Branch was auto-updated.

bin/generate.py

@@ -396,7 +396,27 @@ def add_rba(detection):
     
     return detection
 
-def prepare_detections(detections, deployments, OUTPUT_PATH):
+def add_playbook(detection, playbooks):
+    preface = " The following Splunk SOAR playbook can be used to respond to this detection: "
+    
+    for playbook in playbooks:
+        if detection['name'] in playbook['tags']['detections']:
+            detection['how_to_implement'] = detection['how_to_implement'] + preface + playbook['name']
+    return detection
+
+def map_playbooks_to_stories(playbooks):
+    sto_play = {}
+    for playbook in playbooks:
+        if 'tags' in playbook:
+            if 'analytic_story' in playbook['tags']:
+                for story in playbook['tags']['analytic_story']:
+                    if not (story in sto_play):
+                        sto_play[story] = {playbook['name']}
+                    else:
+                        sto_play[story].add(playbook['name'])
+    return sto_play
+
+def prepare_detections(detections, deployments, playbooks, OUTPUT_PATH):
     for detection in detections:
         # only for DevSecOps
         if global_product == 'DevSecOps':
@@ -436,9 +456,10 @@ def prepare_detections(detections, deployments, OUTPUT_PATH):
                     if key in detection['tags']:
                         mappings[key] = detection['tags'][key]
             detection['mappings'] = mappings
-
+            
             detection = add_annotations(detection)
             detection = add_rba(detection)
+            detection = add_playbook(detection, playbooks)
 
             # add additional metadata
             if 'product' in detection['tags']:
@@ -450,7 +471,7 @@ def prepare_detections(detections, deployments, OUTPUT_PATH):
 
     return detections
 
-def prepare_stories(stories, detections):
+def prepare_stories(stories, detections, playbooks):
     # enrich stories with information from detections: data_models, mitre_ids, kill_chain_phases, nists
     sto_to_data_models = {}
     sto_to_mitre_attack_ids = {}
@@ -459,14 +480,17 @@ def prepare_stories(stories, detections):
     sto_to_nists = {}
     sto_to_det = {}
 
+    preface = " The following Splunk SOAR playbooks can be used in the response to this story's analytics: "
     baselines = [object for object in detections  if 'Baseline' in object['type']]
 
     for detection in detections:
         if detection['type'] == 'Baseline':
+            rule_name = str('ESCU - ' + detection['name'])
             continue
         if 'analytic_story' in detection['tags']:
             for story in detection['tags']['analytic_story']:
-                rule_name = str('ESCU - ' + detection['name'] + ' - Rule')
+                if detection['type'] != "Investigation":
+                    rule_name = str('ESCU - ' + detection['name'] + ' - Rule')
 
                 if story in sto_to_det.keys():
                     sto_to_det[story].add(rule_name)
@@ -510,6 +534,7 @@ def prepare_stories(stories, detections):
 
     sto_res = map_response_tasks_to_stories(detections)
     sto_bas = map_baselines_to_stories(baselines)
+    sto_play = map_playbooks_to_stories(playbooks)
 
     for story in stories:
         story['author_name'], story['author_company'] = parse_author_company(story)
@@ -518,6 +543,9 @@ def prepare_stories(stories, detections):
         story['searches'] = story['detections']
         if story['name'] in sto_to_data_models:
             story['data_models'] = sorted(sto_to_data_models[story['name']])
+        if story['name'] in sto_play:
+            story['description'] = str(story['description']) + preface + str(sto_play[story['name']])
+            story['description'] = story['description'].replace('{', ' ').replace('}', ' ')
         if story['name'] in sto_to_mitre_attack_ids:
             story['mitre_attack'] = sorted(sto_to_mitre_attack_ids[story['name']])
         if story['name'] in sto_to_kill_chain_phases:
@@ -537,6 +565,7 @@ def prepare_stories(stories, detections):
             story['baselines'] = sorted(list(sto_bas[story['name']]))
 
 
+
         keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist']
         mappings = {}
         for key in keys:
@@ -582,6 +611,7 @@ def import_objects(VERBOSE, REPO_PATH):
         "responses": load_objects("responses/*.yml", VERBOSE, REPO_PATH),
         "deployments": load_objects("deployments/*.yml", VERBOSE, REPO_PATH),
         "detections": load_objects("detections/*/*.yml", VERBOSE, REPO_PATH),
+        "playbooks": load_objects("playbooks/*.yml", VERBOSE, REPO_PATH),
     }
     objects["detections"].extend(load_objects("detections/*/*/*.yml", VERBOSE, REPO_PATH))
 
@@ -604,8 +634,8 @@ def compute_objects(objects, PRODUCT, OUTPUT_PATH):
 
     objects["macros"] = sorted(objects["macros"], key=lambda m: m['name'])
 
-    objects["detections"] = prepare_detections(objects["detections"], objects["deployments"], OUTPUT_PATH)
-    objects["stories"] = prepare_stories(objects["stories"], objects["detections"])
+    objects["detections"] = prepare_detections(objects["detections"], objects["deployments"], objects["playbooks"], OUTPUT_PATH)
+    objects["stories"] = prepare_stories(objects["stories"], objects["detections"], objects["playbooks"])
 
     return objects
 

dist/escu/default/analytic_stories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-09-09T22:26:38 UTC
+# On Date: 2021-09-23T18:33:39 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -14,7 +14,7 @@ modification_date = 2018-06-04
 id = 2f2f610a-d64d-48c2-b57c-967a2b49ab5a
 version = 1
 reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"]
-detection_searches = ["ESCU - AWS Investigate User Activities By AccessKeyId - Rule", "ESCU - Get Notable History - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect sts get session token abuse - Rule"]
+detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect sts get session token abuse - Rule"]
 mappings = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078", "T1550"]}
 investigative_searches = ["ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"]
 support_searches = ["ESCU - Previously Seen AWS Cross Account Activity"]
@@ -51,7 +51,7 @@ modification_date = 2018-05-21
 id = 2e8948a5-5239-406b-b56b-6c50ff268af4
 version = 2
 reference = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"]
-detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule"]
+detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"]
 mappings = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1562.007"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC"]}
 investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
 support_searches = ["ESCU - Baseline of Network ACL Activity by ARN", "ESCU - Baseline of blocked outbound traffic from AWS"]
@@ -68,7 +68,7 @@ modification_date = 2020-08-04
 id = 2f2f610a-d64d-48c2-b57c-96722b49ab5a
 version = 1
 reference = ["https://aws.amazon.com/security-hub/features/"]
-detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule"]
+detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"]
 mappings = {"cis20": ["CIS 13"], "nist": ["DE.AE", "DE.DP"]}
 investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"]
 support_searches = []
@@ -85,7 +85,7 @@ modification_date = 2018-03-12
 id = 2e8948a5-5239-406b-b56b-6c50f1269af3
 version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"]
-detection_searches = ["ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS User Activities by user field - Rule"]
+detection_searches = ["ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop"]
 mappings = {"cis20": ["CIS 1", "CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1526"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC", "PR.DS"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"]
 support_searches = ["ESCU - Baseline of API Calls per User ARN", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Create a list of approved AWS service accounts", "ESCU - Previously seen API call per user roles in CloudTrail"]
@@ -105,8 +105,8 @@ modification_date = 2021-08-20
 id = 8460679c-2b21-463e-b381-b813417c32f2
 version = 1
 reference = ["https://attack.mitre.org/tactics/TA0007/", "https://adsecurity.org/?p=2535", "https://attack.mitre.org/techniques/T1087/001/", "https://attack.mitre.org/techniques/T1087/002/", "https://attack.mitre.org/techniques/T1087/003/", "https://attack.mitre.org/techniques/T1482/", "https://attack.mitre.org/techniques/T1201/", "https://attack.mitre.org/techniques/T1069/001/", "https://attack.mitre.org/techniques/T1069/002/", "https://attack.mitre.org/techniques/T1018/", "https://attack.mitre.org/techniques/T1049/", "https://attack.mitre.org/techniques/T1033/"]
-detection_searches = ["ESCU - AdsiSearcher Account Discovery - Rule", "ESCU - Domain Account Discovery With Net App - Rule", "ESCU - Domain Account Discovery with Dsquery - Rule", "ESCU - Domain Account Discovery with Wmic - Rule", "ESCU - Get ADDefaultDomainPasswordPolicy with Powershell - Rule", "ESCU - Get ADDefaultDomainPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get ADUser with PowerShell - Rule", "ESCU - Get ADUser with PowerShell Script Block - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainPolicy with Powershell - Rule", "ESCU - Get DomainPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - GetLocalUser with PowerShell - Rule", "ESCU - GetLocalUser with PowerShell Script Block - Rule", "ESCU - GetWmiObject DS User with PowerShell - Rule", "ESCU - GetWmiObject DS User with PowerShell Script Block - Rule", "ESCU - GetWmiObject User Account with PowerShell - Rule", "ESCU - GetWmiObject User Account with PowerShell Script Block - Rule", "ESCU - Local Account Discovery With Wmic - Rule", "ESCU - Local Account Discovery with Net - Rule", "ESCU - Password Policy Discovery with Net - Rule"]
-mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.001", "T1087.002", "T1201"]}
+detection_searches = ["ESCU - AdsiSearcher Account Discovery - Rule", "ESCU - DSQuery Domain Discovery - Rule", "ESCU - Domain Account Discovery With Net App - Rule", "ESCU - Domain Account Discovery with Dsquery - Rule", "ESCU - Domain Account Discovery with Wmic - Rule", "ESCU - Domain Controller Discovery with Nltest - Rule", "ESCU - Domain Controller Discovery with Wmic - Rule", "ESCU - Domain Group Discovery With Dsquery - Rule", "ESCU - Domain Group Discovery With Net - Rule", "ESCU - Domain Group Discovery With Wmic - Rule", "ESCU - Domain Group Discovery with Adsisearcher - Rule", "ESCU - Elevated Group Discovery With Net - Rule", "ESCU - Elevated Group Discovery With Wmic - Rule", "ESCU - Elevated Group Discovery with PowerView - Rule", "ESCU - Get ADDefaultDomainPasswordPolicy with Powershell - Rule", "ESCU - Get ADDefaultDomainPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get ADUser with PowerShell - Rule", "ESCU - Get ADUser with PowerShell Script Block - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainPolicy with Powershell - Rule", "ESCU - Get DomainPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Get WMIObject Group Discovery - Rule", "ESCU - Get WMIObject Group Discovery with Script Block Logging - Rule", "ESCU - Get-DomainTrust with PowerShell - Rule", "ESCU - Get-DomainTrust with PowerShell Script Block - Rule", "ESCU - Get-ForestTrust with PowerShell - Rule", "ESCU - Get-ForestTrust with PowerShell Script Block - Rule", "ESCU - GetAdComputer with PowerShell - Rule", "ESCU - GetAdComputer with PowerShell Script Block - Rule", "ESCU - GetAdGroup with PowerShell - Rule", "ESCU - GetAdGroup with PowerShell Script Block - Rule", "ESCU - GetCurrent User with PowerShell - Rule", "ESCU - GetCurrent User with PowerShell Script Block - Rule", "ESCU - GetDomainComputer with PowerShell - Rule", "ESCU - GetDomainComputer with PowerShell Script Block - Rule", "ESCU - GetDomainController with PowerShell - Rule", "ESCU - GetDomainController with PowerShell Script Block - Rule", "ESCU - GetDomainGroup with PowerShell - Rule", "ESCU - GetDomainGroup with PowerShell Script Block - Rule", "ESCU - GetLocalUser with PowerShell - Rule", "ESCU - GetLocalUser with PowerShell Script Block - Rule", "ESCU - GetNetTcpconnection with PowerShell - Rule", "ESCU - GetNetTcpconnection with PowerShell Script Block - Rule", "ESCU - GetWmiObject DS User with PowerShell - Rule", "ESCU - GetWmiObject DS User with PowerShell Script Block - Rule", "ESCU - GetWmiObject Ds Computer with PowerShell - Rule", "ESCU - GetWmiObject Ds Computer with PowerShell Script Block - Rule", "ESCU - GetWmiObject Ds Group with PowerShell - Rule", "ESCU - GetWmiObject Ds Group with PowerShell Script Block - Rule", "ESCU - GetWmiObject User Account with PowerShell - Rule", "ESCU - GetWmiObject User Account with PowerShell Script Block - Rule", "ESCU - Local Account Discovery With Wmic - Rule", "ESCU - Local Account Discovery with Net - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Net Localgroup Discovery - Rule", "ESCU - Network Connection Discovery With Arp - Rule", "ESCU - Network Connection Discovery With Net - Rule", "ESCU - Network Connection Discovery With Netstat - Rule", "ESCU - Password Policy Discovery with Net - Rule", "ESCU - PowerShell Get LocalGroup Discovery - Rule", "ESCU - Powershell Get LocalGroup Discovery with Script Block Logging - Rule", "ESCU - Remote System Discovery with Adsisearcher - Rule", "ESCU - Remote System Discovery with Dsquery - Rule", "ESCU - Remote System Discovery with Net - Rule", "ESCU - Remote System Discovery with Wmic - Rule", "ESCU - System User Discovery With Query - Rule", "ESCU - System User Discovery With Whoami - Rule", "ESCU - User Discovery With Env Vars PowerShell - Rule", "ESCU - User Discovery With Env Vars PowerShell Script Block - Rule", "ESCU - Wmic Group Discovery - Rule"]
+mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation", "Reconnaissance"], "mitre_attack": ["T1018", "T1033", "T1049", "T1069.001", "T1069.002", "T1087.001", "T1087.002", "T1201", "T1482"], "nist": ["DE.CM", "PR.PT"]}
 investigative_searches = []
 support_searches = []
 data_models = ["Endpoint"]
@@ -142,7 +142,7 @@ modification_date = 2018-12-06
 id = 2dcfd6a2-e7d2-4873-b6ba-adaf819d2a1e
 version = 1
 reference = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"]
-detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - Investigate Suspicious Strings in HTTP Header - Rule", "ESCU - Investigate Web POSTs From src - Rule", "ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule"]
+detection_searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 18", "CIS 3", "CIS 4", "CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation"], "mitre_attack": ["T1082"], "nist": ["DE.AE", "DE.CM", "ID.RA", "PR.IP", "PR.MA", "PR.PT", "RS.MI"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"]
 support_searches = []
@@ -172,7 +172,7 @@ modification_date = 2017-09-13
 id = 91c676cf-0b23-438d-abee-f6335e1fce77
 version = 1
 reference = ["https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/"]
-detection_searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Rule", "ESCU - Get Notable History - Rule"]
+detection_searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"]
 mappings = {"cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Reconnaissance"], "nist": ["ID.AM", "PR.DS"]}
 investigative_searches = ["ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task", "ESCU - Get Notable History - Response Task"]
 support_searches = ["ESCU - Count of assets by category"]
@@ -240,7 +240,7 @@ modification_date = 2017-12-19
 id = 91c676cf-0b23-438d-abee-f6335e1fce78
 version = 1
 reference = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"]
-detection_searches = ["ESCU - Get Email Info - Rule", "ESCU - Get Emails From Specific Sender - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule"]
+detection_searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule"]
 mappings = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery"], "nist": ["PR.IP"]}
 investigative_searches = ["ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
 support_searches = ["ESCU - DNSTwist Domain Names"]
@@ -276,7 +276,7 @@ modification_date = 2019-10-02
 id = 3b96d13c-fdc7-45dd-b3ad-c132b31cdd2a
 version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
-detection_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS activities via region name - Rule"]
+detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]}
 investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
 support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Compute Creations By User - Initial", "ESCU - Previously Seen Cloud Compute Creations By User - Update", "ESCU - Previously Seen Cloud Compute Images - Initial", "ESCU - Previously Seen Cloud Compute Images - Update", "ESCU - Previously Seen Cloud Compute Instance Types - Initial", "ESCU - Previously Seen Cloud Compute Instance Types - Update", "ESCU - Previously Seen Cloud Regions - Initial", "ESCU - Previously Seen Cloud Regions - Update"]
@@ -339,7 +339,7 @@ modification_date = 2019-01-09
 id = bd91a2bc-d20b-4f44-a982-1bea98e86390
 version = 1
 reference = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"]
-detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - Investigate Network Traffic From src ip - Rule", "ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule"]
+detection_searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule"]
 mappings = {"cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Command and Control", "Installation"], "nist": ["DE.CM", "DE.DP", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"]
 support_searches = []
@@ -358,7 +358,7 @@ modification_date = 2020-02-03
 id = 8e03c61e-13c4-4dcd-bfbe-5ce5a8dc031a
 version = 1
 reference = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"]
-detection_searches = ["ESCU - Detect Renamed 7-Zip - Rule", "ESCU - Detect Renamed WinRAR - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule"]
+detection_searches = ["ESCU - Detect Renamed 7-Zip - Rule", "ESCU - Detect Renamed WinRAR - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule"]
 mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exfiltration", "Exploitation"], "mitre_attack": ["T1036", "T1114.001", "T1114.002", "T1560.001"], "nist": ["DE.AE", "DE.CM", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
@@ -377,7 +377,7 @@ modification_date = 2018-06-01
 id = 943773c6-c4de-4f38-89a8-0b92f98804d8
 version = 1
 reference = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"]
-detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"]
+detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 11", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exfiltration", "Exploitation"], "mitre_attack": ["T1048", "T1048.003", "T1071.001", "T1071.004", "T1095", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
 support_searches = ["ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of blocked outbound traffic from AWS"]
@@ -412,7 +412,7 @@ modification_date = 2020-02-04
 id = 854d78bf-d0e2-4f4e-b05c-640905f86d7a
 version = 3
 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"]
-detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Rule", "ESCU - Investigate Pass the Hash Attempts - Rule", "ESCU - Investigate Pass the Ticket Attempts - Rule", "ESCU - Investigate Previous Unseen User - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"]
+detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"]
 mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Lateral Movement", "Privilege Escalation"], "mitre_attack": ["T1003.001", "T1003.002", "T1003.003", "T1059.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]}
 investigative_searches = ["ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"]
 support_searches = []
@@ -431,7 +431,7 @@ modification_date = 2020-01-22
 id = 0c016e5c-88be-4e2c-8c6c-c2b55b4fb4ef
 version = 2
 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"]
-detection_searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process File Activity - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule"]
+detection_searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 2", "CIS 3", "CIS 5", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Execution", "Exploitation", "Installation", "Lateral Movement"], "mitre_attack": ["T1021.002", "T1053.005", "T1059.001", "T1059.003", "T1071.002", "T1112", "T1136.001", "T1204.002", "T1543.003", "T1547.001", "T1562.004", "T1569.002"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"]
 support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"]
@@ -451,7 +451,7 @@ modification_date = 2016-09-13
 id = e8afd39e-3294-11e6-b39d-a45e60c6700
 version = 1
 reference = ["https://www.us-cert.gov/ncas/alerts/TA13-088A", "https://www.imperva.com/learn/application-security/dns-amplification/"]
-detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - Large Volume of DNS ANY Queries - Rule"]
+detection_searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Large Volume of DNS ANY Queries - Rule"]
 mappings = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1498.002"], "nist": ["DE.AE", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
 support_searches = []
@@ -469,7 +469,7 @@ modification_date = 2020-02-04
 id = 8169f17b-ef68-4b59-aa28-586907301221
 version = 1
 reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"]
-detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get DNS Server History for a host - Rule"]
+detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1048.003", "T1071.004", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task"]
 support_searches = ["ESCU - Discover DNS records"]
@@ -511,7 +511,7 @@ modification_date = 2020-10-21
 id = 66b0fe0c-1351-11eb-adc1-0242ac120002
 version = 1
 reference = ["https://attack.mitre.org/tactics/TA0010/"]
-detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get Notable History - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule"]
+detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule"]
 mappings = {"cis20": ["CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Exfiltration", "Exploitation"], "mitre_attack": ["T1041", "T1048", "T1048.003", "T1114", "T1114.001", "T1114.003", "T1537"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.DS"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
 support_searches = []
@@ -528,7 +528,7 @@ modification_date = 2017-09-14
 id = 91c676cf-0b23-438d-abee-f6335e1fce33
 version = 1
 reference = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"]
-detection_searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule"]
+detection_searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1048.003", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.DS", "PR.PT"]}
 investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
 support_searches = []
@@ -562,7 +562,7 @@ modification_date = 2020-09-18
 id = 5d14a962-569e-4578-939f-f386feb63ce4
 version = 1
 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://github.com/SecuraBV/CVE-2020-1472", "https://www.secura.com/blog/zero-logon", "https://nvd.nist.gov/vuln/detail/CVE-2020-1472"]
-detection_searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Get Notable History - Rule"]
+detection_searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"]
 mappings = {"cis20": ["CIS 11", "CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1003.001", "T1190", "T1210"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
 support_searches = []
@@ -596,7 +596,7 @@ modification_date = 2020-02-04
 id = fcc27099-46a0-46b0-a271-5c7dab56b6f1
 version = 2
 reference = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"]
-detection_searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule"]
+detection_searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1112", "T1543.003", "T1553.004", "T1562.001", "T1562.004"], "nist": ["DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"]
@@ -630,7 +630,7 @@ modification_date = 2018-09-06
 id = 8169f17b-ef68-4b59-aae8-586907301221
 version = 2
 reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"]
-detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule"]
+detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1048", "T1071.001", "T1189"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.DS", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
 support_searches = []
@@ -647,7 +647,7 @@ modification_date = 2020-01-27
 id = bb9f5ed2-916e-4364-bb6d-91c310efcf52
 version = 1
 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"]
-detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"]
+detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 2", "CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation", "Installation"], "mitre_attack": ["T1021.002", "T1059.003", "T1072", "T1547.001", "T1566.001"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"]
 support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Baseline of SMB Traffic - MLTK"]
@@ -666,7 +666,7 @@ modification_date = 2020-08-02
 id = 7678c968-d46e-11ea-87d0-0242ac130003
 version = 1
 reference = ["https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/", "https://support.f5.com/csp/article/K52145254", "https://blog.cloudflare.com/cve-2020-5902-helping-to-protect-against-the-f5-tmui-rce-vulnerability/"]
-detection_searches = ["ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule", "ESCU - Get Notable History - Rule"]
+detection_searches = ["ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"]
 mappings = {"cis20": ["CIS 11", "CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
 support_searches = []
@@ -683,7 +683,7 @@ modification_date = 2020-09-01
 id = 0432039c-ef41-4b03-b157-450c25dad1e6
 version = 1
 reference = ["https://cloud.google.com/iam/docs/understanding-service-accounts"]
-detection_searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - Get Notable History - Rule", "ESCU - gcp detect oauth token abuse - Rule"]
+detection_searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - gcp detect oauth token abuse - Rule"]
 mappings = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
 support_searches = []
@@ -721,7 +721,7 @@ modification_date = 2020-01-22
 id = baf7580b-d4b4-4774-8173-7d198e9da335
 version = 2
 reference = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"]
-detection_searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule"]
+detection_searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1021.001", "T1021.002", "T1048.003", "T1059.001", "T1059.003", "T1070.005", "T1071.002", "T1071.004"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"]
 support_searches = ["ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"]
@@ -775,7 +775,7 @@ modification_date = 2017-09-14
 id = 1f5294cb-b85f-4c2d-9c58-ffcf248f52bd
 version = 1
 reference = ["http://www.deependresearch.org/2016/04/jboss-exploits-view-from-victim.html"]
-detection_searches = ["ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Get Notable History - Rule"]
+detection_searches = ["ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 18", "CIS 4"], "kill_chain_phases": ["Delivery", "Reconnaissance"], "mitre_attack": ["T1082"], "nist": ["DE.AE", "DE.CM", "ID.RA", "PR.IP", "PR.MA", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
 support_searches = []
@@ -806,7 +806,7 @@ modification_date = 2020-04-15
 id = a9ef59cf-e981-4e66-9eef-bb049f695c09
 version = 1
 reference = ["https://github.com/splunk/cloud-datamodel-security-research"]
-detection_searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes activity by src ip - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes activity by src ip - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Get Notable History - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule"]
+detection_searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP GCR container uploaded - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule"]
 mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]}
 investigative_searches = ["ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"]
 support_searches = []
@@ -823,7 +823,7 @@ modification_date = 2020-05-20
 id = 2574e6d9-7254-4751-8925-0447deeec8ea
 version = 1
 reference = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"]
-detection_searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Get Notable History - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule"]
+detection_searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule"]
 mappings = {"kill_chain_phases": ["Lateral Movement"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
 support_searches = []
@@ -840,7 +840,7 @@ modification_date = 2020-02-04
 id = 399d65dc-1f08-499b-a259-aad9051f38ad
 version = 2
 reference = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"]
-detection_searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule"]
+detection_searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule"]
 mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Execution", "Exploitation", "Lateral Movement"], "mitre_attack": ["T1021.001", "T1021.002", "T1053.005", "T1550.002", "T1558.003", "T1569.002"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"]
 support_searches = []
@@ -861,7 +861,7 @@ modification_date = 2017-08-23
 id = 2c8ff66e-0b57-42af-8ad7-912438a403fc
 version = 5
 reference = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
-detection_searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - PowerShell 4104 Hunting - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule"]
+detection_searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - PowerShell 4104 Hunting - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation", "Installation", "Privilege Escalation", "Reconnaissance"], "mitre_attack": ["T1003", "T1027", "T1027.005", "T1055", "T1059.001", "T1140", "T1546.015", "T1562", "T1592"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
@@ -927,7 +927,7 @@ modification_date = 2021-09-08
 id = 4ad4253e-10ca-11ec-8235-acde48001122
 version = 1
 reference = ["https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/09/windows-mshtml-zero-day-actively-exploited-mitigations-required/", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444", "https://www.echotrail.io/insights/search/control.exe"]
-detection_searches = ["ESCU - Control Loading from World Writable Directory - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule"]
+detection_searches = ["ESCU - Control Loading from World Writable Directory - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Product Writing cab or inf - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule"]
 mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.002", "T1218.011", "T1566.001"]}
 investigative_searches = []
 support_searches = []
@@ -946,7 +946,7 @@ modification_date = 2017-09-15
 id = 9ef8d677-7b52-4213-a038-99cfc7acc2d8
 version = 1
 reference = ["https://learn.cisecurity.org/20-controls-download"]
-detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - No Windows Updates in a time frame - Rule"]
+detection_searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - No Windows Updates in a time frame - Rule"]
 mappings = {"cis20": ["CIS 18"], "nist": ["PR.MA", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
 support_searches = []
@@ -982,7 +982,7 @@ modification_date = 2017-01-05
 id = 2b1800dd-92f9-47ec-a981-fdf1351e5f65
 version = 1
 reference = ["https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"]
-detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule"]
+detection_searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule"]
 mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["DE.CM", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"]
@@ -1017,7 +1017,7 @@ modification_date = 2020-01-22
 id = bb9f5ed2-916e-4364-bb6d-97c370efcf52
 version = 2
 reference = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"]
-detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"]
+detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"]
 mappings = {"cis20": ["CIS 2", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1059.001", "T1059.003", "T1543.003", "T1569.002"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = ["ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously Seen Running Windows Services - Update", "ESCU - Previously seen command line arguments"]
@@ -1054,7 +1054,7 @@ modification_date = 2020-01-22
 id = 988C59C5-0A1C-45B6-A555-0C62276E327E
 version = 1
 reference = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"]
-detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
+detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1059.001", "T1059.003", "T1547.001"], "nist": ["DE.AE", "DE.CM", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"]
@@ -1120,7 +1120,7 @@ modification_date = 2017-09-11
 id = 6d13121c-90f3-446d-8ac3-27efbbc65218
 version = 1
 reference = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"]
-detection_searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Inbound Traffic In Firewall Rule - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"]
+detection_searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Inbound Traffic In Firewall Rule - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation"], "mitre_attack": ["T1021", "T1021.001", "T1048", "T1048.003", "T1071.001", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.DS", "PR.PT"]}
 investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"]
 support_searches = []
@@ -1158,13 +1158,13 @@ modification_date = 2020-02-04
 id = cf309d0d-d4aa-4fbb-963d-1e79febd3756
 version = 1
 reference = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
-detection_searches = ["ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - Get Backup Logs For Endpoint - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Sysmon WMI Activity for Host - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Rundll32 LockWorkStation - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule"]
+detection_searches = ["ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule"]
 mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exfiltration", "Exploitation", "Privilege Escalation", "Reconnaissance"], "mitre_attack": ["T1020", "T1021.002", "T1027.005", "T1036.003", "T1047", "T1048", "T1053.005", "T1059.005", "T1069.001", "T1069.002", "T1070", "T1070.001", "T1070.004", "T1071.001", "T1087.001", "T1087.002", "T1112", "T1204", "T1218.003", "T1218.007", "T1218.011", "T1222", "T1482", "T1485", "T1489", "T1490", "T1491", "T1531", "T1546.015", "T1547.001", "T1548", "T1560.001", "T1562.001", "T1562.007", "T1569.002", "T1574.002", "T1592"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Rundll32 LockWorkStation - Response Task"]
 support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK"]
 data_models = ["Email", "Endpoint", "Network_Traffic"]
 providing_technologies = none
-description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
+description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Ransomware Investigate and Contain' 
 narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware.
 product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']
 
@@ -1175,7 +1175,7 @@ modification_date = 2020-10-27
 id = f52f6c43-05f8-4b19-a9d3-5b8c56da91c2
 version = 1
 reference = ["https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/", "https://github.com/d1vious/git-wild-hunt", "https://www.youtube.com/watch?v=PgzNib37g0M"]
-detection_searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - Get Notable History - Rule"]
+detection_searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"]
 mappings = {"mitre_attack": ["T1486"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
 support_searches = []
@@ -1209,7 +1209,7 @@ modification_date = 2017-09-12
 id = 91c676cf-0b23-438d-abee-f6335e177e77
 version = 1
 reference = ["https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html", "https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html"]
-detection_searches = ["ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Get Notable History - Rule"]
+detection_searches = ["ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Reconnaissance"], "mitre_attack": ["T1020.001", "T1200", "T1498", "T1542.005", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
 support_searches = []
@@ -1227,7 +1227,7 @@ modification_date = 2020-11-06
 id = 507edc74-13d5-4339-878e-b9744ded1f35
 version = 1
 reference = ["https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html", "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"]
-detection_searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Get Notable History - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Windows connhost exe started forcefully - Rule"]
+detection_searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Windows connhost exe started forcefully - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Lateral Movement", "Privilege Escalation", "Reconnaissance"], "mitre_attack": ["T1021.001", "T1053.005", "T1059.003", "T1482", "T1485", "T1486", "T1489", "T1490", "T1562.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
 support_searches = []
@@ -1244,7 +1244,7 @@ modification_date = 2017-09-19
 id = 4f6632f5-449c-4686-80df-57625f59bab3
 version = 1
 reference = ["https://capec.mitre.org/data/definitions/66.html", "https://www.incapsula.com/web-application-security/sql-injection.html"]
-detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - SQL Injection with Long URLs - Rule"]
+detection_searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - SQL Injection with Long URLs - Rule"]
 mappings = {"cis20": ["CIS 13", "CIS 18", "CIS 4"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM", "ID.RA", "PR.DS", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
 support_searches = []
@@ -1262,7 +1262,7 @@ modification_date = 2018-12-13
 id = c4b89506-fbcf-4cb7-bfd6-527e54789604
 version = 1
 reference = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"]
-detection_searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Get Backup Logs For Endpoint - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule"]
+detection_searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule"]
 mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 16", "CIS 18", "CIS 2", "CIS 3", "CIS 4", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Execution", "Exploitation", "Installation", "Lateral Movement", "Reconnaissance"], "mitre_attack": ["T1003", "T1021.001", "T1021.002", "T1036.005", "T1082", "T1204.002", "T1485", "T1486", "T1490", "T1569.002", "T1595"], "nist": ["DE.AE", "DE.CM", "ID.AM", "ID.RA", "PR.AC", "PR.DS", "PR.IP", "PR.MA", "PR.PT"]}
 investigative_searches = ["ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"]
 support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security"]
@@ -1301,7 +1301,7 @@ modification_date = 2019-04-29
 id = 57226b40-94f3-4ce5-b101-a75f67759c27
 version = 1
 reference = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"]
-detection_searches = ["ESCU - Detect Outlook exe writing a zip file - Rule", "ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule"]
+detection_searches = ["ESCU - Detect Outlook exe writing a zip file - Rule", "ESCU - Excel Spawning PowerShell - Rule", "ESCU - Excel Spawning Windows Script Host - Rule", "ESCU - MSHTML Module Load in Office Product - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Creating Schedule Task - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Document Spawned Child Process To Download - Rule", "ESCU - Office Product Spawning BITSAdmin - Rule", "ESCU - Office Product Spawning CertUtil - Rule", "ESCU - Office Product Spawning MSHTA - Rule", "ESCU - Office Product Spawning Rundll32 with no DLL - Rule", "ESCU - Office Product Spawning Wmic - Rule", "ESCU - Office Product Writing cab or inf - Rule", "ESCU - Office Spawning Control - Rule", "ESCU - Process Creating LNK file in Suspicious Location - Rule", "ESCU - Winword Spawning Cmd - Rule", "ESCU - Winword Spawning PowerShell - Rule"]
 mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation"], "mitre_attack": ["T1003.002", "T1566.001", "T1566.002"], "nist": ["ID.AM", "PR.DS"]}
 investigative_searches = []
 support_searches = []
@@ -1325,7 +1325,7 @@ modification_date = 2019-05-01
 id = 2e8948a5-5239-406b-b56b-6c59f1268af3
 version = 1
 reference = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"]
-detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule"]
+detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule"]
 mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP"]}
 investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"]
 support_searches = ["ESCU - Previously seen users in CloudTrail", "ESCU - Update previously seen users in CloudTrail"]
@@ -1342,7 +1342,7 @@ modification_date = 2018-07-24
 id = 2e8948a5-5239-406b-b56b-6c50w3168af3
 version = 2
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"]
-detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS S3 Bucket details via bucketName - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS activities via region name - Rule"]
+detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop"]
 mappings = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.CM", "DE.DP", "PR.AC", "PR.DS"]}
 investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
 support_searches = ["ESCU - Baseline of S3 Bucket deletion activity by ARN", "ESCU - Previously seen S3 bucket access by remote IP"]
@@ -1361,7 +1361,7 @@ modification_date = 2018-05-07
 id = 2e8948a5-5239-406b-b56b-6c50f2168af3
 version = 1
 reference = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"]
-detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule"]
+detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"]
 mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "nist": ["DE.AE", "DE.CM", "PR.AC"]}
 investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
 support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS"]
@@ -1381,7 +1381,7 @@ modification_date = 2020-06-04
 id = 6380ebbb-55c5-4fce-b754-01fd565fb73c
 version = 1
 reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"]
-detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS User Activities by user field - Rule"]
+detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Identify Systems Using Remote Desktop"]
 mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.AE", "DE.DP", "PR.AC", "PR.DS"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"]
 support_searches = ["ESCU - Previously Seen AWS Cross Account Activity - Initial", "ESCU - Previously Seen AWS Cross Account Activity - Update", "ESCU - Previously Seen Users In CloudTrail - Update", "ESCU - Previously Seen Users in CloudTrail - Initial"]
@@ -1399,7 +1399,7 @@ modification_date = 2020-08-25
 id = 8168ca88-392e-42f4-85a2-767579c660ce
 version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
-detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Get All AWS Activity From IP Address - Rule"]
+detection_searches = ["ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1537"], "nist": ["DE.AE", "DE.CM", "DE.DP", "ID.AM", "PR.AC", "PR.DS"]}
 investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"]
 support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Previously Seen Cloud Instance Modifications By User - Update"]
@@ -1416,7 +1416,7 @@ modification_date = 2018-08-20
 id = 51045ded-1575-4ba6-aef7-af6c73cffd86
 version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"]
-detection_searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Get Notable History - Rule"]
+detection_searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"]
 mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
 support_searches = ["ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial", "ESCU - Previously Seen Cloud Provisioning Activity Sources - Update"]
@@ -1434,7 +1434,7 @@ modification_date = 2020-09-04
 id = 1ed5ce7d-5469-4232-92af-89d1a3595b39
 version = 1
 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"]
-detection_searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule"]
+detection_searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS IAM Successful Group Deletion - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"], "mitre_attack": ["T1078", "T1078.004", "T1580"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC"]}
 investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"]
 support_searches = ["ESCU - Baseline Of Cloud Infrastructure API Calls Per User", "ESCU - Baseline Of Cloud Security Group API Calls Per User", "ESCU - Previously Seen Cloud API Calls Per User Role - Initial", "ESCU - Previously Seen Cloud API Calls Per User Role - Update"]
@@ -1452,7 +1452,7 @@ modification_date = 2020-02-03
 id = f4368ddf-d59f-4192-84f6-778ac5a3ffc7
 version = 2
 reference = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"]
-detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
+detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1036.003", "T1059.001", "T1059.003"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"]
@@ -1489,7 +1489,7 @@ modification_date = 2017-09-18
 id = 3c3835c0-255d-4f9e-ab84-e29ec9ec9b56
 version = 1
 reference = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"]
-detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule"]
+detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get ADUserResultantPasswordPolicy with Powershell Script Block - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"]
 mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1048", "T1048.003", "T1071.004", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"]
 support_searches = ["ESCU - Baseline of DNS Query Length - MLTK"]
@@ -1506,7 +1506,7 @@ modification_date = 2020-01-27
 id = 2b1800dd-92f9-47ec-a981-fdf1351e5d55
 version = 1
 reference = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"]
-detection_searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get Email Info - Rule", "ESCU - Get Emails From Specific Sender - Rule", "ESCU - Get Notable History - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"]
+detection_searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 3", "CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.AE", "PR.IP"]}
 investigative_searches = ["ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"]
 support_searches = ["ESCU - DNSTwist Domain Names"]
@@ -1527,7 +1527,7 @@ modification_date = 2020-08-05
 id = 4d656b2e-d6be-11ea-87d0-0242ac130003
 version = 1
 reference = ["https://cloud.google.com/blog/product/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security", "https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/"]
-detection_searches = ["ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Get Notable History - Rule"]
+detection_searches = ["ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"]
 mappings = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.CM", "PR.AC", "PR.DS"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
 support_searches = []
@@ -1544,7 +1544,7 @@ modification_date = 2021-01-20
 id = 2b1800dd-92f9-47dd-a981-fdf13w1q5d55
 version = 2
 reference = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/techniques/T1218/005/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5"]
-detection_searches = ["ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule"]
+detection_searches = ["ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule"]
 mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1059.003", "T1218.005", "T1547.001"], "nist": ["DE.AE", "DE.CM", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"]
@@ -1573,7 +1573,7 @@ modification_date = 2020-04-02
 id = 9cbd34af-8f39-4476-a423-bacd126c750b
 version = 1
 reference = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"]
-detection_searches = ["ESCU - Investigate Okta Activity by IP Address - Rule", "ESCU - Investigate Okta Activity by app - Rule", "ESCU - Investigate User Activities In Okta - Rule", "ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule"]
+detection_searches = ["ESCU - Identify Systems Using Remote Desktop", "ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule"]
 mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]}
 investigative_searches = ["ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task"]
 support_searches = []
@@ -1643,7 +1643,7 @@ modification_date = 2018-10-23
 id = c8ddc5be-69bc-4202-b3ab-4010b27d7ad5
 version = 2
 reference = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"]
-detection_searches = ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Sysmon WMI Activity for Host - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule"]
+detection_searches = ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1047", "T1546.003"], "nist": ["PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"]
 support_searches = []
@@ -1660,7 +1660,7 @@ modification_date = 2018-05-31
 id = 2b1800dd-92f9-47dd-a981-fdf1351e5d55
 version = 1
 reference = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"]
-detection_searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule"]
+detection_searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.001", "T1546.011", "T1546.012", "T1547.001", "T1547.010", "T1548.002", "T1564.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
@@ -1679,7 +1679,7 @@ modification_date = 2020-04-13
 id = aa3749a6-49c7-491e-a03f-4eaee5fe0258
 version = 1
 reference = ["https://blog.rapid7.com/2020/04/02/dispelling-zoom-bugbears-what-you-need-to-know-about-the-latest-zoom-vulnerabilities/", "https://threatpost.com/two-zoom-zero-day-flaws-uncovered/154337/"]
-detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Child Process of Zoom - Rule", "ESCU - Get Process File Activity - Rule"]
+detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Child Process of Zoom - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1059.003", "T1068"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get Process File Activity - Response Task"]
 support_searches = ["ESCU - Previously Seen Zoom Child Processes - Initial", "ESCU - Previously Seen Zoom Child Processes - Update"]
@@ -1762,7 +1762,7 @@ modification_date = 2020-02-04
 id = f4368e3f-d59f-4192-84f6-748ac5a3ddb6
 version = 2
 reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
-detection_searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule"]
+detection_searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule"]
 mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Denial of Service", "Exploitation", "Installation", "Privilege Escalation"], "mitre_attack": ["T1003", "T1016", "T1036.003", "T1036.005", "T1190", "T1204.002", "T1218.011", "T1595"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = ["ESCU - Baseline of Command Line Length - MLTK"]
@@ -1781,7 +1781,7 @@ modification_date = 2017-09-15
 id = 826e6431-aeef-41b4-9fc0-6d0985d65a21
 version = 1
 reference = ["https://www.monkey.org/~dugsong/dsniff/"]
-detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Protocols passing authentication in cleartext - Rule"]
+detection_searches = ["ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Protocols passing authentication in cleartext - Rule"]
 mappings = {"cis20": ["CIS 14", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"], "nist": ["DE.AE", "PR.AC", "PR.DS", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"]
 support_searches = []
@@ -1798,7 +1798,7 @@ modification_date = 2020-07-28
 id = 36dbb206-d073-11ea-87d0-0242ac130003
 version = 1
 reference = ["https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", "https://support.microsoft.com/en-au/help/4569509/windows-dns-server-remote-code-execution-vulnerability"]
-detection_searches = ["ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Get Notable History - Rule"]
+detection_searches = ["ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule"]
 mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task"]
 support_searches = []
@@ -1815,7 +1815,7 @@ modification_date = 2018-05-31
 id = 56e24a28-5003-4047-b2db-e8f3c4618064
 version = 1
 reference = ["https://attack.mitre.org/wiki/Defense_Evasion"]
-detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"]
+detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"]
 mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1222.001", "T1548.002", "T1562.001", "T1564.001"], "nist": ["DE.CM", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
@@ -1832,7 +1832,7 @@ modification_date = 2018-01-26
 id = 30552a76-ac78-48e4-b3c0-de4e34e9563d
 version = 1
 reference = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"]
-detection_searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Suspicious Changes to File Associations - Rule"]
+detection_searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Suspicious Changes to File Associations - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003", "T1546.001"], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
@@ -1853,7 +1853,7 @@ modification_date = 2017-09-12
 id = b6db2c60-a281-48b4-95f1-2cd99ed56835
 version = 2
 reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"]
-detection_searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule"]
+detection_searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule"]
 mappings = {"cis20": ["CIS 10", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.001", "T1490"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
@@ -1871,7 +1871,7 @@ modification_date = 2018-05-31
 id = 30874d4f-20a1-488f-85ec-5d52ef74e3f9
 version = 2
 reference = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"]
-detection_searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule"]
+detection_searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule"]
 mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Privilege Escalation"], "mitre_attack": ["T1053", "T1053.005", "T1222.001", "T1543.003", "T1546.011", "T1547.001", "T1547.010", "T1564.001", "T1574.009", "T1574.011"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
@@ -1888,7 +1888,7 @@ modification_date = 2020-02-04
 id = 644e22d3-598a-429c-a007-16fdb802cae5
 version = 2
 reference = ["https://attack.mitre.org/tactics/TA0004/"]
-detection_searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule"]
+detection_searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule"]
 mappings = {"cis20": ["CIS 2", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1068", "T1204.002", "T1546.008", "T1546.012"], "nist": ["DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = []
@@ -1905,7 +1905,7 @@ modification_date = 2017-11-02
 id = 6dbd810e-f66d-414b-8dfc-e46de55cbfe2
 version = 3
 reference = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"]
-detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"]
+detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get DomainUser with PowerShell Script Block - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"]
 mappings = {"cis20": ["CIS 2", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1543.003", "T1569.002", "T1574.011"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]}
 investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 support_searches = ["ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously Seen Running Windows Services - Update"]

dist/escu/default/collections.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-09-09T22:26:38 UTC
+# On Date: 2021-09-23T18:33:39 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

dist/escu/default/es_investigations.conf

@@ -414,7 +414,7 @@ panels = ["panel://workbench_panel_get_notable_history___response_task"]
 
 [panel_group://workbench_panel_group_ransomware]
 label = Ransomware
-description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
+description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. The following Splunk SOAR playbooks can be used in the response to this story's analytics:  'Ransomware Investigate and Contain' 
 disabled = 0
 
 panels = ["panel://workbench_panel_get_backup_logs_for_endpoint___response_task", "panel://workbench_panel_get_history_of_email_sources___response_task", "panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task", "panel://workbench_panel_get_process_information_for_port_activity___response_task", "panel://workbench_panel_get_sysmon_wmi_activity_for_host___response_task", "panel://workbench_panel_rundll32_lockworkstation___response_task"]

dist/escu/default/macros.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-09-09T22:26:38 UTC
+# On Date: 2021-09-23T18:33:39 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1391,6 +1391,30 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[domain_controller_discovery_with_nltest_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[domain_controller_discovery_with_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[domain_group_discovery_with_dsquery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[domain_group_discovery_with_net_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[domain_group_discovery_with_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[domain_group_discovery_with_adsisearcher_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [download_files_using_telegram_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1431,6 +1455,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[elevated_group_discovery_with_net_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[elevated_group_discovery_with_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[elevated_group_discovery_with_powerview_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [email_attachments_with_lots_of_spaces_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1739,10 +1775,82 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[get_wmiobject_group_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_wmiobject_group_discovery_with_script_block_logging_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [get_web_session_information_via_session_id_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[get_domaintrust_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_domaintrust_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_foresttrust_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[get_foresttrust_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getadcomputer_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getadcomputer_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getadgroup_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getadgroup_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getcurrent_user_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getcurrent_user_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getdomaincomputer_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getdomaincomputer_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getdomaincontroller_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getdomaincontroller_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getdomaingroup_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getdomaingroup_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [getlocaluser_with_powershell_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1751,6 +1859,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[getnettcpconnection_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getnettcpconnection_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [getwmiobject_ds_user_with_powershell_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -1759,6 +1875,22 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[getwmiobject_ds_computer_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getwmiobject_ds_computer_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getwmiobject_ds_group_with_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[getwmiobject_ds_group_with_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [getwmiobject_user_account_with_powershell_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -2139,6 +2271,22 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[net_localgroup_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[network_connection_discovery_with_arp_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[network_connection_discovery_with_net_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[network_connection_discovery_with_netstat_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [new_container_uploaded_to_aws_ecr_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -2243,6 +2391,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[office_product_writing_cab_or_inf_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [office_spawning_control_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -2299,6 +2451,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[powershell_get_localgroup_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -2331,6 +2487,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[powershell_get_localgroup_discovery_with_script_block_logging_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [powershell_processing_stream_of_data_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -2587,6 +2747,22 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[remote_system_discovery_with_adsisearcher_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_system_discovery_with_dsquery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_system_discovery_with_net_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[remote_system_discovery_with_wmic_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [remote_wmi_command_attempt_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -2951,6 +3127,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[system_user_discovery_with_query_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[system_user_discovery_with_whoami_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [systems_ready_for_spectre_meltdown_windows_patch_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -3019,6 +3203,14 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[user_discovery_with_env_vars_powershell_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
+[user_discovery_with_env_vars_powershell_script_block_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [w3wp_spawning_shell_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
@@ -3135,6 +3327,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 
 
+[wmic_group_discovery_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives. 
+
 [write_executable_in_smb_share_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives. 

dist/escu/default/transforms.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-09-09T22:26:38 UTC
+# On Date: 2021-09-23T18:33:39 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############

playbooks/ransomware_investigate_and_contain.py

@@ -0,0 +1,331 @@
+"""
+This playbook investigates and contains ransomware detected on endpoints.
+"""
+
+import phantom.rules as phantom
+import json
+from datetime import datetime, timedelta
+##############################
+# Start - Global Code Block
+
+"""Ransomware detected on endpoint"""
+
+# End - Global Code block
+##############################
+
+def on_start(container):
+    phantom.debug('on_start() called')
+    
+    # call 'get_file_1' block
+    get_file_1(container=container)
+
+    return
+
+def quarantine_device_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('quarantine_device_1() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'quarantine_device_1' call
+    results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:action_result.data.*.process.results.*.hostname', 'hunt_file_1:action_result.parameter.context.artifact_id'], action_results=results)
+
+    parameters = []
+    
+    # build parameters list for 'quarantine_device_1' call
+    for results_item_1 in results_data_1:
+        if results_item_1[0]:
+            parameters.append({
+                'ip_hostname': results_item_1[0],
+                # context (artifact id) is added to associate results with the artifact
+                'context': {'artifact_id': results_item_1[1]},
+            })
+
+    phantom.act(action="quarantine device", parameters=parameters, assets=['carbonblack'], name="quarantine_device_1", parent_action=action)
+
+    return
+
+def disable_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('disable_user_1() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'disable_user_1' call
+    results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:action_result.data.*.process.results.*.username', 'hunt_file_1:action_result.parameter.context.artifact_id'], action_results=results)
+
+    parameters = []
+    
+    # build parameters list for 'disable_user_1' call
+    for results_item_1 in results_data_1:
+        if results_item_1[0]:
+            parameters.append({
+                'username': results_item_1[0],
+                # context (artifact id) is added to associate results with the artifact
+                'context': {'artifact_id': results_item_1[1]},
+            })
+
+    phantom.act(action="disable user", parameters=parameters, assets=['domainctrl1'], name="disable_user_1", parent_action=action)
+
+    return
+
+def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('filter_1() called')
+
+    # collect filtered artifact ids for 'if' condition 1
+    matched_artifacts_1, matched_results_1 = phantom.condition(
+        container=container,
+        action_results=results,
+        conditions=[
+            ["detonate_file_1:action_result.summary.malware", "==", "ransomware"],
+        ],
+        name="filter_1:condition_1")
+
+    # call connected blocks if filtered artifacts or results
+    if matched_artifacts_1 or matched_results_1:
+        block_ip_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+        hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+        block_hash_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+        block_hash_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)
+
+    return
+
+def block_ip_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('block_ip_2() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'block_ip_2' call
+    results_data_1 = phantom.collect2(container=container, datapath=['list_connections_1:action_result.data.*.ip_addr', 'list_connections_1:action_result.parameter.context.artifact_id'], action_results=results)
+
+    parameters = []
+    
+    # build parameters list for 'block_ip_2' call
+    for results_item_1 in results_data_1:
+        if results_item_1[0]:
+            parameters.append({
+                'ip': results_item_1[0],
+                'vsys': "",
+                'is_source_address': "",
+                # context (artifact id) is added to associate results with the artifact
+                'context': {'artifact_id': results_item_1[1]},
+            })
+
+    phantom.act(action="block ip", parameters=parameters, assets=['pan'], name="block_ip_2", parent_action=action)
+
+    return
+
+def list_connections_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('list_connections_1() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'list_connections_1' call
+    results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:action_result.data.*.process.results.*.process_pid', 'hunt_file_1:action_result.data.*.process.results.*.hostname', 'hunt_file_1:action_result.data.*.process.results.*.process_name', 'hunt_file_1:action_result.data.*.process.results.*.id', 'hunt_file_1:action_result.parameter.context.artifact_id'], action_results=results)
+
+    parameters = []
+    
+    # build parameters list for 'list_connections_1' call
+    for results_item_1 in results_data_1:
+        parameters.append({
+            'pid': results_item_1[0],
+            'ip_hostname': results_item_1[1],
+            'process_name': results_item_1[2],
+            'carbonblack_process_id': results_item_1[3],
+            # context (artifact id) is added to associate results with the artifact
+            'context': {'artifact_id': results_item_1[4]},
+        })
+
+    phantom.act(action="list connections", parameters=parameters, assets=['carbonblack'], callback=block_ip_2, name="list_connections_1", parent_action=action)
+
+    return
+
+def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('hunt_file_1() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'hunt_file_1' call
+    filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_1:condition_1:detonate_file_1:action_result.data.*.file_info.md5", "filtered-data:filter_1:condition_1:detonate_file_1:action_result.parameter.context.artifact_id"])
+
+    parameters = []
+    
+    # build parameters list for 'hunt_file_1' call
+    for filtered_results_item_1 in filtered_results_data_1:
+        if filtered_results_item_1[0]:
+            parameters.append({
+                'hash': filtered_results_item_1[0],
+                'type': "",
+                'range': "",
+                # context (artifact id) is added to associate results with the artifact
+                'context': {'artifact_id': filtered_results_item_1[1]},
+            })
+
+    phantom.act(action="hunt file", parameters=parameters, assets=['carbonblack'], callback=hunt_file_1_callback, name="hunt_file_1")
+
+    return
+
+def hunt_file_1_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):
+    phantom.debug('hunt_file_1_callback() called')
+    
+    terminate_process_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+    quarantine_device_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+    disable_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+    list_connections_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)
+
+    return
+
+def block_hash_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('block_hash_4() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'block_hash_4' call
+    filtered_results_data_1 = phantom.collect2(container=container, datapath=["filtered-data:filter_1:condition_1:detonate_file_1:action_result.data.*.file_info.md5", "filtered-data:filter_1:condition_1:detonate_file_1:action_result.parameter.context.artifact_id"])
+
+    parameters = []
+    
+    # build parameters list for 'block_hash_4' call
+    for filtered_results_item_1 in filtered_results_data_1:
+        if filtered_results_item_1[0]:
+            parameters.append({
+                'hash': filtered_results_item_1[0],
+                'comment': "",
+                # context (artifact id) is added to associate results with the artifact
+                'context': {'artifact_id': filtered_results_item_1[1]},
+            })
+
+    phantom.act(action="block hash", parameters=parameters, assets=['carbonblack'], name="block_hash_4")
+
+    return
+
+def terminate_process_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('terminate_process_2() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'terminate_process_2' call
+    results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:action_result.data.*.process.results.*.process_pid', 'hunt_file_1:action_result.data.*.process.results.*.sensor_id', 'hunt_file_1:action_result.data.*.process.results.*.hostname', 'hunt_file_1:action_result.parameter.context.artifact_id'], action_results=results)
+
+    parameters = []
+    
+    # build parameters list for 'terminate_process_2' call
+    for results_item_1 in results_data_1:
+        if results_item_1[0]:
+            parameters.append({
+                'pid': results_item_1[0],
+                'sensor_id': results_item_1[1],
+                'ip_hostname': results_item_1[2],
+                # context (artifact id) is added to associate results with the artifact
+                'context': {'artifact_id': results_item_1[3]},
+            })
+
+    phantom.act(action="terminate process", parameters=parameters, assets=['carbonblack'], name="terminate_process_2", parent_action=action)
+
+    return
+
+def block_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('block_ip_1() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'block_ip_1' call
+    passed_filtered_results_data_1 = phantom.collect2(container=container, datapath=["detonate_file_1:filtered-action_result.data.*.task_info.report.*.network.tcp.*.@ip", "detonate_file_1:filtered-action_result.parameter.context.artifact_id"], action_results=filtered_results)
+
+    parameters = []
+    
+    # build parameters list for 'block_ip_1' call
+    for passed_filtered_results_item_1 in passed_filtered_results_data_1:
+        if passed_filtered_results_item_1[0]:
+            parameters.append({
+                'ip': passed_filtered_results_item_1[0],
+                'vsys': "",
+                'is_source_address': "",
+                # context (artifact id) is added to associate results with the artifact
+                'context': {'artifact_id': passed_filtered_results_item_1[1]},
+            })
+
+    phantom.act(action="block ip", parameters=parameters, assets=['pan'], name="block_ip_1")
+
+    return
+
+def block_hash_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('block_hash_3() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'block_hash_3' call
+    passed_filtered_results_data_1 = phantom.collect2(container=container, datapath=["detonate_file_1:filtered-action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha1", "detonate_file_1:filtered-action_result.parameter.context.artifact_id"], action_results=filtered_results)
+
+    parameters = []
+    
+    # build parameters list for 'block_hash_3' call
+    for passed_filtered_results_item_1 in passed_filtered_results_data_1:
+        if passed_filtered_results_item_1[0]:
+            parameters.append({
+                'hash': passed_filtered_results_item_1[0],
+                'comment': "",
+                # context (artifact id) is added to associate results with the artifact
+                'context': {'artifact_id': passed_filtered_results_item_1[1]},
+            })
+
+    phantom.act(action="block hash", parameters=parameters, assets=['carbonblack'], name="block_hash_3")
+
+    return
+
+def detonate_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('detonate_file_1() called')
+        
+    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
+    
+    # collect data for 'detonate_file_1' call
+    results_data_1 = phantom.collect2(container=container, datapath=['get_file_1:action_result.summary.vault_id', 'get_file_1:action_result.parameter.context.artifact_id'], action_results=results)
+
+    parameters = []
+    
+    # build parameters list for 'detonate_file_1' call
+    for results_item_1 in results_data_1:
+        if results_item_1[0]:
+            parameters.append({
+                'vault_id': results_item_1[0],
+                'file_name': "",
+                # context (artifact id) is added to associate results with the artifact
+                'context': {'artifact_id': results_item_1[1]},
+            })
+
+    phantom.act(action="detonate file", parameters=parameters, assets=['wildfire'], callback=filter_1, name="detonate_file_1", parent_action=action)
+
+    return
+
+def get_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
+    phantom.debug('get_file_1() called')
+
+    # collect data for 'get_file_1' call
+    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.fileHash', 'artifact:*.id'])
+
+    parameters = []
+    
+    # build parameters list for 'get_file_1' call
+    for container_item in container_data:
+        parameters.append({
+            'hash': container_item[0],
+            # context (artifact id) is added to associate results with the artifact
+            'context': {'artifact_id': container_item[1]},
+        })
+
+    phantom.act(action="get file", parameters=parameters, assets=['cylance_protect'], callback=detonate_file_1, name="get_file_1")
+
+    return
+
+def on_finish(container, summary):
+    phantom.debug('on_finish() called')
+    # This function is called after all actions are completed.
+    # summary of all the action and/or all details of actions
+    # can be collected here.
+
+    # summary_json = phantom.get_summary()
+    # if 'result' in summary_json:
+        # for action_result in summary_json['result']:
+            # if 'action_run_id' in action_result:
+                # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)
+                # phantom.debug(action_results)
+
+    return

playbooks/ransomware_investigate_and_contain.yml

@@ -0,0 +1,31 @@
+name: Ransomware Investigate and Contain
+id: fc0edc96-ff2b-48b0-9f6f-63da3783fd63
+version: 1
+date: '2018-02-04'
+author: Philip Royer, Splunk
+type: Response
+description: This playbook investigates and contains ransomware detected on endpoints.
+playbook: ransomware_investigate_and_contain
+how_to_implement: This playbook requires the Splunk SOAR apps for Palo Alto 
+  Networks Firewalls, Palo Alto Wildfire, LDAP, and Carbon Black Response. 
+references: []
+app_list:
+- "Carbon Black Response"
+- "LDAP"
+- "Palo Alto Networks Firewall"
+- "WildFire"
+- "Cylance"
+tags:
+  analytic_story:
+  - Ransomware
+  detections:
+  - Conti Common Exec parameter
+  platform_tags:
+  - tag1
+  - tag2
+  - tag3
+  playbook_fields:
+  - ComputerName
+  - Username
+  product:
+  - Splunk SOAR