Branch was auto-updated.

2026-06-08 17:32:49 +00:00 · 2021-08-27 22:52:20 +00:00
parent 180d9e5d3d e7fffbd0b8
commit 939c9da4ea
41 changed files with 1516395 additions and 1513916 deletions
@@ -381,7 +381,7 @@ jobs:

      - name: Upload Reporting 
        run: |
-          aws s3 cp bin/reporting s3://security-content-testing/reporting --recursive --exclude "*" --include "*.svg"
+          aws s3 cp bin/reporting s3://security-content/reporting --recursive --exclude "*" --include "*.svg"
      
  update-sources-github:
    runs-on: ubuntu-latest
@@ -545,9 +545,9 @@ jobs:

      - name: Sync latest ESCU to the Attack Range S3 bucket for apps
        run: |
-            aws s3 cp DA-ESS-ContentUpdate-latest.tar.gz s3://attack-range-appbinaries-testing/
+            aws s3 cp DA-ESS-ContentUpdate-latest.tar.gz s3://attack-range-appbinaries/
            # make the file public since it is not by default
-            aws s3api put-object-acl --bucket attack-range-appbinaries-testing --key DA-ESS-ContentUpdate-latest.tar.gz --acl public-read
+            aws s3api put-object-acl --bucket attack-range-appbinaries --key DA-ESS-ContentUpdate-latest.tar.gz --acl public-read
  
  master-api-update:
    runs-on: ubuntu-latest
@@ -589,16 +589,16 @@ jobs:

      - name: Update API sources
        run: |
-          aws s3 rm s3://security-content-testing --recursive --exclude "*" --include "*.yml"
-          aws s3 cp stories s3://security-content-testing/stories --recursive --exclude "*" --include "*.yml"
-          aws s3 cp baselines s3://security-content-testing/baselines --recursive --exclude "*" --include "*.yml"
-          aws s3 cp detections s3://security-content-testing/detections --recursive --exclude "*" --include "*.yml"
-          aws s3 cp response_tasks s3://security-content-testing/response_tasks --recursive --exclude "*" --include "*.yml"
-          aws s3 cp responses s3://security-content-testing/responses --recursive --exclude "*" --include "*.yml"
-          aws s3 cp lookups s3://security-content-testing/lookups --recursive --exclude "*" --include "*.yml"
-          aws s3 cp lookups s3://security-content-testing/lookups --recursive --exclude "*" --include "*.csv"
-          aws s3 cp macros s3://security-content-testing/macros --recursive --exclude "*" --include "*.yml"
-          aws s3 cp deployments s3://security-content-testing/deployments --recursive --exclude "*" --include "*.yml"
+          aws s3 rm s3://security-content --recursive --exclude "*" --include "*.yml"
+          aws s3 cp stories s3://security-content/stories --recursive --exclude "*" --include "*.yml"
+          aws s3 cp baselines s3://security-content/baselines --recursive --exclude "*" --include "*.yml"
+          aws s3 cp detections s3://security-content/detections --recursive --exclude "*" --include "*.yml"
+          aws s3 cp response_tasks s3://security-content/response_tasks --recursive --exclude "*" --include "*.yml"
+          aws s3 cp responses s3://security-content/responses --recursive --exclude "*" --include "*.yml"
+          aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.yml"
+          aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.csv"
+          aws s3 cp macros s3://security-content/macros --recursive --exclude "*" --include "*.yml"
+          aws s3 cp deployments s3://security-content/deployments --recursive --exclude "*" --include "*.yml"
      - name: Security Content API Smoke Test
        run: |
          API_URL='https://content.splunkresearch.com/detections'
@@ -5,14 +5,15 @@ date: '2021-08-20'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel: []
-description: This search is to detect a pushed or commit to master or main branch. 
-  This is to avoid unwanted modification to master without a review to the changes. Ideally in terms of devsecops the changes made in a branch and do a 
-  PR for review. of course in some cases admin of the project may did a changes directly to master branch
-search: '`github` branches{}.name = main OR branches{}.name = master
-  |  stats count min(_time) as firstTime max(_time) as lastTime  by commit.author.html_url commit.commit.author.email commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `github_commit_changes_in_master_filter`'
+description: This search is to detect a pushed or commit to master or main branch.
+  This is to avoid unwanted modification to master without a review to the changes.
+  Ideally in terms of devsecops the changes made in a branch and do a PR for review.
+  of course in some cases admin of the project may did a changes directly to master
+  branch
+search: '`github` branches{}.name = main OR branches{}.name = master |  stats count
+  min(_time) as firstTime max(_time) as lastTime  by commit.author.html_url commit.commit.author.email
+  commit.author.login commit.commit.message repository.pushed_at commit.commit.committer.date
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `github_commit_changes_in_master_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
  logs related to github logs having the fork, commit, push metadata that can be use
  to monitor the changes in a github project.
@@ -22,29 +23,29 @@ references:
 tags:
  analytic_story:
  - DevSecOps
+  automated_detection_testing: passed
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1199/github_push_master/github_push_master.log
+  impact: 30
  kill_chain_phases:
  - Exploitation
+  message: suspicious commit by $commit.commit.author.email$ to main branch
  mitre_attack_id:
  - T1199
+  observable:
+  - name: commit.commit.author.email
+    type: User
+    role:
+    - attacker
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
-  security_domain: endpoint
-  impact: 30
-  confidence: 30
  risk_score: 9
-  context:
-  - Source:Endpoint
-  - Stage:Reconnaissance
-  message: suspicious commit by $commit.commit.author.email$ to main branch
-  observable:
-  - name: commit.commit.author.email
-    type: User
-    role:
-    - attacker
-  automated_detection_testing: passed
+  security_domain: endpoint
@@ -36,26 +36,19 @@ references:
 tags:
  analytic_story:
  - DevSecOps
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1566.001
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  security_domain: endpoint
-  impact: 50
+  automated_detection_testing: passed
  confidence: 50
-  risk_score: 25
  context:
  - Source:Endpoint
  - Stage:Reconnaissance
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_subj/gsuite_susp_subj_attach.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
  message: suspicious email from $source.address$ to $destination{}.address$
+  mitre_attack_id:
+  - T1566.001
  observable:
  - name: source.address
    type: User
@@ -65,4 +58,11 @@ tags:
    type: User
    role:
    - Victim
-  automated_detection_testing: passed
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  risk_score: 25
+  security_domain: endpoint
@@ -26,26 +26,19 @@ references:
 tags:
  analytic_story:
  - DevSecOps
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1566.001
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  security_domain: endpoint
-  impact: 50
+  automated_detection_testing: passed
  confidence: 50
-  risk_score: 25
  context:
  - Source:Endpoint
  - Stage:Reconnaissance
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gsuite_susp_url/gsuite_susp_url.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
  message: suspicious email from $source.address$ to $destination{}.address$
+  mitre_attack_id:
+  - T1566.001
  observable:
  - name: source.address
    type: User
@@ -55,4 +48,11 @@ tags:
    type: User
    role:
    - Victim
-  automated_detection_testing: passed
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  risk_score: 25
+  security_domain: endpoint
@@ -32,12 +32,28 @@ references:
 tags:
  analytic_story:
  - DevSecOps
+  automated_detection_testing: passed
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/gdrive_susp_file_share/gdrive_susp_attach.log
+  impact: 30
  kill_chain_phases:
  - Exploitation
+  message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
  mitre_attack_id:
  - T1566.001
+  observable:
+  - name: parameters.owner
+    type: User
+    role:
+    - attacker
+  - name: email
+    type: User
+    role:
+    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
@@ -51,21 +67,5 @@ tags:
  - parameters.visibility
  - parameters.owner
  - parameters.doc_type
-  security_domain: endpoint
-  impact: 30
-  confidence: 30
  risk_score: 9
-  context:
-  - Source:Endpoint
-  - Stage:Reconnaissance
-  message: suspicious share gdrive from $parameters.owner$ to $email$ namely as $parameters.doc_title$
-  observable:
-  - name: parameters.owner
-    type: User
-    role:
-    - attacker
-  - name: email
-    type: User
-    role:
-    - Victim
-  automated_detection_testing: passed
+  security_domain: endpoint
@@ -23,9 +23,12 @@ tags:
  analytic_story:
  - Dev Sec Ops
  asset_type: Kubernetes
+  automated_detection_testing: passed
  cis20:
  - CIS 13
  confidence: 70
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/kubernetes_nginx_lfi_attack.log
  impact: 70
  kill_chain_phases:
  - Actions on Objectives
@@ -49,7 +52,3 @@ tags:
  - raw
  risk_score: 49
  security_domain: network
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/kubernetes_nginx_lfi_attack.log
-
@@ -22,9 +22,12 @@ tags:
  analytic_story:
  - Dev Sec Ops
  asset_type: Kubernetes
+  automated_detection_testing: passed
  cis20:
  - CIS 13
  confidence: 70
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/kubernetes_nginx_rfi_attack.log
  impact: 70
  kill_chain_phases:
  - Actions on Objectives
@@ -48,7 +51,3 @@ tags:
  - raw
  risk_score: 49
  security_domain: network
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/kubernetes_nginx_rfi_attack.log
-
@@ -21,9 +21,12 @@ tags:
  analytic_story:
  - Dev Sec Ops
  asset_type: Kubernetes
+  automated_detection_testing: passed
  cis20:
  - CIS 13
  confidence: 70
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json
  impact: 70
  kill_chain_phases:
  - Actions on Objectives
@@ -51,7 +54,3 @@ tags:
  - object.reason
  risk_score: 49
  security_domain: network
-  automated_detection_testing: passed
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/kubernetes_kube_hunter/kubernetes_kube_hunter.json
-
@@ -80,4 +80,3 @@ tags:
  - Processes.parent_process_id
  risk_score: 90
  security_domain: endpoint
-
@@ -11,10 +11,9 @@ description: This search looks for arguments to certutil.exe indicating the mani
  tokens specially inside Federated environments such as Windows ADFS.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe
-  Processes.process = "*-exportPFX*" by Processes.dest Processes.user
-  Processes.parent_process Processes.process_name Processes.process Processes.process_id
-  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `certutil_exe_certificate_extraction_filter`'
+  Processes.process = "*-exportPFX*" by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `certutil_exe_certificate_extraction_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -6,55 +6,42 @@ author: Michael Haag, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: The following analytic identifies the process - `esentutl.exe` - being used to capture credentials stored in ntds.dit or the SAM file on disk. 
-  During triage, review parallel processes and determine if legitimate activity. Upon determination of illegitimate activity, take further action to isolate and contain the threat.
+description: The following analytic identifies the process - `esentutl.exe` - being
+  used to capture credentials stored in ntds.dit or the SAM file on disk. During triage,
+  review parallel processes and determine if legitimate activity. Upon determination
+  of illegitimate activity, take further action to isolate and contain the threat.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_esentutl`
-  Processes.process IN ("*ntds*", "*SAM*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
+  as lastTime from datamodel=Endpoint.Processes where `process_esentutl` Processes.process
+  IN ("*ntds*", "*SAM*") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.original_file_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)` | `esentutl_sam_copy_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: False positives should be limited. Filter as needed.
 references:
-  - https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md
-  - https://attack.mitre.org/software/S0404/
+- https://github.com/redcanaryco/atomic-red-team/blob/6a570c2a4630cf0c2bd41a2e8375b5d5ab92f700/atomics/T1003.002/T1003.002.md
+- https://attack.mitre.org/software/S0404/
 tags:
  analytic_story:
  - Credential Dumping
-  dataset: []
-  kill_chain_phases:
-  - Privilege Escalation
-  - Lateral Movement
-  mitre_attack_id:
-  - T1003.002
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
-  - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
-  security_domain: endpoint
-  impact: 80
  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
  context:
  - Source:Endpoint
  - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user user$ attempting to capture credentials for offline cracking or observability.
+  dataset: []
+  impact: 80
+  kill_chain_phases:
+  - Privilege Escalation
+  - Lateral Movement
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user user$ attempting to capture credentials for offline
+    cracking or observability.
+  mitre_attack_id:
+  - T1003.002
  observable:
  - name: user
    type: User
@@ -71,4 +58,23 @@ tags:
  - name: process_name
    type: Process
    role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 80
+  security_domain: endpoint
@@ -5,64 +5,63 @@ date: '2021-08-18'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel: []
-description: The following Hunting analytic assists with identifying suspicious PowerShell execution using Script Block Logging, or EventCode 4104. This analytic is not meant to be ran hourly, but occasionally to identify malicious or suspicious PowerShell.
-  This analytic is a combination of work completed by Alex Teixeira and Splunk Threat Research Team.
-search: '`powershell` EventCode=4104 
-  | eval DoIt = if(match(Message,"(?i)(\$doit)"), "4", 0)
-  | eval enccom=if(match(Message,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)") OR match(Message, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) 
-  | eval suspcmdlet=if(match(Message, "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-Jboss|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|get-net\S+|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|Kerberos.*(policy|ticket)|netfirewall|Uninstall-Windows|Verb\s+Runas|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0)
-  | eval base64 = if(match(lower(Message),"frombase64"), "4", 0)
-  | eval empire=if(match(lower(Message),"system.net.webclient") AND match(lower(Message), "frombase64string") ,5,0)
-  | eval mimikatz=if(match(lower(Message),"mimikatz") OR match(lower(Message), "-dumpcr") OR match(lower(Message), "SEKURLSA::Pth") OR match(lower(Message), "kerberos::ptt") OR match(lower(Message), "kerberos::golden") ,5,0)
-  | eval iex = if(match(lower(Message),"iex"), "2", 0)
-  | eval webclient=if(match(lower(Message),"http") OR match(lower(Message),"web(client|request)") OR match(lower(Message),"socket") OR match(lower(Message),"download(file|string)") OR match(lower(Message),"bitstransfer") OR match(lower(Message),"internetexplorer.application") OR match(lower(Message),"xmlhttp"),5,0) 
-  | eval get = if(match(lower(Message),"get-"), "1", 0)
-  | eval rundll32 = if(match(lower(Message),"rundll32"), "4", 0)
-  | eval suspkeywrd=if(match(Message, "(?i)(bitstransfer|mimik|metasp|AssemblyBuilderAccess|Reflection\.Assembly|shellcode|injection|cnvert|shell\.application|start-process|Rc4ByteStream|System\.Security\.Cryptography|lsass\.exe|localadmin|LastLoggedOn|hijack|BackupPrivilege|ngrok|comsvcs|backdoor|brute.?force|Port.?Scan|Exfiltration|exploit|DisableRealtimeMonitoring|beacon)"),1,0)
-  | eval syswow64 = if(match(lower(Message),"syswow64"), "3", 0)
-  | eval httplocal = if(match(lower(Message),"http://127.0.0.1"), "4", 0)
-  | eval reflection = if(match(lower(Message),"reflection"), "1", 0)
-  | eval invokewmi=if(match(lower(Message), "(?i)(wmiobject|WMIMethod|RemoteWMI|PowerShellWmi|wmicommand)"),5,0)
-  | eval downgrade=if(match(Message, "(?i)([-]ve*r*s*i*o*n*\s+2)") OR match(lower(Message),"powershell -version"),3,0)
-  | eval compressed=if(match(Message, "(?i)GZipStream|::Decompress|IO.Compression|write-zip|(expand|compress)-Archive"),5,0)
-  | eval invokecmd = if(match(lower(Message),"invoke-command"), "4", 0)
-  | addtotals fieldname=Score DoIt, enccom, suspcmdlet, suspkeywrd, compressed, downgrade, mimikatz, iex, empire, rundll32, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get
-  | stats values(Score) by DoIt, enccom, compressed, downgrade, iex, mimikatz, rundll32, empire, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd, base64, get, suspcmdlet, suspkeywrd
-  | `powershell_4104_hunting_filter`'
-how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+description: The following Hunting analytic assists with identifying suspicious PowerShell
+  execution using Script Block Logging, or EventCode 4104. This analytic is not meant
+  to be ran hourly, but occasionally to identify malicious or suspicious PowerShell.
+  This analytic is a combination of work completed by Alex Teixeira and Splunk Threat
+  Research Team.
+search: '`powershell` EventCode=4104 | eval DoIt = if(match(Message,"(?i)(\$doit)"),
+  "4", 0) | eval enccom=if(match(Message,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)")
+  OR match(Message, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) | eval suspcmdlet=if(match(Message,
+  "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-Jboss|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|get-net\S+|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|Kerberos.*(policy|ticket)|netfirewall|Uninstall-Windows|Verb\s+Runas|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0)
+  | eval base64 = if(match(lower(Message),"frombase64"), "4", 0) | eval empire=if(match(lower(Message),"system.net.webclient")
+  AND match(lower(Message), "frombase64string") ,5,0) | eval mimikatz=if(match(lower(Message),"mimikatz")
+  OR match(lower(Message), "-dumpcr") OR match(lower(Message), "SEKURLSA::Pth") OR
+  match(lower(Message), "kerberos::ptt") OR match(lower(Message), "kerberos::golden")
+  ,5,0) | eval iex = if(match(lower(Message),"iex"), "2", 0) | eval webclient=if(match(lower(Message),"http")
+  OR match(lower(Message),"web(client|request)") OR match(lower(Message),"socket")
+  OR match(lower(Message),"download(file|string)") OR match(lower(Message),"bitstransfer")
+  OR match(lower(Message),"internetexplorer.application") OR match(lower(Message),"xmlhttp"),5,0)
+  | eval get = if(match(lower(Message),"get-"), "1", 0) | eval rundll32 = if(match(lower(Message),"rundll32"),
+  "4", 0) | eval suspkeywrd=if(match(Message, "(?i)(bitstransfer|mimik|metasp|AssemblyBuilderAccess|Reflection\.Assembly|shellcode|injection|cnvert|shell\.application|start-process|Rc4ByteStream|System\.Security\.Cryptography|lsass\.exe|localadmin|LastLoggedOn|hijack|BackupPrivilege|ngrok|comsvcs|backdoor|brute.?force|Port.?Scan|Exfiltration|exploit|DisableRealtimeMonitoring|beacon)"),1,0)
+  | eval syswow64 = if(match(lower(Message),"syswow64"), "3", 0) | eval httplocal
+  = if(match(lower(Message),"http://127.0.0.1"), "4", 0) | eval reflection = if(match(lower(Message),"reflection"),
+  "1", 0) | eval invokewmi=if(match(lower(Message), "(?i)(wmiobject|WMIMethod|RemoteWMI|PowerShellWmi|wmicommand)"),5,0)
+  | eval downgrade=if(match(Message, "(?i)([-]ve*r*s*i*o*n*\s+2)") OR match(lower(Message),"powershell
+  -version"),3,0) | eval compressed=if(match(Message, "(?i)GZipStream|::Decompress|IO.Compression|write-zip|(expand|compress)-Archive"),5,0)
+  | eval invokecmd = if(match(lower(Message),"invoke-command"), "4", 0) | addtotals
+  fieldname=Score DoIt, enccom, suspcmdlet, suspkeywrd, compressed, downgrade, mimikatz,
+  iex, empire, rundll32, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd,
+  base64, get | stats values(Score) by DoIt, enccom, compressed, downgrade, iex, mimikatz,
+  rundll32, empire, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd,
+  base64, get, suspcmdlet, suspkeywrd | `powershell_4104_hunting_filter`'
+how_to_implement: The following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: Limited false positives. May filter as needed.
 references:
-  - https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md
-  - https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell
-  - https://github.com/marcurdy/dfir-toolset/blob/master/Powershell%20Blueteam.txt
-  - https://devblogs.microsoft.com/powershell/powershell-the-blue-team/
-  - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1
-  - https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html
-  - https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/ 
+- https://github.com/inodee/threathunting-spl/blob/master/hunt-queries/powershell_qualifiers.md
+- https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell
+- https://github.com/marcurdy/dfir-toolset/blob/master/Powershell%20Blueteam.txt
+- https://devblogs.microsoft.com/powershell/powershell-the-blue-team/
+- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1
+- https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html
+- https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/
 tags:
  analytic_story:
  - Malicious PowerShell
-  dataset: []
-  kill_chain_phases:
-  - Exploitation
-  mitre_attack_id:
-  - T1059.001
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  required_fields:
-  - _time
-  - Message
-  security_domain: endpoint
-  impact: 80
  confidence: 100
-  # (impact * confidence)/100
-  risk_score: 80
  context:
  - Source:Endpoint
  - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing suspicious commands.
+  dataset: []
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ executing suspicious commands.
+  mitre_attack_id:
+  - T1059.001
  observable:
  - name: user
    type: User
@@ -79,4 +78,13 @@ tags:
  - name: process_name
    type: Process
    role:
-    - Child Process
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Message
+  risk_score: 80
+  security_domain: endpoint
@@ -5,7 +5,7 @@ date: '2020-07-22'
 author: David Dorsey, Splunk
 type: TTP
 datamodel:
-  - Endpoint
+- Endpoint
 description: This search looks for reg.exe being launched from a command prompt not
  started by the user. When a user launches cmd.exe, the parent process is usually
  explorer.exe. This search filters out those instances.
@@ -6,26 +6,27 @@ author: Rico Valdez, Splunk
 type: TTP
 datamodel:
 - Network_Traffic
-description: The following analytic identifies cleartext protocols at risk of leaking sensitive information.
-  Currently, this consists of legacy protocols such as telnet (port 23), POP3 (port 110), IMAP (port 143), and non-anonymous
-  FTP (port 21) sessions. While some of these protocols may be used over SSL, they typically
-  are found on different assigned ports in those instances.
+description: The following analytic identifies cleartext protocols at risk of leaking
+  sensitive information. Currently, this consists of legacy protocols such as telnet
+  (port 23), POP3 (port 110), IMAP (port 143), and non-anonymous FTP (port 21) sessions.
+  While some of these protocols may be used over SSL, they typically are found on
+  different assigned ports in those instances.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Network_Traffic where All_Traffic.action!=blocked AND All_Traffic.transport="tcp" AND
-  (All_Traffic.dest_port="23" OR All_Traffic.dest_port="143" OR All_Traffic.dest_port="110"
-  OR (All_Traffic.dest_port="21" AND All_Traffic.user != "anonymous")) by All_Traffic.user
-  All_Traffic.src All_Traffic.dest All_Traffic.dest_port | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")` | `protocols_passing_authentication_in_cleartext_filter`'
+  as lastTime from datamodel=Network_Traffic where All_Traffic.action!=blocked AND
+  All_Traffic.transport="tcp" AND (All_Traffic.dest_port="23" OR All_Traffic.dest_port="143"
+  OR All_Traffic.dest_port="110" OR (All_Traffic.dest_port="21" AND All_Traffic.user
+  != "anonymous")) by All_Traffic.user All_Traffic.src All_Traffic.dest All_Traffic.dest_port
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")`
+  | `protocols_passing_authentication_in_cleartext_filter`'
 how_to_implement: This search requires you to be ingesting your network traffic, and
-  populating the Network_Traffic data model.
-  For more accurate result it's better to limit destination to organization private and public IP range, like
-    All_Traffic.dest IN(192.168.0.0/16,172.16.0.0/12,10.0.0.0/8, x.x.x.x/22)
-  
+  populating the Network_Traffic data model. For more accurate result it's better
+  to limit destination to organization private and public IP range, like All_Traffic.dest
+  IN(192.168.0.0/16,172.16.0.0/12,10.0.0.0/8, x.x.x.x/22)
 known_false_positives: Some networks may use kerberized FTP or telnet servers, however,
  this is rare.
 references:
-  - https://www.rackaid.com/blog/secure-your-email-and-file-transfers/
-  - https://www.infosecmatter.com/capture-passwords-using-wireshark/
+- https://www.rackaid.com/blog/secure-your-email-and-file-transfers/
+- https://www.infosecmatter.com/capture-passwords-using-wireshark/
 tags:
  analytic_story:
  - Use of Cleartext Protocols
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-08-27T14:05:22 UTC
+# On Date: 2021-08-27T21:28:09 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 36246
+build = 88

 [triggers]
 reload.analytic_stories = simple
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-08-27T14:05:22 UTC
+# On Date: 2021-08-27T21:28:09 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-08-27T14:05:22 UTC
+# On Date: 2021-08-27T21:28:09 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-08-27T14:05:22 UTC
+# On Date: 2021-08-27T21:28:09 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-08-27T14:05:22 UTC
+# On Date: 2021-08-27T21:28:09 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-08-27T14:05:22 UTC
+# On Date: 2021-08-27T21:28:09 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-08-20T22:01:05 UTC
+# On Date: 2021-08-27T21:28:31 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -23,7 +23,7 @@ providing_technologies = none
 description = This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation.
 narrative = Amazon Web Services provides a neat feature called Identity and Access Management (IAM) that enables organizations to manage various AWS services and resources in a secure way. All IAM users have roles, groups and policies associated with them which governs and sets permissions to allow a user to access specific restrictions.\
 However, if these IAM policies are misconfigured and have specific combinations of weak permissions; it can allow attackers to escalate their privileges and further compromise the organization. Rhino Security Labs have published comprehensive blogs detailing various AWS Escalation methods. By using this as an inspiration, Splunk’s research team wants to highlight how these attack vectors look in AWS Cloudtrail logs and provide you with detection queries to uncover these potentially malicious events via this Analytic Story. \
-product = [&#39;Splunk Security Analytics for AWS&#39;, &#39;Splunk Enterprise&#39;, &#39;Splunk Enterprise Security&#39;, &#39;Splunk Cloud&#39;]
+product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

 [AWS Network ACL Activity]
 category =  Cloud Security
@@ -40,7 +40,7 @@ data_models = []
 providing_technologies = none
 description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it.
 narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls.
-product = [&#39;Splunk Security Analytics for AWS&#39;, &#39;Splunk Enterprise&#39;, &#39;Splunk Enterprise Security&#39;, &#39;Splunk Cloud&#39;]
+product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

 [AWS Security Hub Alerts]
 category =  Cloud Security
@@ -57,7 +57,7 @@ data_models = []
 providing_technologies = none
 description = This story is focused around detecting Security Hub alerts generated from AWS
 narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager.
-product = [&#39;Splunk Security Analytics for AWS&#39;, &#39;Splunk Enterprise&#39;, &#39;Splunk Enterprise Security&#39;, &#39;Splunk Cloud&#39;]
+product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

 [Cloud Cryptomining]
 category =  Cloud Security
@@ -73,11 +73,11 @@ support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Base
 data_models = ["Change"]
 providing_technologies = none
 description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
-narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it&#39;s par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \
-Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It&#39;s difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool&#39;s IP address behind a free CDN. \
+narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \
+Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \
 When malicious miners appropriate a cloud instance, often spinning up hundreds of new instances, the costs can become astronomical for the account holder. So it is critically important to monitor your systems for suspicious activities that could indicate that your network has been infiltrated. \
 This Analytic Story is focused on detecting suspicious new instances in your cloud environment to help prevent cryptominers from gaining a foothold. It contains detection searches that will detect when a previously unused instance type or AMI is used. It also contains support searches to build lookup files to ensure proper execution of the detection searches.
-product = [&#39;Splunk Security Analytics for AWS&#39;, &#39;Splunk Enterprise&#39;, &#39;Splunk Enterprise Security&#39;, &#39;Splunk Cloud&#39;]
+product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

 [Cloud Federated Credential Abuse]
 category =  Cloud Security
@@ -92,9 +92,9 @@ investigative_searches = []
 support_searches = []
 data_models = []
 providing_technologies = none
-description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim&#39;s cloud environements.
+description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements.
 narrative = This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches.
-product = [&#39;Splunk Security Analytics for AWS&#39;, &#39;Splunk Enterprise&#39;, &#39;Splunk Enterprise Security&#39;, &#39;Splunk Cloud&#39;]
+product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

 [Office 365 Detections]
 category =  Cloud Security
@@ -111,7 +111,7 @@ data_models = []
 providing_technologies = none
 description = This story is focused around detecting Office 365 Attacks.
 narrative = More and more companies are using Microsofts Office 365 cloud offering. Therefore, we see more and more attacks against Office 365. This story provides various detections for Office 365 attacks.
-product = [&#39;Splunk Security Analytics for AWS&#39;, &#39;Splunk Enterprise&#39;, &#39;Splunk Enterprise Security&#39;, &#39;Splunk Cloud&#39;]
+product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

 [Ransomware Cloud]
 category =  Malware
@@ -128,7 +128,7 @@ data_models = []
 providing_technologies = none
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features.
 narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise.Cloud ransomware can be deployed by obtaining high privilege credentials from targeted users or resources.
-product = [&#39;Splunk Security Analytics for AWS&#39;, &#39;Splunk Enterprise&#39;, &#39;Splunk Enterprise Security&#39;, &#39;Splunk Cloud&#39;]
+product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

 [Suspicious AWS Login Activities]
 category =  Cloud Security
@@ -145,7 +145,7 @@ data_models = ["Authentication"]
 providing_technologies = none
 description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. 
 narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker.
-product = [&#39;Splunk Security Analytics for AWS&#39;, &#39;Splunk Enterprise&#39;, &#39;Splunk Enterprise Security&#39;, &#39;Splunk Cloud&#39;]
+product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

 [Suspicious AWS S3 Activities]
 category =  Cloud Security
@@ -162,9 +162,9 @@ data_models = []
 providing_technologies = none
 description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
 narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\
-Amazon&#39;s &#34;shared responsibility&#34; model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it&#39;s important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\
+Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\
 Among things to look out for are S3 access from unfamiliar locations and by unfamiliar users. Some of the searches in this Analytic Story help you detect suspicious behavior and others help you investigate more deeply, when the situation warrants.   
-product = [&#39;Splunk Security Analytics for AWS&#39;, &#39;Splunk Enterprise&#39;, &#39;Splunk Enterprise Security&#39;, &#39;Splunk Cloud&#39;]
+product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

 [Suspicious Cloud Authentication Activities]
 category =  Cloud Security
@@ -182,7 +182,7 @@ providing_technologies = none
 description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. 
 narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\
 This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS.
-product = [&#39;Splunk Security Analytics for AWS&#39;, &#39;Splunk Enterprise&#39;, &#39;Splunk Enterprise Security&#39;, &#39;Splunk Cloud&#39;]
+product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

 [Suspicious Cloud Instance Activities]
 category =  Cloud Security
@@ -199,7 +199,7 @@ data_models = ["Change"]
 providing_technologies = none
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
 narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities.
-product = [&#39;Splunk Security Analytics for AWS&#39;, &#39;Splunk Enterprise&#39;, &#39;Splunk Enterprise Security&#39;, &#39;Splunk Cloud&#39;]
+product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

 [Suspicious Cloud Provisioning Activities]
 category =  Cloud Security
@@ -216,8 +216,8 @@ data_models = ["Change"]
 providing_technologies = none
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
 narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\
-This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven&#39;t previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further.
-product = [&#39;Splunk Security Analytics for AWS&#39;, &#39;Splunk Enterprise&#39;, &#39;Splunk Enterprise Security&#39;, &#39;Splunk Cloud&#39;]
+This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further.
+product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

 [Suspicious Cloud User Activities]
 category =  Cloud Security
@@ -233,8 +233,8 @@ support_searches = ["ESCU - Baseline Of Cloud Infrastructure API Calls Per User"
 data_models = ["Change"]
 providing_technologies = none
 description = Detect and investigate suspicious activities by users and roles in your cloud environments.
-narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it&#39;s all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla&#39;s cryptojacking attack in February, 2018.\
+narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\
 In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage.
-product = [&#39;Splunk Security Analytics for AWS&#39;, &#39;Splunk Enterprise&#39;, &#39;Splunk Enterprise Security&#39;, &#39;Splunk Cloud&#39;]
+product = ['Splunk Security Analytics for AWS', 'Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

 #### END STORIES ####
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-08-20T22:01:05 UTC
+# On Date: 2021-08-27T21:28:31 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -50,8 +50,8 @@ maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
 searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule", "ESCU - Investigate AWS activities via region name - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
 description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
-narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it&#39;s par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \
-Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It&#39;s difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool&#39;s IP address behind a free CDN. \
+narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \
+Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \
 When malicious miners appropriate a cloud instance, often spinning up hundreds of new instances, the costs can become astronomical for the account holder. So it is critically important to monitor your systems for suspicious activities that could indicate that your network has been infiltrated. \
 This Analytic Story is focused on detecting suspicious new instances in your cloud environment to help prevent cryptominers from gaining a foothold. It contains detection searches that will detect when a previously unused instance type or AMI is used. It also contains support searches to build lookup files to ensure proper execution of the detection searches.

@@ -63,7 +63,7 @@ references = ["https://www.cyberark.com/resources/threat-research-blog/golden-sa
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}]
 spec_version = 3
 searches = ["ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule"]
-description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim&#39;s cloud environements.
+description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements.
 narrative = This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches.

 [analytic_story://Office 365 Detections]
@@ -109,7 +109,7 @@ spec_version = 3
 searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS S3 Bucket details via bucketName - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Investigate AWS activities via region name - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
 description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
 narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\
-Amazon&#39;s &#34;shared responsibility&#34; model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it&#39;s important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\
+Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\
 Among things to look out for are S3 access from unfamiliar locations and by unfamiliar users. Some of the searches in this Analytic Story help you detect suspicious behavior and others help you investigate more deeply, when the situation warrants.   

 [analytic_story://Suspicious Cloud Authentication Activities]
@@ -145,7 +145,7 @@ spec_version = 3
 searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule"]
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
 narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\
-This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven&#39;t previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further.
+This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further.

 [analytic_story://Suspicious Cloud User Activities]
 category = Cloud Security
@@ -156,7 +156,7 @@ maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
 searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
 description = Detect and investigate suspicious activities by users and roles in your cloud environments.
-narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it&#39;s all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla&#39;s cryptojacking attack in February, 2018.\
+narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\
 In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage.

 ### END STORIES ###
@@ -200,7 +200,7 @@ confidence = medium
 explanation = This search looks for AssumeRole events where an IAM role in a different account is requested for the first time.
 how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen AWS Cross Account Activity - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen AWS Cross Account Activity - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `aws_cross_account_activity_from_previously_unseen_account_filter` macro.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.AC", "PR.DS", "DE.AE"]}
-known_false_positives = Using multiple AWS accounts and roles is perfectly valid behavior. It&#39;s suspicious when an account requests privileges of an account it hasn&#39;t before. You should validate with the account owner that this is a legitimate request.
+known_false_positives = Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicious when an account requests privileges of an account it hasn't before. You should validate with the account owner that this is a legitimate request.
 providing_technologies = []

 [savedsearch://ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule]
@@ -290,7 +290,7 @@ confidence = medium
 explanation = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs.
 annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]}
-known_false_positives = It&#39;s possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.
+known_false_positives = It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.
 providing_technologies = []

 [savedsearch://ESCU - AWS Network Access Control List Deleted - Rule]
@@ -300,7 +300,7 @@ confidence = medium
 explanation = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs.
 annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]}
-known_false_positives = It&#39;s possible that a user has legitimately deleted a network ACL.
+known_false_positives = It's possible that a user has legitimately deleted a network ACL.
 providing_technologies = []

 [savedsearch://ESCU - AWS SAML Access by Provider User and Principal - Rule]
@@ -398,9 +398,9 @@ type = detection
 asset_type = Cloud Compute Instance
 confidence = medium
 explanation = This search looks for cloud compute instances created by users who have not created them before.
-how_to_implement = You must be ingesting the appropriate cloud-infrastructure logs Run the &#34;Previously Seen Cloud Compute Creations By User&#34; support search to create of baseline of previously seen users.
+how_to_implement = You must be ingesting the appropriate cloud-infrastructure logs Run the "Previously Seen Cloud Compute Creations By User" support search to create of baseline of previously seen users.
 annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]}
-known_false_positives = It&#39;s possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior.
+known_false_positives = It's possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior.
 providing_technologies = []

 [savedsearch://ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule]
@@ -410,7 +410,7 @@ confidence = medium
 explanation = This search looks at cloud-infrastructure events where an instance is created in any region within the last hour and then compares it to a lookup file of previously seen regions where instances have been created.
 how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Regions - Initial` to build the initial table of images observed and times. You must also enable the second baseline search `Previously Seen Cloud Regions - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_in_previously_unused_region_filter` macro.
 annotations = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
-known_false_positives = It&#39;s possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate.
+known_false_positives = It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate.
 providing_technologies = []

 [savedsearch://ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule]
@@ -438,9 +438,9 @@ type = detection
 asset_type = AWS Instance
 confidence = medium
 explanation = This search looks for cloud instances being modified by users who have not previously modified them.
-how_to_implement = This search has a dependency on other searches to create and update a baseline of users observed to be associated with this activity. The search &#34;Previously Seen Cloud Instance Modifications By User - Update&#34; should be enabled for this detection to properly work.
+how_to_implement = This search has a dependency on other searches to create and update a baseline of users observed to be associated with this activity. The search "Previously Seen Cloud Instance Modifications By User - Update" should be enabled for this detection to properly work.
 annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]}
-known_false_positives = It&#39;s possible that a new user will start to modify EC2 instances when they haven&#39;t before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior.
+known_false_positives = It's possible that a new user will start to modify EC2 instances when they haven't before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior.
 providing_technologies = []

 [savedsearch://ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule]
@@ -450,7 +450,7 @@ confidence = medium
 explanation = This search looks for cloud provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that runs or creates something.
 how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_city_filter` macro.
 annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
-known_false_positives = This is a strictly behavioral search, so we define &#34;false positive&#34; slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you&#39;re searching within, plus what is stored in the cache feature. But while there are really no &#34;false positives&#34; in a traditional sense, there is definitely lots of noise.\
+known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
 This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
 providing_technologies = []

@@ -461,7 +461,7 @@ confidence = medium
 explanation = This search looks for cloud provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that runs or creates something.
 how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_country_filter` macro.
 annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
-known_false_positives = This is a strictly behavioral search, so we define &#34;false positive&#34; slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you&#39;re searching within, plus what is stored in the cache feature. But while there are really no &#34;false positives&#34; in a traditional sense, there is definitely lots of noise.\
+known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
 This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
 providing_technologies = []

@@ -472,7 +472,7 @@ confidence = medium
 explanation = This search looks for cloud provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that runs or creates something.
 how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` macro.
 annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
-known_false_positives = This is a strictly behavioral search, so we define &#34;false positive&#34; slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you&#39;re searching within, plus what is stored in the cache feature. But while there are really no &#34;false positives&#34; in a traditional sense, there is definitely lots of noise.\
+known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
 This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
 providing_technologies = []

@@ -483,7 +483,7 @@ confidence = medium
 explanation = This search looks for cloud provisioning activities from previously unseen regions. Provisioning activities are defined broadly as any event that runs or creates something.
 how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_region_filter` macro.
 annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
-known_false_positives = This is a strictly behavioral search, so we define &#34;false positive&#34; slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you&#39;re searching within, plus what is stored in the cache feature. But while there are really no &#34;false positives&#34; in a traditional sense, there is definitely lots of noise.\
+known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
 This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
 providing_technologies = []

@@ -534,7 +534,7 @@ confidence = medium
 explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
 how_to_implement = 
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
-known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the &#34;All Users&#34; group.
+known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
 providing_technologies = []

 [savedsearch://ESCU - Detect New Open S3 buckets - Rule]
@@ -544,7 +544,7 @@ confidence = medium
 explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket.
 how_to_implement = You must install the AWS App for Splunk.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
-known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the &#34;All Users&#34; group.
+known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
 providing_technologies = []

 [savedsearch://ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule]
@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 36246
+build = 88

 [triggers]
 reload.analytic_stories = simple
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-08-20T22:01:05 UTC
+# On Date: 2021-08-27T21:28:31 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -29,7 +29,7 @@ panels = ["panel://workbench_panel_aws_investigate_security_hub_alerts_by_dest__

 [panel_group://workbench_panel_group_cloud_federated_credential_abuse]
 label = Cloud Federated Credential Abuse
-description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim&#39;s cloud environements.
+description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements.
 disabled = 0

 panels = ["panel://workbench_panel_get_notable_history___response_task"]
@@ -1,21 +1,13 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-08-20T22:01:05 UTC
+# On Date: 2021-08-27T21:28:31 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############


 [aws_cloudwatchlogs_eks]
-definition = sourcetype=&#34;aws:cloudwatchlogs:eks&#34;
-description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
-
-[aws_config]
-definition = sourcetype=aws:config
-description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
-
-[aws_description]
-definition = sourcetype=&#34;aws:description&#34;
+definition = sourcetype="aws:cloudwatchlogs:eks"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

 [aws_config]
@@ -35,11 +27,7 @@ definition = sourcetype=aws:s3:accesslogs
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

 [aws_securityhub_finding]
-definition = sourcetype=&#34;aws:securityhub:finding&#34;
-description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
-
-[aws_securityhub_firehose]
-definition = sourcetype=&#34;aws:securityhub:firehose&#34;
+definition = sourcetype="aws:securityhub:finding"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

 [aws_securityhub_firehose]
@@ -63,7 +51,7 @@ definition = eventtype=cisco_ios
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

 [cloud_api_calls_from_previously_unseen_user_roles_activity_window]
-definition = &#34;-70m@m&#34;
+definition = "-70m@m"
 description = Use this macro to determine how far back you should be checking for new commands from user roles

 [cloudtrail]
@@ -71,7 +59,7 @@ definition = sourcetype=aws:cloudtrail
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

 [cloudwatch_eks]
-definition = sourcetype=&#34;aws:cloudwatchlogs:eks&#34;
+definition = sourcetype="aws:cloudwatchlogs:eks"
 description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch eks logs. Replace the macro definition with configurations for your Splunk Environmnent.

 [cloudwatch_vpc]
@@ -123,19 +111,23 @@ definition = (query=outlook* AND query=login* AND query=account*)
 description = This limits the query fields to domains that are associated with evilginx masquerading as Outlook

 [f5_bigip_rogue]
-definition = index=netops sourcetype=&#34;f5:bigip:rogue&#34;
+definition = index=netops sourcetype="f5:bigip:rogue"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

 [filter_rare_process_allow_list]
-definition = lookup update=true lookup_rare_process_allow_list_default process as process OUTPUTNEW allow_list | where allow_list=&#34;false&#34; | lookup update=true lookup_rare_process_allow_list_local process as process OUTPUT allow_list | where allow_list=&#34;false&#34;
+definition = lookup update=true lookup_rare_process_allow_list_default process as process OUTPUTNEW allow_list | where allow_list="false" | lookup update=true lookup_rare_process_allow_list_local process as process OUTPUT allow_list | where allow_list="false"
 description = This macro is intended to allow_list processes that have been definied as rare

+[github]
+definition = sourcetype=aws:firehose:json
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [google_gcp_pubnet_message]
-definition = sourcetype=&#34;google:gcp:pubsub:message&#34;
+definition = sourcetype="google:gcp:pubsub:message"
 description = customer specific splunk configurations(eg- index, source, sourcetype) for Google GCP. Replace the macro definition with configurations for your Splunk Environmnent.

 [google_gcp_pubsub_message]
-definition = sourcetype=&#34;google:gcp:pubsub:message&#34;
+definition = sourcetype="google:gcp:pubsub:message"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

 [gsuite_drive]
@@ -150,16 +142,24 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true
 description = This macro limits the output to process names that are in the Windows System directory

+[kube_objects_events]
+definition = sourcetype=kube:objects:events
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [kubernetes_azure]
 definition = sourcetype=mscs:storage:blob:json
 description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data from Azure. Replace the macro definition with configurations for your Splunk Environmnent.

+[kubernetes_container_controller]
+definition = sourcetype=kube:container:controller
+description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data. Replace the macro definition with configurations for your Splunk Environmnent.
+
 [linux_hosts]
 definition = index=*
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

 [netbackup]
-definition = sourcetype=&#34;netbackup_logs&#34;
+definition = sourcetype="netbackup_logs"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

 [network_acl_events]
@@ -179,79 +179,83 @@ definition = eventtype=okta_log
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

 [osquery_process]
-definition = eventtype=&#34;osquery-process&#34;
+definition = eventtype="osquery-process"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

 [powershell]
-definition = (source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source=&#34;XmlWinEventLog:Microsoft-Windows-PowerShell/Operational&#34;)
+definition = (source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational")
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

 [previously_seen_cloud_api_calls_per_user_role_forget_window]
-definition = &#34;-90d@d&#34;
+definition = "-90d@d"
 description = Use this macro to determine how long to keep track of cloud api calls per user role

 [previously_seen_cloud_compute_creations_by_user_search_window_begin_offset]
-definition = &#34;-70m@m&#34;
+definition = "-70m@m"
 description = Use this macro to determine how far into the past the window should be to determine if the user is new or not

 [previously_seen_cloud_compute_image_search_window_begin_offset]
-definition = &#34;-70m@m&#34;
+definition = "-70m@m"
 description = Use this macro to determine how far into the past the window should be to determine if the image is new or not

 [previously_seen_cloud_compute_images_forget_window]
-definition = &#34;-90d@d&#34;
+definition = "-90d@d"
 description = Use this macro to determine how long to keep track of cloud instance images

 [previously_seen_cloud_compute_instance_type_forget_window]
-definition = &#34;-90d@d&#34;
+definition = "-90d@d"
 description = Use this macro to determine how long to keep track of cloud instance types

 [previously_seen_cloud_compute_instance_types_search_window_begin_offset]
-definition = &#34;-70m@m&#34;
+definition = "-70m@m"
 description = Use this macro to determine how far into the past the window should be to determine if the instance type is new or not

 [previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset]
-definition = &#34;-70m@m&#34;
+definition = "-70m@m"
 description = Use this macro to determine how far into the past the window should be to determine if the user is new or not

 [previously_seen_cloud_provisioning_activity_forget_window]
-definition = &#34;-90d@d&#34;
+definition = "-90d@d"
 description = Use this macro to determine how long to keep track of cloud provisioning locations

 [previously_seen_cloud_region_forget_window]
-definition = &#34;-90d@d&#34;
+definition = "-90d@d"
 description = Use this macro to determine how long to keep track of cloud regions

 [previously_seen_cloud_regions_search_window_begin_offset]
-definition = &#34;-70m@m&#34;
+definition = "-70m@m"
 description = Use this macro to determine how far into the past the window should be to determine if the region is new or not

 [previously_seen_windows_services_forget_window]
-definition = &#34;-90d@d&#34;
+definition = "-90d@d"
 description = Use this macro to determine how long to keep track of Windows services

 [previously_seen_windows_services_window]
-definition = &#34;-70m@m&#34;
+definition = "-70m@m"
 description = Use this macro to determine how far back you should be checking for new Windows services

 [previously_seen_zoom_child_processes_forget_window]
-definition = &#34;-90d@d&#34;
+definition = "-90d@d"
 description = Use this macro to determine how long to keep track of zoom child processes

 [previously_seen_zoom_child_processes_window]
-definition = &#34;-70m@m&#34;
+definition = "-70m@m"
 description = Use this macro to determine how far back you should be checking for new zoom child processes

 [previously_unseen_cloud_provisioning_activity_window]
-definition = &#34;-70m@m&#34;
+definition = "-70m@m"
 description = Use this macro to determine how far back you should be checking for new provisioning activities

 [printservice]
-definition = source=&#34;wineventlog:microsoft-windows-printservice/operational&#34; OR sourcetype=&#34;WinEventLog:Microsoft-Windows-PrintService/Admin&#34;
+definition = source="wineventlog:microsoft-windows-printservice/operational" OR sourcetype="WinEventLog:Microsoft-Windows-PrintService/Admin"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

+[process_esentutl]
+definition = (Processes.process_name=esentutl.exe OR Processes.original_file_name=esentutl.exe)
+description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
+
 [prohibited_apps_launching_cmd]
-definition = | inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name=&#34;*&#34; . parent_process_name | table parent_process_name
+definition = | inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name="*" . parent_process_name | table parent_process_name
 description = This macro outputs a list of process that should not be the parent process of cmd.exe

 [prohibited_softwares]
@@ -263,11 +267,11 @@ definition = lookup update=true ransomware_extensions_lookup Extensions AS file_
 description = This macro limits the output to files that have extensions associated with ransomware

 [ransomware_notes]
-definition = lookup ransomware_notes_lookup ransomware_notes as file_name OUTPUT status as &#34;Known Ransomware Notes&#34; | search &#34;Known Ransomware Notes&#34;=True
+definition = lookup ransomware_notes_lookup ransomware_notes as file_name OUTPUT status as "Known Ransomware Notes" | search "Known Ransomware Notes"=True
 description = This macro limits the output to files that have been identified as a ransomware note

 [remove_valid_domains]
-definition = eval domain=trim(domain,&#34;*&#34;) | search NOT[| inputlookup domains]  NOT[ |inputlookup cim_corporate_email_domain_lookup] NOT[inputlookup cim_corporate_web_domain_lookup] | eval domain=&#34;*&#34;+domain+&#34;*&#34;
+definition = eval domain=trim(domain,"*") | search NOT[| inputlookup domains]  NOT[ |inputlookup cim_corporate_email_domain_lookup] NOT[inputlookup cim_corporate_web_domain_lookup] | eval domain="*"+domain+"*"
 description = This macro removes valid domains from the output

 [s3_accesslogs]
@@ -276,12 +280,12 @@ description = customer specific splunk configurations(eg- index, source, sourcet

 [security_content_ctime(1)]
 args = field
-definition = convert timeformat=&#34;%Y-%m-%dT%H:%M:%S&#34; ctime($field$)
+definition = convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)
 description = convert epoch time to string

 [security_content_summariesonly]
 definition = summariesonly=false allow_old_summaries=true
-description = search data model&#39;s summaries only
+description = search data model's summaries only

 [security_group_api_calls]
 definition = (eventName=AuthorizeSecurityGroupIngress OR eventName=CreateSecurityGroup OR eventName=DeleteSecurityGroup OR eventName=DescribeClusterSecurityGroups OR eventName=DescribeDBSecurityGroups OR eventName=DescribeSecurityGroupReferences OR eventName=DescribeSecurityGroups OR eventName=DescribeStaleSecurityGroups OR eventName=RevokeSecurityGroupIngress OR eventName=UpdateSecurityGroupRuleDescriptionsIngress)
@@ -304,7 +308,7 @@ definition = lookup update=true is_suspicious_file_extension_lookup file_name OU
 description = This macro limits the output to email attachments that have suspicious extensions

 [suspicious_writes]
-definition = lookup suspicious_writes_lookup file as file_name OUTPUT note as &#34;Reference&#34; | search &#34;Reference&#34; != False
+definition = lookup suspicious_writes_lookup file as file_name OUTPUT note as "Reference" | search "Reference" != False
 description = This macro limites the output to file names that have been marked as suspicious

 [sysmon]
@@ -312,7 +316,7 @@ definition = sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR s
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

 [system_network_configuration_discovery_tools]
-definition = (process_name= &#34;arp.exe&#34; OR process_name= &#34;at.exe&#34; OR process_name= &#34;attrib.exe&#34; OR process_name= &#34;cscript.exe&#34; OR process_name= &#34;dsquery.exe&#34; OR process_name= &#34;hostname.exe&#34; OR process_name= &#34;ipconfig.exe&#34; OR process_name= &#34;mimikatz.exe&#34; OR process_name= &#34;nbstat.exe&#34; OR process_name= &#34;net.exe&#34; OR process_name= &#34;netsh.exe&#34; OR process_name= &#34;nslookup.exe&#34; OR process_name= &#34;ping.exe&#34; OR process_name= &#34;quser.exe&#34; OR process_name= &#34;qwinsta.exe&#34; OR process_name= &#34;reg.exe&#34; OR process_name= &#34;runas.exe&#34; OR process_name= &#34;sc.exe&#34; OR process_name= &#34;schtasks.exe&#34; OR process_name= &#34;ssh.exe&#34; OR process_name= &#34;systeminfo.exe&#34; OR process_name= &#34;taskkill.exe&#34; OR process_name= &#34;telnet.exe&#34; OR process_name= &#34;tracert.exe&#34; OR process_name=&#34;wscript.exe&#34; OR process_name= &#34;xcopy.exe&#34;)
+definition = (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe" OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe" OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name= "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name= "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name= "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name= "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name= "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe")
 description = This macro is a list of process that can be used to discover the network configuration

 [uncommon_processes]
@@ -328,15 +332,15 @@ definition = eventtype=wineventlog_system
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

 [wmi]
-definition = sourcetype=&#34;wineventlog:microsoft-windows-wmi-activity/operational&#34;
+definition = sourcetype="wineventlog:microsoft-windows-wmi-activity/operational"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

 [zeek_rpc]
-definition = index=zeek sourcetype=&#34;zeek:rpc:json&#34;
+definition = index=zeek sourcetype="zeek:rpc:json"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

 [zeek_ssl]
-definition = index=zeek sourcetype=&#34;zeek:ssl:json&#34;
+definition = index=zeek sourcetype="zeek:ssl:json"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.

 [aws_create_policy_version_to_allow_all_resources_filter]
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-08-20T22:01:05 UTC
+# On Date: 2021-08-27T21:28:31 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -44,7 +44,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com errorCode = success | spath input=requestParameters.policyDocument output=key_policy_statements path=Statement{} | mvexpand key_policy_statements | spath input=key_policy_statements output=key_policy_action_1 path=Action | search key_policy_action_1 = &#34;*&#34; | stats count min(_time) as firstTime max(_time) as lastTime values(key_policy_statements) as policy_added by eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_create_policy_version_to_allow_all_resources_filter`
+search = `cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com errorCode = success | spath input=requestParameters.policyDocument output=key_policy_statements path=Statement{} | mvexpand key_policy_statements | spath input=key_policy_statements output=key_policy_action_1 path=Action | search key_policy_action_1 = "*" | stats count min(_time) as firstTime max(_time) as lastTime values(key_policy_statements) as policy_added by eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_create_policy_version_to_allow_all_resources_filter`

 [ESCU - AWS CreateAccessKey - Rule]
 action.escu = 0
@@ -132,7 +132,7 @@ action.escu.mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on O
 action.escu.data_models = ["Authentication"]
 action.escu.eli5 = This search looks for AssumeRole events where an IAM role in a different account is requested for the first time.
 action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen AWS Cross Account Activity - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen AWS Cross Account Activity - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `aws_cross_account_activity_from_previously_unseen_account_filter` macro.
-action.escu.known_false_positives = Using multiple AWS accounts and roles is perfectly valid behavior. It&#39;s suspicious when an account requests privileges of an account it hasn&#39;t before. You should validate with the account owner that this is a legitimate request.
+action.escu.known_false_positives = Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicious when an account requests privileges of an account it hasn't before. You should validate with the account owner that this is a legitimate request.
 action.escu.creation_date = 2020-05-28
 action.escu.modification_date = 2020-05-28
 action.escu.confidence = high
@@ -161,7 +161,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role &#34;arn:aws:sts:*:(?&lt;dest_account&gt;.*):&#34; | where vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | lookup previously_seen_aws_cross_account_activity requestingAccountId, requestedAccountId, OUTPUTNEW firstTime | eval status = if(firstTime &gt; relative_time(now(), &#34;-24h@h&#34;),&#34;New Cross Account Activity&#34;,&#34;Previously Seen&#34;) |  where status = &#34;New Cross Account Activity&#34; | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `aws_cross_account_activity_from_previously_unseen_account_filter`
+search = | tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role "arn:aws:sts:*:(?<dest_account>.*):" | where vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | lookup previously_seen_aws_cross_account_activity requestingAccountId, requestedAccountId, OUTPUTNEW firstTime | eval status = if(firstTime > relative_time(now(), "-24h@h"),"New Cross Account Activity","Previously Seen") |  where status = "New Cross Account Activity" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `aws_cross_account_activity_from_previously_unseen_account_filter`

 [ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule]
 action.escu = 0
@@ -200,7 +200,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy | spath input=requestParameters.policy output=key_policy_statements path=Statement{} | mvexpand key_policy_statements | spath input=key_policy_statements output=key_policy_action_1 path=Action | spath input=key_policy_statements output=key_policy_action_2 path=Action{} | eval key_policy_action=mvappend(key_policy_action_1, key_policy_action_2) | spath input=key_policy_statements output=key_policy_principal path=Principal.AWS | search key_policy_action=&#34;kms:Encrypt&#34; AND key_policy_principal=&#34;*&#34; | stats count min(_time) as firstTime max(_time) as lastTime by eventName eventSource eventID awsRegion userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`
+search = `cloudtrail` eventName=CreateKey OR eventName=PutKeyPolicy | spath input=requestParameters.policy output=key_policy_statements path=Statement{} | mvexpand key_policy_statements | spath input=key_policy_statements output=key_policy_action_1 path=Action | spath input=key_policy_statements output=key_policy_action_2 path=Action{} | eval key_policy_action=mvappend(key_policy_action_1, key_policy_action_2) | spath input=key_policy_statements output=key_policy_principal path=Principal.AWS | search key_policy_action="kms:Encrypt" AND key_policy_principal="*" | stats count min(_time) as firstTime max(_time) as lastTime by eventName eventSource eventID awsRegion userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter`

 [ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule]
 action.escu = 0
@@ -239,7 +239,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption=&#34;aws:kms&#34; | rename requestParameters.bucketName AS bucket_name, requestParameters.x-amz-copy-source AS src_file, requestParameters.key AS dest_file | stats count min(_time) as firstTime max(_time) as lastTime values(src_file) AS src_file values(dest_file) AS dest_file values(userAgent) AS userAgent values(region) AS region values(src) AS src by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_with_kms_keys_performing_encryption_s3_filter`
+search = `cloudtrail` eventName=CopyObject requestParameters.x-amz-server-side-encryption="aws:kms" | rename requestParameters.bucketName AS bucket_name, requestParameters.x-amz-copy-source AS src_file, requestParameters.key AS dest_file | stats count min(_time) as firstTime max(_time) as lastTime values(src_file) AS src_file values(dest_file) AS dest_file values(userAgent) AS userAgent values(region) AS region values(src) AS src by user | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_detect_users_with_kms_keys_performing_encryption_s3_filter`

 [ESCU - AWS Excessive Security Scanning - Rule]
 action.escu = 0
@@ -278,7 +278,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get*  | stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName values(src) as src values(userAgent) as userAgent by user userIdentity.arn | where dc_events &gt; 50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter`
+search = `cloudtrail` eventName=Describe* OR eventName=List* OR eventName=Get*  | stats dc(eventName) as dc_events min(_time) as firstTime max(_time) as lastTime values(eventName) as eventName values(src) as src values(userAgent) as userAgent by user userIdentity.arn | where dc_events > 50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_excessive_security_scanning_filter`

 [ESCU - AWS IAM AccessDenied Discovery Events - Rule]
 action.escu = 0
@@ -317,7 +317,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `cloudtrail` (errorCode = &#34;AccessDenied&#34;) user_type=IAMUser (userAgent!=*.amazonaws.com) | bucket _time span=1h | stats count as failures min(_time) as firstTime max(_time) as lastTime, dc(eventName) as methods, dc(eventSource) as sources values(userIdentity.arn) by src_ip, userIdentity.arn, _time | where failures &gt;= 5 and methods &gt;= 1 and sources &gt;= 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_accessdenied_discovery_events_filter`
+search = `cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com) | bucket _time span=1h | stats count as failures min(_time) as firstTime max(_time) as lastTime, dc(eventName) as methods, dc(eventSource) as sources values(userIdentity.arn) by src_ip, userIdentity.arn, _time | where failures >= 5 and methods >= 1 and sources >= 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_accessdenied_discovery_events_filter`

 [ESCU - AWS IAM Assume Role Policy Brute Force - Rule]
 action.escu = 0
@@ -356,7 +356,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion userIdentity.principalId user_arn | where count &gt;= 2 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_assume_role_policy_brute_force_filter`
+search = `cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure (userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion userIdentity.principalId user_arn | where count >= 2 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_iam_assume_role_policy_brute_force_filter`

 [ESCU - AWS IAM Delete Policy - Rule]
 action.escu = 0
@@ -483,7 +483,7 @@ action.escu.mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on O
 action.escu.data_models = []
 action.escu.eli5 = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs.
-action.escu.known_false_positives = It&#39;s possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.
+action.escu.known_false_positives = It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.
 action.escu.creation_date = 2021-01-11
 action.escu.modification_date = 2021-01-11
 action.escu.confidence = high
@@ -512,7 +512,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1 | append [search `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol!=-1 | eval port_range=&#39;requestParameters.portRange.to&#39; - &#39;requestParameters.portRange.from&#39; | where port_range&gt;1024] | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId eventName requestParameters.ruleAction requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to requestParameters.portRange.from src userAgent requestParameters.cidrBlock | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_network_access_control_list_created_with_all_open_ports_filter`
+search = `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol=-1 | append [search `cloudtrail` eventName=CreateNetworkAclEntry OR eventName=ReplaceNetworkAclEntry requestParameters.ruleAction=allow requestParameters.egress=false requestParameters.aclProtocol!=-1 | eval port_range='requestParameters.portRange.to' - 'requestParameters.portRange.from' | where port_range>1024] | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId eventName requestParameters.ruleAction requestParameters.egress requestParameters.aclProtocol requestParameters.portRange.to requestParameters.portRange.from src userAgent requestParameters.cidrBlock | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `aws_network_access_control_list_created_with_all_open_ports_filter`

 [ESCU - AWS Network Access Control List Deleted - Rule]
 action.escu = 0
@@ -522,7 +522,7 @@ action.escu.mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on O
 action.escu.data_models = []
 action.escu.eli5 = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs.
-action.escu.known_false_positives = It&#39;s possible that a user has legitimately deleted a network ACL.
+action.escu.known_false_positives = It's possible that a user has legitimately deleted a network ACL.
 action.escu.creation_date = 2021-01-12
 action.escu.modification_date = 2021-01-12
 action.escu.confidence = high
@@ -746,7 +746,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats count as api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name(&#34;All_Changes&#34;)` | eval HourOfDay=strftime(_time, &#34;%H&#34;) | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, &#34;%w&#34;) | eval isWeekend=if(DayOfWeek &gt;= 1 AND DayOfWeek &lt;= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_api_calls_v1] | where cardinality &gt;=16 | apply cloud_excessive_api_calls_v1 threshold=0.005 | rename &#34;IsOutlier(api_calls)&#34; as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), &#34;:&#34;), 0) | where api_calls &gt; expected_upper_threshold | eval distance_from_threshold = api_calls - expected_upper_threshold | table _time, user, command, api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_infrastructure_api_calls_filter`
+search = | tstats count as api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_api_calls_v1] | where cardinality >=16 | apply cloud_excessive_api_calls_v1 threshold=0.005 | rename "IsOutlier(api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where api_calls > expected_upper_threshold | eval distance_from_threshold = api_calls - expected_upper_threshold | table _time, user, command, api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_infrastructure_api_calls_filter`

 [ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule]
 action.escu = 0
@@ -785,7 +785,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats count as instances_destroyed values(All_Changes.object_id) as object_id from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name(&#34;All_Changes&#34;)` | eval HourOfDay=strftime(_time, &#34;%H&#34;) | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, &#34;%w&#34;) | eval isWeekend=if(DayOfWeek &gt;= 1 AND DayOfWeek &lt;= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_destroyed_v1] | where cardinality &gt;=16 | apply cloud_excessive_instances_destroyed_v1 threshold=0.005 | rename &#34;IsOutlier(instances_destroyed)&#34; as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), &#34;:&#34;), 0) | eval distance_from_threshold = instances_destroyed - expected_upper_threshold | table _time, user, instances_destroyed, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_destroyed_filter`
+search = | tstats count as instances_destroyed values(All_Changes.object_id) as object_id from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_destroyed_v1] | where cardinality >=16 | apply cloud_excessive_instances_destroyed_v1 threshold=0.005 | rename "IsOutlier(instances_destroyed)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | eval distance_from_threshold = instances_destroyed - expected_upper_threshold | table _time, user, instances_destroyed, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_destroyed_filter`

 [ESCU - Abnormally High Number Of Cloud Instances Launched - Rule]
 action.escu = 0
@@ -824,7 +824,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats count as instances_launched values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name(&#34;All_Changes&#34;)` | eval HourOfDay=strftime(_time, &#34;%H&#34;) | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, &#34;%w&#34;) | eval isWeekend=if(DayOfWeek &gt;= 1 AND DayOfWeek &lt;= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_created_v1] | where cardinality &gt;=16 | apply cloud_excessive_instances_created_v1 threshold=0.005 | rename &#34;IsOutlier(instances_launched)&#34; as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), &#34;:&#34;), 0) | eval distance_from_threshold = instances_launched - expected_upper_threshold | table _time, user, instances_launched, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_launched_filter`
+search = | tstats count as instances_launched values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join HourOfDay isWeekend [summary cloud_excessive_instances_created_v1] | where cardinality >=16 | apply cloud_excessive_instances_created_v1 threshold=0.005 | rename "IsOutlier(instances_launched)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | eval distance_from_threshold = instances_launched - expected_upper_threshold | table _time, user, instances_launched, expected_upper_threshold, distance_from_threshold, object_id | `abnormally_high_number_of_cloud_instances_launched_filter`

 [ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule]
 action.escu = 0
@@ -863,7 +863,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats count as security_group_api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.object_category=firewall AND All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name(&#34;All_Changes&#34;)` | eval HourOfDay=strftime(_time, &#34;%H&#34;) | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, &#34;%w&#34;) | eval isWeekend=if(DayOfWeek &gt;= 1 AND DayOfWeek &lt;= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_security_group_api_calls_v1] | where cardinality &gt;=16 | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 | rename &#34;IsOutlier(security_group_api_calls)&#34; as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), &#34;:&#34;), 0) | where security_group_api_calls &gt; expected_upper_threshold | eval distance_from_threshold = security_group_api_calls - expected_upper_threshold | table _time, user, command, security_group_api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`
+search = | tstats count as security_group_api_calls values(All_Changes.command) as command from datamodel=Change where All_Changes.object_category=firewall AND All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_security_group_api_calls_v1] | where cardinality >=16 | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 | rename "IsOutlier(security_group_api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where security_group_api_calls > expected_upper_threshold | eval distance_from_threshold = security_group_api_calls - expected_upper_threshold | table _time, user, command, security_group_api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`

 [ESCU - Cloud API Calls From Previously Unseen User Roles - Rule]
 action.escu = 0
@@ -902,7 +902,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command All_Changes.object | `drop_dm_object_name(&#34;All_Changes&#34;)` | lookup previously_seen_cloud_api_calls_per_user_role user as user, command as command OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUserApiCall=min(firstTimeSeen) | where isnull(firstTimeSeenUserApiCall) OR firstTimeSeenUserApiCall &gt; relative_time(now(),&#34;-24h@h&#34;) | table firstTime, user, object, command |`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `cloud_api_calls_from_previously_unseen_user_roles_filter`
+search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command All_Changes.object | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_api_calls_per_user_role user as user, command as command OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUserApiCall=min(firstTimeSeen) | where isnull(firstTimeSeenUserApiCall) OR firstTimeSeenUserApiCall > relative_time(now(),"-24h@h") | table firstTime, user, object, command |`security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `cloud_api_calls_from_previously_unseen_user_roles_filter`

 [ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule]
 action.escu = 0
@@ -911,8 +911,8 @@ description = This search looks for cloud compute instances created by users who
 action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]}
 action.escu.data_models = ["Change"]
 action.escu.eli5 = This search looks for cloud compute instances created by users who have not created them before.
-action.escu.how_to_implement = You must be ingesting the appropriate cloud-infrastructure logs Run the &#34;Previously Seen Cloud Compute Creations By User&#34; support search to create of baseline of previously seen users.
-action.escu.known_false_positives = It&#39;s possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior.
+action.escu.how_to_implement = You must be ingesting the appropriate cloud-infrastructure logs Run the "Previously Seen Cloud Compute Creations By User" support search to create of baseline of previously seen users.
+action.escu.known_false_positives = It's possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior.
 action.escu.creation_date = 2021-07-13
 action.escu.modification_date = 2021-07-13
 action.escu.confidence = high
@@ -941,7 +941,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object) as dest from datamodel=Change where All_Changes.action=created by All_Changes.user All_Changes.vendor_region | `drop_dm_object_name(&#34;All_Changes&#34;)` | lookup previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) | where isnull(firstTimeSeenUser) OR firstTimeSeenUser &gt; relative_time(now(), &#34;-24h@h&#34;) | table firstTime, user, dest, count vendor_region | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_by_previously_unseen_user_filter`
+search = | tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object) as dest from datamodel=Change where All_Changes.action=created by All_Changes.user All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_compute_creations_by_user user as user OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) | where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h") | table firstTime, user, dest, count vendor_region | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_by_previously_unseen_user_filter`

 [ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule]
 action.escu = 0
@@ -951,7 +951,7 @@ action.escu.mappings = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on O
 action.escu.data_models = ["Change"]
 action.escu.eli5 = This search looks at cloud-infrastructure events where an instance is created in any region within the last hour and then compares it to a lookup file of previously seen regions where instances have been created.
 action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Regions - Initial` to build the initial table of images observed and times. You must also enable the second baseline search `Previously Seen Cloud Regions - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_in_previously_unused_region_filter` macro.
-action.escu.known_false_positives = It&#39;s possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate.
+action.escu.known_false_positives = It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate.
 action.escu.creation_date = 2020-09-02
 action.escu.modification_date = 2020-09-02
 action.escu.confidence = high
@@ -980,7 +980,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region, All_Changes.user | `drop_dm_object_name(&#34;All_Changes&#34;)` | lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion &gt; relative_time(now(), &#34;-24h@h&#34;) | table firstTime, user, dest, count , vendor_region | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_in_previously_unused_region_filter`
+search = | tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region, All_Changes.user | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(), "-24h@h") | table firstTime, user, dest, count , vendor_region | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_in_previously_unused_region_filter`

 [ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule]
 action.escu = 0
@@ -1019,7 +1019,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id, All_Changes.user | `drop_dm_object_name(&#34;All_Changes&#34;)` | `drop_dm_object_name(&#34;Instance_Changes&#34;)` | where image_id != &#34;unknown&#34; | lookup previously_seen_cloud_compute_images image_id as image_id OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenImage=min(firstTimeSeen) | where isnull(firstTimeSeenImage) OR firstTimeSeenImage &gt; relative_time(now(), &#34;-24h@h&#34;) | table firstTime, user, image_id, count, dest | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_with_previously_unseen_image_filter`
+search = | tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id, All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" | lookup previously_seen_cloud_compute_images image_id as image_id OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenImage=min(firstTimeSeen) | where isnull(firstTimeSeenImage) OR firstTimeSeenImage > relative_time(now(), "-24h@h") | table firstTime, user, image_id, count, dest | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_with_previously_unseen_image_filter`

 [ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule]
 action.escu = 0
@@ -1058,7 +1058,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type, All_Changes.user | `drop_dm_object_name(&#34;All_Changes&#34;)` | `drop_dm_object_name(&#34;Instance_Changes&#34;)` | where instance_type != &#34;unknown&#34; | lookup previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenInstanceType=min(firstTimeSeen) | where isnull(firstTimeSeenInstanceType) OR firstTimeSeenInstanceType &gt; relative_time(now(), &#34;-24h@h&#34;) | table firstTime, user, dest, count, instance_type | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`
+search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type, All_Changes.user | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where instance_type != "unknown" | lookup previously_seen_cloud_compute_instance_types instance_type as instance_type OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenInstanceType=min(firstTimeSeen) | where isnull(firstTimeSeenInstanceType) OR firstTimeSeenInstanceType > relative_time(now(), "-24h@h") | table firstTime, user, dest, count, instance_type | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_with_previously_unseen_instance_type_filter`

 [ESCU - Cloud Instance Modified By Previously Unseen User - Rule]
 action.escu = 0
@@ -1067,8 +1067,8 @@ description = This search looks for cloud instances being modified by users who
 action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]}
 action.escu.data_models = ["Change"]
 action.escu.eli5 = This search looks for cloud instances being modified by users who have not previously modified them.
-action.escu.how_to_implement = This search has a dependency on other searches to create and update a baseline of users observed to be associated with this activity. The search &#34;Previously Seen Cloud Instance Modifications By User - Update&#34; should be enabled for this detection to properly work.
-action.escu.known_false_positives = It&#39;s possible that a new user will start to modify EC2 instances when they haven&#39;t before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior.
+action.escu.how_to_implement = This search has a dependency on other searches to create and update a baseline of users observed to be associated with this activity. The search "Previously Seen Cloud Instance Modifications By User - Update" should be enabled for this detection to properly work.
+action.escu.known_false_positives = It's possible that a new user will start to modify EC2 instances when they haven't before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior.
 action.escu.creation_date = 2020-07-29
 action.escu.modification_date = 2020-07-29
 action.escu.confidence = high
@@ -1097,7 +1097,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command) as command from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user | `drop_dm_object_name(&#34;All_Changes&#34;)` | lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) | where isnull(firstTimeSeenUser) OR firstTimeSeenUser &gt; relative_time(now(), &#34;-24h@h&#34;) | table firstTime user command object_id count | `security_content_ctime(firstTime)` | `cloud_instance_modified_by_previously_unseen_user_filter`
+search = | tstats `security_content_summariesonly` count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as object_id values(All_Changes.command) as command from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_instance_modifications_by_user user as user OUTPUTNEW firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenUser=min(firstTimeSeen) | where isnull(firstTimeSeenUser) OR firstTimeSeenUser > relative_time(now(), "-24h@h") | table firstTime user command object_id count | `security_content_ctime(firstTime)` | `cloud_instance_modified_by_previously_unseen_user_filter`

 [ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule]
 action.escu = 0
@@ -1107,7 +1107,7 @@ action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": [
 action.escu.data_models = ["Change"]
 action.escu.eli5 = This search looks for cloud provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that runs or creates something.
 action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_city_filter` macro.
-action.escu.known_false_positives = This is a strictly behavioral search, so we define &#34;false positive&#34; slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you&#39;re searching within, plus what is stored in the cache feature. But while there are really no &#34;false positives&#34; in a traditional sense, there is definitely lots of noise.\
+action.escu.known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
 This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
 action.escu.creation_date = 2020-10-09
 action.escu.modification_date = 2020-10-09
@@ -1137,7 +1137,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name(&#34;All_Changes&#34;)` | iplocation src | where isnotnull(City) | lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenCity=min(firstTimeSeen) | where isnull(firstTimeSeenCity) OR firstTimeSeenCity &gt; relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) | table firstTime, src, City, user, object, command | `cloud_provisioning_activity_from_previously_unseen_city_filter` | `security_content_ctime(firstTime)`
+search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(City) | lookup previously_seen_cloud_provisioning_activity_sources City as City OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenCity=min(firstTimeSeen) | where isnull(firstTimeSeenCity) OR firstTimeSeenCity > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) | table firstTime, src, City, user, object, command | `cloud_provisioning_activity_from_previously_unseen_city_filter` | `security_content_ctime(firstTime)`

 [ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule]
 action.escu = 0
@@ -1147,7 +1147,7 @@ action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": [
 action.escu.data_models = ["Change"]
 action.escu.eli5 = This search looks for cloud provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that runs or creates something.
 action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_country_filter` macro.
-action.escu.known_false_positives = This is a strictly behavioral search, so we define &#34;false positive&#34; slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you&#39;re searching within, plus what is stored in the cache feature. But while there are really no &#34;false positives&#34; in a traditional sense, there is definitely lots of noise.\
+action.escu.known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
 This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
 action.escu.creation_date = 2020-10-09
 action.escu.modification_date = 2020-10-09
@@ -1177,7 +1177,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name(&#34;All_Changes&#34;)` | iplocation src | where isnotnull(Country) | lookup previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenCountry=min(firstTimeSeen) | where isnull(firstTimeSeenCountry) OR firstTimeSeenCountry &gt; relative_time(now(), &#34;-24h@h&#34;) | table firstTime, src, Country, user, object, command | `cloud_provisioning_activity_from_previously_unseen_country_filter` | `security_content_ctime(firstTime)`
+search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) | lookup previously_seen_cloud_provisioning_activity_sources Country as Country OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenCountry=min(firstTimeSeen) | where isnull(firstTimeSeenCountry) OR firstTimeSeenCountry > relative_time(now(), "-24h@h") | table firstTime, src, Country, user, object, command | `cloud_provisioning_activity_from_previously_unseen_country_filter` | `security_content_ctime(firstTime)`

 [ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule]
 action.escu = 0
@@ -1187,7 +1187,7 @@ action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": [
 action.escu.data_models = ["Change"]
 action.escu.eli5 = This search looks for cloud provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that runs or creates something.
 action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` macro.
-action.escu.known_false_positives = This is a strictly behavioral search, so we define &#34;false positive&#34; slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you&#39;re searching within, plus what is stored in the cache feature. But while there are really no &#34;false positives&#34; in a traditional sense, there is definitely lots of noise.\
+action.escu.known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
 This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
 action.escu.creation_date = 2020-08-16
 action.escu.modification_date = 2020-08-16
@@ -1217,7 +1217,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.command | `drop_dm_object_name(&#34;All_Changes&#34;)` | lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) | where isnull(firstTimeSeenSrc) OR firstTimeSeenSrc &gt; relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) | table firstTime, src, user, object_id, command | `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` | `security_content_ctime(firstTime)`
+search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id) as object_id from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) | where isnull(firstTimeSeenSrc) OR firstTimeSeenSrc > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) | table firstTime, src, user, object_id, command | `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` | `security_content_ctime(firstTime)`

 [ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule]
 action.escu = 0
@@ -1227,7 +1227,7 @@ action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": [
 action.escu.data_models = ["Change"]
 action.escu.eli5 = This search looks for cloud provisioning activities from previously unseen regions. Provisioning activities are defined broadly as any event that runs or creates something.
 action.escu.how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_region_filter` macro.
-action.escu.known_false_positives = This is a strictly behavioral search, so we define &#34;false positive&#34; slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you&#39;re searching within, plus what is stored in the cache feature. But while there are really no &#34;false positives&#34; in a traditional sense, there is definitely lots of noise.\
+action.escu.known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
 This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
 action.escu.creation_date = 2020-08-16
 action.escu.modification_date = 2020-08-16
@@ -1257,7 +1257,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name(&#34;All_Changes&#34;)` | iplocation src | where isnotnull(Region) | lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion &gt; relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) | table firstTime, src, Region, user, object, command | `cloud_provisioning_activity_from_previously_unseen_region_filter` | `security_content_ctime(firstTime)`
+search = | tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.object, All_Changes.command | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Region) | lookup previously_seen_cloud_provisioning_activity_sources Region as Region OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) | table firstTime, src, Region, user, object, command | `cloud_provisioning_activity_from_previously_unseen_region_filter` | `security_content_ctime(firstTime)`

 [ESCU - Detect AWS Console Login by New User - Rule]
 action.escu = 0
@@ -1296,7 +1296,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user | `drop_dm_object_name(Authentication)` | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user | eval userStatus=if(firstTime &gt;=relative_time(now(),&#34;-24h@h&#34;), &#34;First Time Logging into AWS Console&#34;, &#34;Previously Seen User&#34;) |where userStatus=&#34;First Time Logging into AWS Console&#34; |  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `detect_aws_console_login_by_new_user_filter`
+search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user | `drop_dm_object_name(Authentication)` | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user | eval userStatus=if(firstTime >=relative_time(now(),"-24h@h"), "First Time Logging into AWS Console", "Previously Seen User") |where userStatus="First Time Logging into AWS Console" |  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `detect_aws_console_login_by_new_user_filter`

 [ESCU - Detect AWS Console Login by User from New City - Rule]
 action.escu = 0
@@ -1335,7 +1335,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user City | join user  type=outer [| inputlookup previously_seen_users_console_logins | stats earliest(firstTime) AS earliestseen by user City | fields earliestseen user City] | eval userCity=if(firstTime &gt;= relative_time(now(), &#34;-24h@h&#34;), &#34;New City&#34;,&#34;Previously Seen City&#34;) | eval userStatus=if(earliestseen &gt;= relative_time(now(), &#34;-24h@h&#34;) OR isnull(earliestseen), &#34;New User&#34;,&#34;Old User&#34;) | where userCity = &#34;New City&#34; AND userStatus != &#34;Old User&#34; | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime lastTime user City  userStatus userCity  | `detect_aws_console_login_by_user_from_new_city_filter`
+search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user City | join user  type=outer [| inputlookup previously_seen_users_console_logins | stats earliest(firstTime) AS earliestseen by user City | fields earliestseen user City] | eval userCity=if(firstTime >= relative_time(now(), "-24h@h"), "New City","Previously Seen City") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") | where userCity = "New City" AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime lastTime user City  userStatus userCity  | `detect_aws_console_login_by_user_from_new_city_filter`

 [ESCU - Detect AWS Console Login by User from New Country - Rule]
 action.escu = 0
@@ -1374,7 +1374,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user Country | join user  type=outer [| inputlookup previously_seen_users_console_logins | stats earliest(firstTime) AS earliestseen by user Country | fields earliestseen user Country] | eval userCountry=if(firstTime &gt;= relative_time(now(), &#34;-24h@h&#34;), &#34;New Country&#34;,&#34;Previously Seen Country&#34;) | eval userStatus=if(earliestseen &gt;= relative_time(now(),&#34;-24h@h&#34;) OR isnull(earliestseen), &#34;New User&#34;,&#34;Old User&#34;) | where userCountry = &#34;New Country&#34; AND userStatus != &#34;Old User&#34; | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime lastTime user Country  userStatus userCountry  | `detect_aws_console_login_by_user_from_new_country_filter`
+search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user Country | join user  type=outer [| inputlookup previously_seen_users_console_logins | stats earliest(firstTime) AS earliestseen by user Country | fields earliestseen user Country] | eval userCountry=if(firstTime >= relative_time(now(), "-24h@h"), "New Country","Previously Seen Country") | eval userStatus=if(earliestseen >= relative_time(now(),"-24h@h") OR isnull(earliestseen), "New User","Old User") | where userCountry = "New Country" AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime lastTime user Country  userStatus userCountry  | `detect_aws_console_login_by_user_from_new_country_filter`

 [ESCU - Detect AWS Console Login by User from New Region - Rule]
 action.escu = 0
@@ -1413,7 +1413,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user Region | join user  type=outer [| inputlookup previously_seen_users_console_logins | stats earliest(firstTime) AS earliestseen by user Region | fields earliestseen user Region] | eval userRegion=if(firstTime &gt;= relative_time(now(), &#34;-24h@h&#34;), &#34;New Region&#34;,&#34;Previously Seen Region&#34;) | eval userStatus=if(earliestseen &gt;= relative_time(now(), &#34;-24h@h&#34;) OR isnull(earliestseen), &#34;New User&#34;,&#34;Old User&#34;) | where userRegion = &#34;New Region&#34; AND userStatus != &#34;Old User&#34; | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime lastTime user Region  userStatus userRegion  | `detect_aws_console_login_by_user_from_new_region_filter`
+search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | `drop_dm_object_name(Authentication)` | table firstTime lastTime user Region | join user  type=outer [| inputlookup previously_seen_users_console_logins | stats earliest(firstTime) AS earliestseen by user Region | fields earliestseen user Region] | eval userRegion=if(firstTime >= relative_time(now(), "-24h@h"), "New Region","Previously Seen Region") | eval userStatus=if(earliestseen >= relative_time(now(), "-24h@h") OR isnull(earliestseen), "New User","Old User") | where userRegion = "New Region" AND userStatus != "Old User" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | table firstTime lastTime user Region  userStatus userRegion  | `detect_aws_console_login_by_user_from_new_region_filter`

 [ESCU - Detect New Open S3 Buckets over AWS CLI - Rule]
 action.escu = 0
@@ -1423,7 +1423,7 @@ action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on O
 action.escu.data_models = []
 action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
 action.escu.how_to_implement = 
-action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the &#34;All Users&#34; group.
+action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
 action.escu.creation_date = 2021-07-19
 action.escu.modification_date = 2021-07-19
 action.escu.confidence = high
@@ -1452,7 +1452,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `cloudtrail` eventSource=&#34;s3.amazonaws.com&#34; (userAgent=&#34;[aws-cli*&#34; OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN (&#34;*AuthenticatedUsers&#34;,&#34;*AllUsers&#34;) OR requestParameters.accessControlList.x-amz-grant-write IN (&#34;*AuthenticatedUsers&#34;,&#34;*AllUsers&#34;) OR requestParameters.accessControlList.x-amz-grant-write-acp IN (&#34;*AuthenticatedUsers&#34;,&#34;*AllUsers&#34;) OR requestParameters.accessControlList.x-amz-grant-full-control IN (&#34;*AuthenticatedUsers&#34;,&#34;*AllUsers&#34;) | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` 
+search = `cloudtrail` eventSource="s3.amazonaws.com" (userAgent="[aws-cli*" OR userAgent=aws-cli* ) eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` 

 [ESCU - Detect New Open S3 buckets - Rule]
 action.escu = 0
@@ -1462,7 +1462,7 @@ action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on O
 action.escu.data_models = []
 action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket.
 action.escu.how_to_implement = You must install the AWS App for Splunk.
-action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the &#34;All Users&#34; group.
+action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
 action.escu.creation_date = 2021-07-19
 action.escu.modification_date = 2021-07-19
 action.escu.confidence = high
@@ -1491,7 +1491,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw &#34;(?&lt;json_field&gt;{.+})&#34; | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI | spath input=grantees output=permission path=Permission | search uri IN (&#34;http://acs.amazonaws.com/groups/global/AllUsers&#34;,&#34;http://acs.amazonaws.com/groups/global/AuthenticatedUsers&#34;) | search permission IN (&#34;READ&#34;,&#34;READ_ACP&#34;,&#34;WRITE&#34;,&#34;WRITE_ACP&#34;,&#34;FULL_CONTROL&#34;) | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime max(_time) as lastTime by user_arn userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` 
+search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?<json_field>{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime max(_time) as lastTime by user_arn userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` 

 [ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule]
 action.escu = 0
@@ -1530,7 +1530,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `aws_securityhub_finding` &#34;Resources{}.Type&#34;=AWSEC2Instance | bucket span=4h _time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev | eval threshold_value = 3 | eval isOutlier=if(alerts &gt; total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`
+search = `aws_securityhub_finding` "Resources{}.Type"=AWSEC2Instance | bucket span=4h _time | stats count AS alerts values(Title) as Title values(Types{}) as Types values(vendor_account) as vendor_account values(vendor_region) as vendor_region values(severity) as severity by _time dest | eventstats avg(alerts) as total_alerts_avg, stdev(alerts) as total_alerts_stdev | eval threshold_value = 3 | eval isOutlier=if(alerts > total_alerts_avg+(total_alerts_stdev * threshold_value), 1, 0) | search isOutlier=1 | table _time dest alerts Title Types vendor_account vendor_region severity isOutlier total_alerts_avg | `detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter`

 [ESCU - Detect shared ec2 snapshot - Rule]
 action.escu = 0
@@ -1569,7 +1569,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,&#34;Match&#34;,&#34;No Match&#34;) | table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent | where match = &#34;No Match&#34; | `detect_shared_ec2_snapshot_filter` 
+search = `cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter` 

 [ESCU - O365 Add App Role Assignment Grant User - Rule]
 action.escu = 0
@@ -1608,7 +1608,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `o365_management_activity` Workload=AzureActiveDirectory Operation=&#34;Add app role assignment grant to user.&#34; | stats count min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by ActorIpAddress dest ResultStatus | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_add_app_role_assignment_grant_user_filter`
+search = `o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment grant to user." | stats count min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by ActorIpAddress dest ResultStatus | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_add_app_role_assignment_grant_user_filter`

 [ESCU - O365 Added Service Principal - Rule]
 action.escu = 0
@@ -1647,7 +1647,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `o365_management_activity` Workload=AzureActiveDirectory signature=&#34;Add service principal credentials.&#34; | stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue) as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress signature | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_added_service_principal_filter`
+search = `o365_management_activity` Workload=AzureActiveDirectory signature="Add service principal credentials." | stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue) as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress signature | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_added_service_principal_filter`

 [ESCU - O365 Bypass MFA via Trusted IP - Rule]
 action.escu = 0
@@ -1686,7 +1686,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `o365_management_activity` signature=&#34;Set Company Information.&#34; ModifiedProperties{}.Name=StrongAuthenticationPolicy | rex max_match=100 field=ModifiedProperties{}.NewValue &#34;(?&lt;ip_addresses_new_added&gt;\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})&#34; | rex max_match=100 field=ModifiedProperties{}.OldValue &#34;(?&lt;ip_addresses_old&gt;\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})&#34; | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,&#34;0&#34;) | mvexpand ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) |stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature Workload vendor_account status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `o365_bypass_mfa_via_trusted_ip_filter`
+search = `o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy | rex max_match=100 field=ModifiedProperties{}.NewValue "(?<ip_addresses_new_added>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | rex max_match=100 field=ModifiedProperties{}.OldValue "(?<ip_addresses_old>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) |stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature Workload vendor_account status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `o365_bypass_mfa_via_trusted_ip_filter`

 [ESCU - O365 Disable MFA - Rule]
 action.escu = 0
@@ -1725,7 +1725,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `o365_management_activity` Operation=&#34;Disable Strong Authentication.&#34; | stats count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation user status signature dest ResultStatus |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `o365_disable_mfa_filter`
+search = `o365_management_activity` Operation="Disable Strong Authentication." | stats count earliest(_time) as firstTime latest(_time) as lastTime by UserType Operation user status signature dest ResultStatus |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `o365_disable_mfa_filter`

 [ESCU - O365 Excessive Authentication Failures Alert - Rule]
 action.escu = 0
@@ -1764,7 +1764,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=Failed | stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user | where count &gt; 10 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `o365_excessive_authentication_failures_alert_filter`
+search = `o365_management_activity` Workload=AzureActiveDirectory UserAuthenticationMethod=* status=Failed | stats count earliest(_time) as firstTime latest(_time) values(UserAuthenticationMethod) AS UserAuthenticationMethod values(UserAgent) AS UserAgent values(status) AS status values(src_ip) AS src_ip by user | where count > 10 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `o365_excessive_authentication_failures_alert_filter`

 [ESCU - O365 Excessive SSO logon errors - Rule]
 action.escu = 0
@@ -1803,7 +1803,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `o365_management_activity`  Workload=AzureActiveDirectory LogonError=SsoArtifactInvalidOrExpired | stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress UserAgent UserId | where count &gt; 5 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_excessive_sso_logon_errors_filter`
+search = `o365_management_activity`  Workload=AzureActiveDirectory LogonError=SsoArtifactInvalidOrExpired | stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress UserAgent UserId | where count > 5 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_excessive_sso_logon_errors_filter`

 [ESCU - O365 New Federated Domain Added - Rule]
 action.escu = 0
@@ -1842,7 +1842,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `o365_management_activity` Workload=Exchange Operation=&#34;Add-FederatedDomain&#34; | stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value) as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId UserKey | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_federated_domain_added_filter`
+search = `o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain" | stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value) as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId UserKey | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_federated_domain_added_filter`

 [ESCU - O365 PST export alert - Rule]
 action.escu = 0
@@ -1881,7 +1881,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `o365_management_activity` Category=ThreatManagement Name=&#34;eDiscovery search started or exported&#34; | stats count earliest(_time) as firstTime latest(_time) as lastTime by Source Severity AlertEntityId Operation Name |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `o365_pst_export_alert_filter`
+search = `o365_management_activity` Category=ThreatManagement Name="eDiscovery search started or exported" | stats count earliest(_time) as firstTime latest(_time) as lastTime by Source Severity AlertEntityId Operation Name |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `o365_pst_export_alert_filter`

 [ESCU - O365 Suspicious Admin Email Forwarding - Rule]
 action.escu = 0
@@ -1920,7 +1920,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `o365_management_activity` Operation=Set-Mailbox | spath input=Parameters | rename Identity AS src_user | search ForwardingAddress=* | stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) AS src_user values(user) AS user by ForwardingAddress | where count_src_user &gt; 1 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_admin_email_forwarding_filter`
+search = `o365_management_activity` Operation=Set-Mailbox | spath input=Parameters | rename Identity AS src_user | search ForwardingAddress=* | stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) AS src_user values(user) AS user by ForwardingAddress | where count_src_user > 1 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_admin_email_forwarding_filter`

 [ESCU - O365 Suspicious Rights Delegation - Rule]
 action.escu = 0
@@ -1998,7 +1998,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `o365_management_activity` Operation=Set-Mailbox | spath input=Parameters | rename Identity AS src_user | search ForwardingSmtpAddress=* | stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) AS src_user values(user) AS user by ForwardingSmtpAddress | where count_src_user &gt; 1 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_user_email_forwarding_filter`
+search = `o365_management_activity` Operation=Set-Mailbox | spath input=Parameters | rename Identity AS src_user | search ForwardingSmtpAddress=* | stats dc(src_user) AS count_src_user earliest(_time) as firstTime latest(_time) as lastTime values(src_user) AS src_user values(user) AS user by ForwardingSmtpAddress | where count_src_user > 1 |`security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` |`o365_suspicious_user_email_forwarding_filter`

 ### END ESCU DETECTIONS ###

@@ -2025,7 +2025,7 @@ action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK
 action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.
 disabled = false
 is_visible = false
-search = | tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name(&#34;All_Changes&#34;)` | eval HourOfDay=strftime(_time, &#34;%H&#34;) | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, &#34;%w&#34;) | eval isWeekend=if(DayOfWeek &gt;= 1 AND DayOfWeek &lt;= 5, 0, 1) | table _time api_calls, user, HourOfDay, isWeekend | eventstats dc(api_calls) as api_calls by user, HourOfDay, isWeekend | where api_calls &gt;= 1 | fit DensityFunction api_calls by &#34;user,HourOfDay,isWeekend&#34; into cloud_excessive_api_calls_v1 dist=norm show_density=true
+search = | tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time api_calls, user, HourOfDay, isWeekend | eventstats dc(api_calls) as api_calls by user, HourOfDay, isWeekend | where api_calls >= 1 | fit DensityFunction api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm show_density=true

 [ESCU - Baseline Of Cloud Instances Destroyed]
 action.escu = 0
@@ -2048,7 +2048,7 @@ action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, i
 More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.
 disabled = false
 is_visible = false
-search = | tstats count as instances_destroyed from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, &#34;%H&#34;) | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, &#34;%w&#34;) | eval isWeekend=if(DayOfWeek &gt;= 1 AND DayOfWeek &lt;= 5, 0, 1) | table _time instances_destroyed, HourOfDay, isWeekend | fit DensityFunction instances_destroyed by &#34;HourOfDay,isWeekend&#34; into cloud_excessive_instances_destroyed_v1 dist=expon show_density=true
+search = | tstats count as instances_destroyed from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time instances_destroyed, HourOfDay, isWeekend | fit DensityFunction instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1 dist=expon show_density=true

 [ESCU - Baseline Of Cloud Instances Launched]
 action.escu = 0
@@ -2071,7 +2071,7 @@ action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, i
 More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.
 disabled = false
 is_visible = false
-search = | tstats count as instances_launched from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, &#34;%H&#34;) | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, &#34;%w&#34;) | eval isWeekend=if(DayOfWeek &gt;= 1 AND DayOfWeek &lt;= 5, 0, 1) | table _time instances_launched, HourOfDay, isWeekend | fit DensityFunction instances_launched by &#34;HourOfDay,isWeekend&#34; into cloud_excessive_instances_created_v1 dist=expon show_density=true
+search = | tstats count as instances_launched from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time instances_launched, HourOfDay, isWeekend | fit DensityFunction instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1 dist=expon show_density=true

 [ESCU - Baseline Of Cloud Security Group API Calls Per User]
 action.escu = 0
@@ -2093,7 +2093,7 @@ action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK
 action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.
 disabled = false
 is_visible = false
-search = | tstats count as security_group_api_calls from datamodel=Change where All_Changes.object_category=firewall All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name(&#34;All_Changes&#34;)` | eval HourOfDay=strftime(_time, &#34;%H&#34;) | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, &#34;%w&#34;) | eval isWeekend=if(DayOfWeek &gt;= 1 AND DayOfWeek &lt;= 5, 0, 1) | table _time security_group_api_calls, user, HourOfDay, isWeekend | eventstats dc(security_group_api_calls) as security_group_api_calls by user, HourOfDay, isWeekend | where security_group_api_calls &gt;= 1 | fit DensityFunction security_group_api_calls by &#34;user,HourOfDay,isWeekend&#34; into cloud_excessive_security_group_api_calls_v1 dist=norm show_density=true
+search = | tstats count as security_group_api_calls from datamodel=Change where All_Changes.object_category=firewall All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time security_group_api_calls, user, HourOfDay, isWeekend | eventstats dc(security_group_api_calls) as security_group_api_calls by user, HourOfDay, isWeekend | where security_group_api_calls >= 1 | fit DensityFunction security_group_api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_security_group_api_calls_v1 dist=norm show_density=true

 [ESCU - Previously Seen AWS Cross Account Activity - Initial]
 action.escu = 0
@@ -2115,7 +2115,7 @@ action.escu.eli5 = This search looks for **AssumeRole** events where the request
 action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search.
 disabled = false
 is_visible = false
-search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role |  `drop_dm_object_name(Authentication)` | rex field=user_role &#34;arn:aws:sts:*:(?&lt;dest_account&gt;.*):&#34; |  where  vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity
+search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role |  `drop_dm_object_name(Authentication)` | rex field=user_role "arn:aws:sts:*:(?<dest_account>.*):" |  where  vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity

 [ESCU - Previously Seen AWS Cross Account Activity - Update]
 action.escu = 0
@@ -2137,7 +2137,7 @@ action.escu.eli5 = This search looks for **AssumeRole** events where the request
 action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search.
 disabled = false
 is_visible = false
-search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role &#34;arn:aws:sts:*:(?&lt;dest_account&gt;.*):&#34; | where vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity | stats min(firstTime) as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId | outputlookup previously_seen_aws_cross_account_activity
+search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role "arn:aws:sts:*:(?<dest_account>.*):" | where vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity | stats min(firstTime) as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId | outputlookup previously_seen_aws_cross_account_activity

 [ESCU - Previously Seen Cloud API Calls Per User Role - Initial]
 action.escu = 0
@@ -2159,7 +2159,7 @@ action.escu.eli5 = This search builds a table of the first and last times seen f
 action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider.
 disabled = false
 is_visible = false
-search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name(&#34;All_Changes&#34;)` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime &lt;= relative_time(now(), &#34;-7d@d&#34;), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role
+search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role

 [ESCU - Previously Seen Cloud API Calls Per User Role - Update]
 action.escu = 0
@@ -2181,7 +2181,7 @@ action.escu.eli5 = This search updates the table of the first and last times see
 action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider.
 disabled = false
 is_visible = false
-search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name(&#34;All_Changes&#34;)` | table user, command, firstTimeSeen, lastTimeSeen | inputlookup previously_seen_cloud_api_calls_per_user_role append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by user, command | where lastTimeSeen &gt; relative_time(now(), `previously_seen_cloud_api_calls_per_user_role_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime &lt;= relative_time(now(), &#34;-7d@d&#34;), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role
+search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | table user, command, firstTimeSeen, lastTimeSeen | inputlookup previously_seen_cloud_api_calls_per_user_role append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by user, command | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_api_calls_per_user_role_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role

 [ESCU - Previously Seen Cloud Compute Creations By User - Initial]
 action.escu = 0
@@ -2203,7 +2203,7 @@ action.escu.eli5 = This search builds a table of previously seen users that have
 action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed.
 disabled = false
 is_visible = false
-search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user | `drop_dm_object_name(&#34;All_Changes&#34;)` | outputlookup previously_seen_cloud_compute_creations_by_user | stats count
+search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user | stats count

 [ESCU - Previously Seen Cloud Compute Creations By User - Update]
 action.escu = 0
@@ -2225,7 +2225,7 @@ action.escu.eli5 = This search builds a table of previously seen users that have
 action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed.
 disabled = false
 is_visible = false
-search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user| `drop_dm_object_name(&#34;All_Changes&#34;)` | inputlookup append=t previously_seen_cloud_compute_creations_by_user | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen &gt; relative_time(now(), &#34;-90d@d&#34;) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime &lt;= relative_time(now(), &#34;-7d@d&#34;), 1, 0) | outputlookup previously_seen_cloud_compute_creations_by_user
+search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user| `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_compute_creations_by_user | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(), "-90d@d") | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_creations_by_user

 [ESCU - Previously Seen Cloud Compute Images - Initial]
 action.escu = 0
@@ -2247,7 +2247,7 @@ action.escu.eli5 = This search builds a table of previously seen images used to
 action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated
 disabled = false
 is_visible = false
-search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created  by All_Changes.Instance_Changes.image_id | `drop_dm_object_name(&#34;All_Changes&#34;)` | `drop_dm_object_name(&#34;Instance_Changes&#34;)` | where image_id != &#34;unknown&#34; | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime &lt;= relative_time(now(), &#34;-7d@d&#34;), 1, 0) | outputlookup previously_seen_cloud_compute_images
+search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created  by All_Changes.Instance_Changes.image_id | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images

 [ESCU - Previously Seen Cloud Compute Images - Update]
 action.escu = 0
@@ -2269,7 +2269,7 @@ action.escu.eli5 = This search builds a table of previously seen images used to
 action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs
 disabled = false
 is_visible = false
-search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id | `drop_dm_object_name(&#34;All_Changes&#34;)` | `drop_dm_object_name(&#34;Instance_Changes&#34;)` | where image_id != &#34;unknown&#34; | inputlookup append=t previously_seen_cloud_compute_images | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by image_id | where lastTimeSeen &gt; relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime &lt;= relative_time(now(), &#34;-7d@d&#34;), 1, 0) | outputlookup previously_seen_cloud_compute_images
+search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" | inputlookup append=t previously_seen_cloud_compute_images | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by image_id | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images

 [ESCU - Previously Seen Cloud Compute Instance Types - Initial]
 action.escu = 0
@@ -2291,7 +2291,7 @@ action.escu.eli5 = This search builds a table of previously seen cloud compute i
 action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed.
 disabled = false
 is_visible = false
-search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name(&#34;All_Changes.Instance_Changes&#34;)` | where instance_type != &#34;unknown&#34; | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime &lt;= relative_time(now(), &#34;-14d@d&#34;), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types
+search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types

 [ESCU - Previously Seen Cloud Compute Instance Types - Update]
 action.escu = 0
@@ -2313,7 +2313,7 @@ action.escu.eli5 = This search builds a table of previously seen cloud compute i
 action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs
 disabled = false
 is_visible = false
-search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name(&#34;All_Changes.Instance_Changes&#34;)` | where instance_type != &#34;unknown&#34; | inputlookup append=t previously_seen_cloud_compute_instance_types | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by instance_type | where lastTimeSeen &gt; relative_time(now(), `previously_seen_cloud_compute_instance_type_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime &lt;= relative_time(now(), &#34;-14d@d&#34;), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types
+search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type != "unknown" | inputlookup append=t previously_seen_cloud_compute_instance_types | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by instance_type | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_instance_type_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types

 [ESCU - Previously Seen Cloud Instance Modifications By User - Initial]
 action.escu = 0
@@ -2357,7 +2357,7 @@ action.escu.eli5 = This search updates a table of previously seen Cloud Instance
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`.
 disabled = false
 is_visible = false
-search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user | `drop_dm_object_name(&#34;All_Changes&#34;)` | inputlookup append=t previously_seen_cloud_instance_modifications_by_user | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen &gt; relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime &lt;= relative_time(now(), &#34;-7d@d&#34;), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user
+search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_instance_modifications_by_user | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user

 [ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial]
 action.escu = 0
@@ -2379,7 +2379,7 @@ action.escu.eli5 = This search builds a table of the first and last times seen f
 action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider.
 disabled = false
 is_visible = false
-search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name(&#34;All_Changes&#34;)` | iplocation src | where isnotnull(Country) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime &lt;= relative_time(now(), &#34;-7d@d&#34;), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources
+search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources

 [ESCU - Previously Seen Cloud Provisioning Activity Sources - Update]
 action.escu = 0
@@ -2401,14 +2401,14 @@ action.escu.eli5 = This returns the first and last times seen for every IP addre
 action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider.
 disabled = false
 is_visible = false
-search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name(&#34;All_Changes&#34;)` | iplocation src | where isnotnull(Country) | table src, firstTimeSeen, lastTimeSeen, City, Country, Region | inputlookup previously_seen_cloud_provisioning_activity_sources append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by src, City, Country, Region | where lastTimeSeen &gt; relative_time(now(), `previously_seen_cloud_provisioning_activity_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime &lt;= relative_time(now(), &#34;-7d@d&#34;), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources
+search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) | table src, firstTimeSeen, lastTimeSeen, City, Country, Region | inputlookup previously_seen_cloud_provisioning_activity_sources append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by src, City, Country, Region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_provisioning_activity_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources

 [ESCU - Previously Seen Cloud Regions - Initial]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
 action.escu.full_search_name = ESCU - Previously Seen Cloud Regions - Initial
-description = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we&#39;ve seen this region in our dataset grouped by the region for the last 30 days
+description = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days
 action.escu.creation_date = 2020-09-02
 action.escu.modification_date = 2020-09-02
 action.escu.analytic_story = ["Cloud Cryptomining"]
@@ -2419,18 +2419,18 @@ dispatch.earliest_time = -90d@d
 dispatch.latest_time = -1d@d
 schedule_window = auto
 action.escu.providing_technologies = []
-action.escu.eli5 = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we&#39;ve seen this region in our dataset grouped by the region for the last 30 days
+action.escu.eli5 = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days
 action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed.
 disabled = false
 is_visible = false
-search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name(&#34;All_Changes&#34;)` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime &lt;= relative_time(now(), &#34;-14d@d&#34;), 1, 0) | outputlookup previously_seen_cloud_regions
+search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions

 [ESCU - Previously Seen Cloud Regions - Update]
 action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = support
 action.escu.full_search_name = ESCU - Previously Seen Cloud Regions - Update
-description = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we&#39;ve seen this region in our dataset grouped by the region for the last 30 days
+description = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days
 action.escu.creation_date = 2020-09-02
 action.escu.modification_date = 2020-09-02
 action.escu.analytic_story = ["Cloud Cryptomining"]
@@ -2441,11 +2441,11 @@ dispatch.earliest_time = -1450m@m
 dispatch.latest_time = -10m@m
 schedule_window = auto
 action.escu.providing_technologies = []
-action.escu.eli5 = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we&#39;ve seen this region in our dataset grouped by the region for the last 30 days
+action.escu.eli5 = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days
 action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed.
 disabled = false
 is_visible = false
-search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name(&#34;All_Changes&#34;)` | inputlookup append=t previously_seen_cloud_regions | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by vendor_region | where lastTimeSeen &gt; relative_time(now(), `previously_seen_cloud_region_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime &lt;= relative_time(now(), &#34;-14d@d&#34;), 1, 0) | outputlookup previously_seen_cloud_regions | stats count
+search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_regions | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by vendor_region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_region_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions | stats count

 [ESCU - Previously Seen Users In CloudTrail - Update]
 action.escu = 0
@@ -2521,7 +2521,7 @@ action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = investigative
 action.escu.full_search_name = ESCU - AWS Investigate User Activities By ARN - Response Task
-description = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user&#39;s identity information.
+description = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information.
 action.escu.creation_date = 2019-04-30
 action.escu.modification_date = 2019-04-30
 action.escu.analytic_story = ["AWS Cryptomining", "AWS Network ACL Activity", "Cloud Cryptomining", "Command and Control", "Suspicious AWS EC2 Activities", "Suspicious AWS Login Activities", "Suspicious AWS S3 Activities", "Suspicious AWS Traffic", "Unusual AWS EC2 Modifications", "Suspicious Cloud User Activities", "AWS Suspicious Provisioning Activities", "Suspicious Cloud Instance Activities", "AWS Security Hub Alerts"]
@@ -2529,7 +2529,7 @@ action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []
 action.escu.data_models = []
-action.escu.eli5 = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user&#39;s identity information.
+action.escu.eli5 = This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's identity information.
 action.escu.how_to_implement = none
 action.escu.known_false_positives = None at this time
 disabled = true
@@ -2773,7 +2773,7 @@ action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = investigative
 action.escu.full_search_name = ESCU - Investigate AWS User Activities by user field - Response Task
-description = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user&#39;s identity information.
+description = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information.
 action.escu.creation_date = 2018-03-12
 action.escu.modification_date = 2018-03-12
 action.escu.analytic_story = ["AWS User Monitoring", "Suspicious Cloud Authentication Activities"]
@@ -2781,7 +2781,7 @@ action.escu.earliest_time_offset = 3600
 action.escu.latest_time_offset = 86400
 action.escu.providing_technologies = []
 action.escu.data_models = []
-action.escu.eli5 = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user&#39;s identity information.
+action.escu.eli5 = This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity information.
 action.escu.how_to_implement = none
 action.escu.known_false_positives = None at this time
 disabled = true
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-08-20T22:01:05 UTC
+# On Date: 2021-08-27T21:28:31 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -88,6 +88,14 @@ min_matches = 1
 filename = legit_domains.csv
 # description = A list of legit domains to be used as an ignore list for possible phishing sites

+[local_file_inclusion_paths]
+filename = local_file_inclusion_paths.csv
+default_match = false
+case_sensitive_match = false
+# description = A list of interesting files in a local file inclusion attack
+match_type = WILDCARD(local_file_inclusion_paths)
+min_matches = 1
+
 [lookup_rare_process_allow_list_default]
 filename = rare_process_allow_list_default.csv
 default_match = false
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2021-08-20T22:01:05 UTC
+# On Date: 2021-08-27T21:28:31 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -50,8 +50,8 @@ maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
 searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule", "ESCU - Investigate AWS activities via region name - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
 description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior.
-narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it&#39;s par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \
-Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It&#39;s difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool&#39;s IP address behind a free CDN. \
+narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \
+Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \
 When malicious miners appropriate a cloud instance, often spinning up hundreds of new instances, the costs can become astronomical for the account holder. So it is critically important to monitor your systems for suspicious activities that could indicate that your network has been infiltrated. \
 This Analytic Story is focused on detecting suspicious new instances in your cloud environment to help prevent cryptominers from gaining a foothold. It contains detection searches that will detect when a previously unused instance type or AMI is used. It also contains support searches to build lookup files to ensure proper execution of the detection searches.

@@ -63,7 +63,7 @@ references = ["https://www.cyberark.com/resources/threat-research-blog/golden-sa
 maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}]
 spec_version = 3
 searches = ["ESCU - AWS SAML Access by Provider User and Principal - Rule", "ESCU - AWS SAML Update identity provider - Rule", "ESCU - O365 Add App Role Assignment Grant User - Rule", "ESCU - O365 Added Service Principal - Rule", "ESCU - O365 Excessive SSO logon errors - Rule", "ESCU - O365 New Federated Domain Added - Rule"]
-description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim&#39;s cloud environements.
+description = This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements.
 narrative = This story is composed of detection searches based on endpoint that addresses the use of Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) related events are also addressed in specific cloud environment detection searches.

 [analytic_story://Office 365 Detections]
@@ -109,7 +109,7 @@ spec_version = 3
 searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS S3 Bucket details via bucketName - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Investigate AWS activities via region name - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"]
 description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
 narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\
-Amazon&#39;s &#34;shared responsibility&#34; model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it&#39;s important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\
+Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\
 Among things to look out for are S3 access from unfamiliar locations and by unfamiliar users. Some of the searches in this Analytic Story help you detect suspicious behavior and others help you investigate more deeply, when the situation warrants.   

 [analytic_story://Suspicious Cloud Authentication Activities]
@@ -145,7 +145,7 @@ spec_version = 3
 searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule"]
 description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment.
 narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\
-This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven&#39;t previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further.
+This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further.

 [analytic_story://Suspicious Cloud User Activities]
 category = Cloud Security
@@ -156,7 +156,7 @@ maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
 searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"]
 description = Detect and investigate suspicious activities by users and roles in your cloud environments.
-narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it&#39;s all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla&#39;s cryptojacking attack in February, 2018.\
+narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\
 In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage.

 ### END STORIES ###
@@ -200,7 +200,7 @@ confidence = medium
 explanation = This search looks for AssumeRole events where an IAM role in a different account is requested for the first time.
 how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen AWS Cross Account Activity - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen AWS Cross Account Activity - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `aws_cross_account_activity_from_previously_unseen_account_filter` macro.
 annotations = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.AC", "PR.DS", "DE.AE"]}
-known_false_positives = Using multiple AWS accounts and roles is perfectly valid behavior. It&#39;s suspicious when an account requests privileges of an account it hasn&#39;t before. You should validate with the account owner that this is a legitimate request.
+known_false_positives = Using multiple AWS accounts and roles is perfectly valid behavior. It's suspicious when an account requests privileges of an account it hasn't before. You should validate with the account owner that this is a legitimate request.
 providing_technologies = []

 [savedsearch://ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule]
@@ -290,7 +290,7 @@ confidence = medium
 explanation = The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS, version 4.4.0 or later, and configure your AWS CloudTrail inputs.
 annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]}
-known_false_positives = It&#39;s possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.
+known_false_positives = It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment.
 providing_technologies = []

 [savedsearch://ESCU - AWS Network Access Control List Deleted - Rule]
@@ -300,7 +300,7 @@ confidence = medium
 explanation = Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker has gained control of the AWS console by compromising an admin account, they can delete a network ACL and gain access to the instance from anywhere. This search will query the AWS CloudTrail logs to detect users deleting network ACLs.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your AWS CloudTrail inputs.
 annotations = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.007"], "nist": ["DE.DP", "DE.AE"]}
-known_false_positives = It&#39;s possible that a user has legitimately deleted a network ACL.
+known_false_positives = It's possible that a user has legitimately deleted a network ACL.
 providing_technologies = []

 [savedsearch://ESCU - AWS SAML Access by Provider User and Principal - Rule]
@@ -398,9 +398,9 @@ type = detection
 asset_type = Cloud Compute Instance
 confidence = medium
 explanation = This search looks for cloud compute instances created by users who have not created them before.
-how_to_implement = You must be ingesting the appropriate cloud-infrastructure logs Run the &#34;Previously Seen Cloud Compute Creations By User&#34; support search to create of baseline of previously seen users.
+how_to_implement = You must be ingesting the appropriate cloud-infrastructure logs Run the "Previously Seen Cloud Compute Creations By User" support search to create of baseline of previously seen users.
 annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]}
-known_false_positives = It&#39;s possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior.
+known_false_positives = It's possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior.
 providing_technologies = []

 [savedsearch://ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule]
@@ -410,7 +410,7 @@ confidence = medium
 explanation = This search looks at cloud-infrastructure events where an instance is created in any region within the last hour and then compares it to a lookup file of previously seen regions where instances have been created.
 how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Regions - Initial` to build the initial table of images observed and times. You must also enable the second baseline search `Previously Seen Cloud Regions - Update` to keep this table up to date and to age out old data. You can also provide additional filtering for this search by customizing the `cloud_compute_instance_created_in_previously_unused_region_filter` macro.
 annotations = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]}
-known_false_positives = It&#39;s possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate.
+known_false_positives = It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate.
 providing_technologies = []

 [savedsearch://ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule]
@@ -438,9 +438,9 @@ type = detection
 asset_type = AWS Instance
 confidence = medium
 explanation = This search looks for cloud instances being modified by users who have not previously modified them.
-how_to_implement = This search has a dependency on other searches to create and update a baseline of users observed to be associated with this activity. The search &#34;Previously Seen Cloud Instance Modifications By User - Update&#34; should be enabled for this detection to properly work.
+how_to_implement = This search has a dependency on other searches to create and update a baseline of users observed to be associated with this activity. The search "Previously Seen Cloud Instance Modifications By User - Update" should be enabled for this detection to properly work.
 annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]}
-known_false_positives = It&#39;s possible that a new user will start to modify EC2 instances when they haven&#39;t before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior.
+known_false_positives = It's possible that a new user will start to modify EC2 instances when they haven't before for any number of reasons. Verify with the user that is modifying instances that this is the intended behavior.
 providing_technologies = []

 [savedsearch://ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule]
@@ -450,7 +450,7 @@ confidence = medium
 explanation = This search looks for cloud provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that runs or creates something.
 how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_city_filter` macro.
 annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
-known_false_positives = This is a strictly behavioral search, so we define &#34;false positive&#34; slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you&#39;re searching within, plus what is stored in the cache feature. But while there are really no &#34;false positives&#34; in a traditional sense, there is definitely lots of noise.\
+known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
 This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
 providing_technologies = []

@@ -461,7 +461,7 @@ confidence = medium
 explanation = This search looks for cloud provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that runs or creates something.
 how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_country_filter` macro.
 annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
-known_false_positives = This is a strictly behavioral search, so we define &#34;false positive&#34; slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you&#39;re searching within, plus what is stored in the cache feature. But while there are really no &#34;false positives&#34; in a traditional sense, there is definitely lots of noise.\
+known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
 This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
 providing_technologies = []

@@ -472,7 +472,7 @@ confidence = medium
 explanation = This search looks for cloud provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that runs or creates something.
 how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_ip_address_filter` macro.
 annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
-known_false_positives = This is a strictly behavioral search, so we define &#34;false positive&#34; slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you&#39;re searching within, plus what is stored in the cache feature. But while there are really no &#34;false positives&#34; in a traditional sense, there is definitely lots of noise.\
+known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
 This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
 providing_technologies = []

@@ -483,7 +483,7 @@ confidence = medium
 explanation = This search looks for cloud provisioning activities from previously unseen regions. Provisioning activities are defined broadly as any event that runs or creates something.
 how_to_implement = You must be ingesting your cloud infrastructure logs from your cloud provider.  You should run the baseline search `Previously Seen Cloud Provisioning Activity Sources - Initial` to build the initial table of source IP address, geographic locations, and times. You must also enable the second baseline search `Previously Seen Cloud Provisioning Activity Sources - Update` to keep this table up to date and to age out old data. You can adjust the time window for this search by updating the `previously_unseen_cloud_provisioning_activity_window` macro. You can also provide additional filtering for this search by customizing the `cloud_provisioning_activity_from_previously_unseen_region_filter` macro.
 annotations = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]}
-known_false_positives = This is a strictly behavioral search, so we define &#34;false positive&#34; slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you&#39;re searching within, plus what is stored in the cache feature. But while there are really no &#34;false positives&#34; in a traditional sense, there is definitely lots of noise.\
+known_false_positives = This is a strictly behavioral search, so we define "false positive" slightly differently. Every time this fires, it will accurately reflect the first occurrence in the time period you're searching within, plus what is stored in the cache feature. But while there are really no "false positives" in a traditional sense, there is definitely lots of noise.\
 This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you.
 providing_technologies = []

@@ -534,7 +534,7 @@ confidence = medium
 explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli.
 how_to_implement = 
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
-known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the &#34;All Users&#34; group.
+known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
 providing_technologies = []

 [savedsearch://ESCU - Detect New Open S3 buckets - Rule]
@@ -544,7 +544,7 @@ confidence = medium
 explanation = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket.
 how_to_implement = You must install the AWS App for Splunk.
 annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
-known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the &#34;All Users&#34; group.
+known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group.
 providing_technologies = []

 [savedsearch://ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule]
@@ -61,7 +61,7 @@ _version_: 1
 ---

 ### DNS Amplification Attacks
-DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company&#39;s DNS infrastructure to launch amplification attacks, causing Denial of Service to other victims.
+DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company's DNS infrastructure to launch amplification attacks, causing Denial of Service to other victims.

 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Network_Resolution
@@ -696,6 +696,8 @@ Uncover activity consistent with credential dumping, a technique wherein attacke

 * [Dump LSASS via procdump Rename](detections.md#dump-lsass-via-procdump-rename)

+* [Esentutl SAM Copy](detections.md#esentutl-sam-copy)
+
 * [Extract SAM from Registry](detections.md#extract-sam-from-registry)

 * [Investigate Failed Logins for Multiple Destinations](detections.md#investigate-failed-logins-for-multiple-destinations)
@@ -749,6 +751,10 @@ Uncover activity consistent with credential dumping, a technique wherein attacke

 * Installation

+* Lateral Movement
+
+* Privilege Escalation
+

 #### Reference

@@ -1362,7 +1368,7 @@ _version_: 2
 ---

 ### Malicious PowerShell
-Attackers are finding stealthy ways &#34;live off the land,&#34; leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
+Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.

 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Email, Endpoint
@@ -1410,6 +1416,8 @@ Attackers are finding stealthy ways &#34;live off the land,&#34; leveraging util

 * [Malicious PowerShell Process With Obfuscation Techniques](detections.md#malicious-powershell-process-with-obfuscation-techniques)

+* [PowerShell 4104 Hunting](detections.md#powershell-4104-hunting)
+
 * [PowerShell Domain Enumeration](detections.md#powershell-domain-enumeration)

 * [PowerShell Loading DotNET into Memory via System Reflection Assembly](detections.md#powershell-loading-dotnet-into-memory-via-system-reflection-assembly)
@@ -1904,7 +1912,7 @@ _version_: 1
 ---

 ### Suspicious Command-Line Executions
-Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&amp;CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems.
+Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems.

 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Endpoint
@@ -3676,7 +3684,7 @@ _version_: 1
 ---

 ### AWS User Monitoring
-Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it&#39;s critical to enable governance within your environment.
+Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment.

 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: 
@@ -3805,7 +3813,7 @@ _version_: 1
 ---

 ### Cloud Federated Credential Abuse
-This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim&#39;s cloud environements.
+This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements.

 - **Product**: Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: Endpoint
@@ -3874,7 +3882,7 @@ _version_: 1
 ---

 ### Container Implantation Monitoring and Investigation
-Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company&#39;s repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry.
+Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company's repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry.

 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: 
@@ -3913,7 +3921,7 @@ This story is focused around detecting attacks on a DevSecOps lifeccycle which c

 - **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 - **Datamodel**: 
- **ATT&CK**: [T1204.003](https://attack.mitre.org/techniques/T1204.003/)
+- **ATT&CK**: [T1204.003](https://attack.mitre.org/techniques/T1204.003/), [T1212](https://attack.mitre.org/techniques/T1212/), [T1526](https://attack.mitre.org/techniques/T1526/)
 - **Last Updated**: 2021-08-18

 <details>
@@ -3931,12 +3939,20 @@ This story is focused around detecting attacks on a DevSecOps lifeccycle which c

 * [AWS ECR Container Upload Unknown User](detections.md#aws-ecr-container-upload-unknown-user)

+* [Kubernetes Nginx Ingress LFI](detections.md#kubernetes-nginx-ingress-lfi)
+
+* [Kubernetes Nginx Ingress RFI](detections.md#kubernetes-nginx-ingress-rfi)
+
+* [Kubernetes Scanner Image Pulling](detections.md#kubernetes-scanner-image-pulling)
+

 #### ATT&CK

 | ID          | Technique   | Tactic       |
 | ----------- | ----------- |--------------|
 | T1204.003 | Malicious Image | Execution |
+| T1212 | Exploitation for Credential Access | Credential Access |
+| T1526 | Cloud Service Discovery | Discovery |

 #### Kill Chain Phase

@@ -57,7 +57,7 @@ Detect and investigate activity that may indicate that an adversary is using fau
 ----

 ===Dns amplification attacks===
-DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company&#39;s DNS infrastructure to launch amplification attacks, causing Denial of Service to other victims.
+DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company's DNS infrastructure to launch amplification attacks, causing Denial of Service to other victims.

 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Network_Resolution
@@ -793,7 +793,7 @@ Uncover activity consistent with credential dumping, a technique wherein attacke

 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Authentication, Endpoint
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.001/ T1003.001], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1547/ T1547], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1554/ T1554], [https://attack.mitre.org/techniques/T1556/ T1556], [https://attack.mitre.org/techniques/T1558/ T1558], [https://attack.mitre.org/techniques/T1555/ T1555], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1201/ T1201], [https://attack.mitre.org/techniques/T1552/ T1552], [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1003.003/ T1003.003], [https://attack.mitre.org/techniques/T1558.003/ T1558.003], [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1003.001/ T1003.001], [https://attack.mitre.org/techniques/T1055/ T1055], [https://attack.mitre.org/techniques/T1068/ T1068], [https://attack.mitre.org/techniques/T1078/ T1078], [https://attack.mitre.org/techniques/T1098/ T1098], [https://attack.mitre.org/techniques/T1134/ T1134], [https://attack.mitre.org/techniques/T1543/ T1543], [https://attack.mitre.org/techniques/T1547/ T1547], [https://attack.mitre.org/techniques/T1548/ T1548], [https://attack.mitre.org/techniques/T1554/ T1554], [https://attack.mitre.org/techniques/T1556/ T1556], [https://attack.mitre.org/techniques/T1558/ T1558], [https://attack.mitre.org/techniques/T1555/ T1555], [https://attack.mitre.org/techniques/T1087/ T1087], [https://attack.mitre.org/techniques/T1201/ T1201], [https://attack.mitre.org/techniques/T1552/ T1552], [https://attack.mitre.org/techniques/T1003/ T1003], [https://attack.mitre.org/techniques/T1003.002/ T1003.002], [https://attack.mitre.org/techniques/T1003.003/ T1003.003], [https://attack.mitre.org/techniques/T1558.003/ T1558.003], [https://attack.mitre.org/techniques/T1059.001/ T1059.001]
 * '''Last Updated''': 2020-02-04

 <div class="toccolours mw-collapsible mw-collapsed">
@@ -859,6 +859,8 @@ Uncover activity consistent with credential dumping, a technique wherein attacke

 * [[Documentation:ESSOC:detections:Detections#Dump_lsass_via_procdump_rename|Dump LSASS via procdump Rename]]

+* [[Documentation:ESSOC:detections:Detections#Esentutl_sam_copy|Esentutl SAM Copy]]
+
 * [[Documentation:ESSOC:detections:Detections#Extract_sam_from_registry|Extract SAM from Registry]]

 * [[Documentation:ESSOC:detections:Detections#Investigate_failed_logins_for_multiple_destinations|Investigate Failed Logins for Multiple Destinations]]
@@ -979,6 +981,10 @@ Uncover activity consistent with credential dumping, a technique wherein attacke

 * Installation

+* Lateral Movement
+
+* Privilege Escalation
+

 ====Reference====

@@ -1820,7 +1826,7 @@ Detect and investigate tactics, techniques, and procedures around how attackers
 ----

 ===Malicious powershell===
-Attackers are finding stealthy ways &#34;live off the land,&#34; leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
+Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.

 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Email, Endpoint
@@ -1868,6 +1874,8 @@ Attackers are finding stealthy ways &#34;live off the land,&#34; leveraging util

 * [[Documentation:ESSOC:detections:Detections#Malicious_powershell_process_with_obfuscation_techniques|Malicious PowerShell Process With Obfuscation Techniques]]

+* [[Documentation:ESSOC:detections:Detections#Powershell_4104_hunting|PowerShell 4104 Hunting]]
+
 * [[Documentation:ESSOC:detections:Detections#Powershell_domain_enumeration|PowerShell Domain Enumeration]]

 * [[Documentation:ESSOC:detections:Detections#Powershell_loading_dotnet_into_memory_via_system_reflection_assembly|PowerShell Loading DotNET into Memory via System Reflection Assembly]]
@@ -2564,7 +2572,7 @@ Detect signs of malicious payloads that may indicate that your environment has b
 ----

 ===Suspicious command-line executions===
-Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&amp;CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems.
+Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems.

 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint
@@ -4835,7 +4843,7 @@ This story is focused around detecting Security Hub alerts generated from AWS
 ----

 ===Aws user monitoring===
-Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it&#39;s critical to enable governance within your environment.
+Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment.

 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': 
@@ -4983,7 +4991,7 @@ Monitor your cloud compute instances for activities related to cryptojacking/cry
 ----

 ===Cloud federated credential abuse===
-This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim&#39;s cloud environements.
+This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active Directory Federation Services. Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order to provide seamless access between cloud and perimeter environments. If these objects are either hijacked or forged then attackers will be able to pivot into victim's cloud environements.

 * '''Product''': Splunk Security Analytics for AWS, Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': Endpoint
@@ -5072,7 +5080,7 @@ This analytical story addresses events that indicate abuse of cloud federated cr
 ----

 ===Container implantation monitoring and investigation===
-Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company&#39;s repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry.
+Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container names and repository names. The searches provide context to address Mitre T1525 which refers to container implantation upload to a company's repository either in Amazon Elastic Container Registry, Google Container Registry and Azure Container Registry.

 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': 
@@ -5119,7 +5127,7 @@ This story is focused around detecting attacks on a DevSecOps lifeccycle which c

 * '''Product''': Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
 * '''Datamodel''': 
-* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204.003/ T1204.003]
+* '''ATT&CK''': [https://attack.mitre.org/techniques/T1204.003/ T1204.003], [https://attack.mitre.org/techniques/T1212/ T1212], [https://attack.mitre.org/techniques/T1526/ T1526]
 * '''Last Updated''': 2021-08-18

 <div class="toccolours mw-collapsible mw-collapsed">
@@ -5137,6 +5145,12 @@ This story is focused around detecting attacks on a DevSecOps lifeccycle which c

 * [[Documentation:ESSOC:detections:Detections#Aws_ecr_container_upload_unknown_user|AWS ECR Container Upload Unknown User]]

+* [[Documentation:ESSOC:detections:Detections#Kubernetes_nginx_ingress_lfi|Kubernetes Nginx Ingress LFI]]
+
+* [[Documentation:ESSOC:detections:Detections#Kubernetes_nginx_ingress_rfi|Kubernetes Nginx Ingress RFI]]
+
+* [[Documentation:ESSOC:detections:Detections#Kubernetes_scanner_image_pulling|Kubernetes Scanner Image Pulling]]
+


 ====ATT&CK====
@@ -5148,6 +5162,14 @@ This story is focused around detecting attacks on a DevSecOps lifeccycle which c
 | T1204.003
 | Malicious Image
 | Execution
+|-
+| T1212
+| Exploitation for Credential Access
+| Credential Access
+|-
+| T1526
+| Cloud Service Discovery
+| Discovery
 |}


@@ -8703,7 +8725,7 @@ In March of 2016, adversaries were seen using JexBoss--an open-source utility us
 <pre>
 #############
 # Automatically generated by doc_gen.py in https://github.com/splunk/security_content
-# On Date: 2021-08-20 22:13:27.026019 UTC
+# On Date: 2021-08-27 21:42:13.761546 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############