   - name: form_data
-    type: formdata
     role:
     - Attacker
+    type: formdata
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -76,3 +73,5 @@ tags:
   - form_data
   risk_score: 25
   security_domain: network
+type: TTP
+version: 1
diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml
index 3716f34a17..3e2de35c16 100644
--- a/detections/network/plain_http_post_exfiltrated_data.yml
+++ b/detections/network/plain_http_post_exfiltrated_data.yml
@@ -1,26 +1,23 @@
-name: Plain HTTP POST Exfiltrated Data
-id: e2b36208-a364-11eb-8909-acde48001122
-version: 1
-date: '2021-04-22'
 author: Teoderick Contreras, Splunk
-type: TTP
-datamodel:
-- Network_Traffic
+datamodel: []
+date: '2021-04-22'
 description: This search is to detect potential plain HTTP POST method data exfiltration.
   This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary
   where arguments or commands are sent in plain text to the remote C2 server using
   HTTP POST method as part of data exfiltration.
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the stream HTTP logs or network logs that catch network traffic. Make
+  sure that the http-request-body, payload, or request field is enabled.
+id: e2b36208-a364-11eb-8909-acde48001122
+known_false_positives: unknown
+name: Plain HTTP POST Exfiltrated Data
+references:
+- https://blog.talosintelligence.com/2020/03/trickbot-primer.html
 search: '`stream_http` http_method=POST form_data IN ("*wermgr.exe*","*svchost.exe*",
   "*name=\"proclist\"*","*ipconfig*", "*name=\"sysinfo\"*", "*net view*") |stats values(form_data)
   as http_request_body min(_time) as firstTime max(_time) as lastTime count by http_method
   http_user_agent uri_path url bytes_in bytes_out | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `plain_http_post_exfiltrated_data_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the stream HTTP logs or network logs that catch network traffic. Make
-  sure that the http-request-body, payload, or request field is enabled.
-known_false_positives: unknown
-references:
-- https://blog.talosintelligence.com/2020/03/trickbot-primer.html
 tags:
   analytic_story:
   - Command and Control
@@ -42,13 +39,13 @@ tags:
   - T1048
   observable:
   - name: uri_path
+    role:
+    - Attacker
     type: UriPath
-    role:
-    - Attacker
   - name: form_data
-    type: formdata
     role:
     - Attacker
+    type: formdata
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -63,3 +60,5 @@ tags:
   - bytes_out
   risk_score: 63
   security_domain: network
+type: TTP
+version: 1
diff --git a/detections/web/log4shell_jndi_payload_injection_attempt.yml b/detections/web/log4shell_jndi_payload_injection_attempt.yml
index e7b549f675..bd603bc780 100644
--- a/detections/web/log4shell_jndi_payload_injection_attempt.yml
+++ b/detections/web/log4shell_jndi_payload_injection_attempt.yml
@@ -1,11 +1,7 @@
-name: Log4Shell JNDI Payload Injection Attempt
-id: c184f12e-5c90-11ec-bf1f-497c9a704a72
-version: 1
-date: '2021-12-13'
 author: Jose Hernandez
-type: Anomaly
 datamodel:
-- Web
+- Web.Web
+date: '2021-12-13'
 description: CVE-2021-44228 Log4Shell payloads can be injected via various methods,
   but on of the most common vectors injection is via Web calls. Many of the vulnerable
   java web applications that are using log4j have a web component to them are specially
@@ -23,16 +19,18 @@ description: CVE-2021-44228 Log4Shell payloads can be injected via various metho
   that there was a attempt at a injection, which could be a reconnaissance activity
   or a valid expliotation attempt, but this does not exactly mean that the host was
   indeed successfully exploited.
+how_to_implement: This detection requires the Web datamodel to be populated from a
+  supported Technology Add-On like Splunk for Apache or Splunk for Nginx.
+id: c184f12e-5c90-11ec-bf1f-497c9a704a72
+known_false_positives: If there is a vulnerablility scannner looking for log4shells
+  this will trigger, otherwise likely to have low false positives.
+name: Log4Shell JNDI Payload Injection Attempt
+references:
+- https://www.lunasec.io/docs/blog/log4j-zero-day/
 search: '| from datamodel Web.Web | regex _raw="[jJnNdDiI]{4}(\:|\%3A|\/|\%2F)\w+(\:\/\/|\%3A\%2F\%2F)(\$\{.*?\}(\.)?)?"
   | fillnull | stats count by action, category, dest, dest_port, http_content_type,
   http_method, http_referrer, http_user_agent, site, src, url, url_domain, user |
   `log4shell_jndi_payload_injection_attempt_filter`'
-how_to_implement: This detection requires the Web datamodel to be populated from a
-  supported Technology Add-On like Splunk for Apache or Splunk for Nginx.
-known_false_positives: If there is a vulnerablility scannner looking for log4shells
-  this will trigger, otherwise likely to have low false positives.
-references:
-- https://www.lunasec.io/docs/blog/log4j-zero-day/
 tags:
   analytic_story:
   - Log4Shell CVE-2021-44228
@@ -60,13 +58,13 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -87,3 +85,5 @@ tags:
   - user
   risk_score: 15
   security_domain: threat
+type: Anomaly
+version: 1
diff --git a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml
index 0e781ffc20..2dff28835e 100644
--- a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml
+++ b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml
@@ -1,12 +1,8 @@
-name: Log4Shell JNDI Payload Injection with Outbound Connection
-id: 69afee44-5c91-11ec-bf1f-497c9a704a72
-version: 1
-date: '2021-12-13'
 author: Jose Hernandez
-type: Anomaly
 datamodel:
-- Network_Traffic
-- Web
+- Network_Traffic.All_Traffic
+- Web.Web
+date: '2021-12-13'
 description: CVE-2021-44228 Log4Shell payloads can be injected via various methods,
   but on of the most common vectors injection is via Web calls. Many of the vulnerable
   java web applications that are using log4j have a web component to them are specially
@@ -17,6 +13,14 @@ description: CVE-2021-44228 Log4Shell payloads can be injected via various metho
   Specifically it has been successfully exploited via headers like X-Forwarded-For,
   User-Agent, Referer, and X-Api-Version. In this detection we match the invocation
   function with a network connection to a malicious ip address.
+how_to_implement: This detection requires the Web datamodel to be populated from a
+  supported Technology Add-On like Splunk for Apache or Splunk for Nginx.
+id: 69afee44-5c91-11ec-bf1f-497c9a704a72
+known_false_positives: If there is a vulnerablility scannner looking for log4shells
+  this will trigger, otherwise likely to have low false positives.
+name: Log4Shell JNDI Payload Injection with Outbound Connection
+references:
+- https://www.lunasec.io/docs/blog/log4j-zero-day/
 search: '| from datamodel Web.Web | rex field=_raw max_match=0 "[jJnNdDiI]{4}(\:|\%3A|\/|\%2F)(?<proto>\w+)(\:\/\/|\%3A\%2F\%2F)(\$\{.*?\}(\.)?)?(?<affected_host>[a-zA-Z0-9\.\-\_\$]+)"
   | join affected_host type=inner [| tstats `security_content_summariesonly` count
   min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic.All_Traffic
@@ -24,12 +28,6 @@ search: '| from datamodel Web.Web | rex field=_raw max_match=0 "[jJnNdDiI]{4}(\:
   | `security_content_ctime(lastTime)` | rename dest AS affected_host] | fillnull
   | stats count by action, category, dest, dest_port, http_content_type, http_method,
   http_referrer, http_user_agent, site, src, url, url_domain, user | `log4shell_jndi_payload_injection_with_outbound_connection_filter`'
-how_to_implement: This detection requires the Web datamodel to be populated from a
-  supported Technology Add-On like Splunk for Apache or Splunk for Nginx.
-known_false_positives: If there is a vulnerablility scannner looking for log4shells
-  this will trigger, otherwise likely to have low false positives.
-references:
-- https://www.lunasec.io/docs/blog/log4j-zero-day/
 tags:
   analytic_story:
   - Log4Shell CVE-2021-44228
@@ -57,18 +55,19 @@ tags:
   - DE.CM
   observable:
   - name: user
+    role:
+    - Victim
     type: User
-    role:
-    - Victim
   - name: dest
-    type: Hostname
     role:
     - Victim
+    type: Hostname
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
   required_fields:
+  - Network_Traffic.All_Traffic.dest
   - action
   - category
   - dest
@@ -84,3 +83,5 @@ tags:
   - user
   risk_score: 15
   security_domain: threat
+type: Anomaly
+version: 1