From e9484c657fb5562e47d1690ab7d63693ae744230 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 30 Aug 2022 06:31:00 -0600
Subject: [PATCH 01/29] Update
 ssa___windows_lolbin_binary_in_non_standard_path.yml

---
 .../ssa___windows_lolbin_binary_in_non_standard_path.yml    | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
index 3c745c91b3..e60a9df909 100644
--- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
+++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
@@ -1,6 +1,6 @@
 name: Windows LOLBin Binary in Non Standard Path
 id: 25689101-012a-324a-94d3-08301e6c065a
-version: 3
+version: 4
 description: The following analytic identifies native living off the land binaries
   within the Windows operating system that may be abused by adversaries by moving
   it to a new directory. The list of binaries was derived from the https://lolbas-project.github.io
@@ -14,7 +14,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
 
   $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe"
-  OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bash.exe"
+  OR process_name="at.exe" OR process_name="atbroker.exe"
   OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe"
   OR process_name="certutil.exe" OR process_name="cmdkey.exe" OR process_name="cmdl32.exe"
   OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe"
@@ -30,7 +30,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="msconfig.exe"
   OR process_name="msdt.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe"
   OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe"
-  OR process_name="onedrivestandaloneupdater.exe" OR process_name="pcalua.exe" OR
+  OR process_name="pcalua.exe" OR
   process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe"
   OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe"
   OR process_name="psr.exe" OR process_name="rasautou.exe" OR process_name="reg.exe"

From 44bc5ac3daeff0dfc7a0048ea5090c7dee7d1379 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 30 Aug 2022 06:38:55 -0600
Subject: [PATCH 02/29] Update windows_ingress_tool_transfer_using_explorer.yml

---
 ...s_ingress_tool_transfer_using_explorer.yml | 32 +++++++++++++------
 1 file changed, 22 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
index 7866b9324f..8b8526b547 100644
--- a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
+++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
@@ -1,16 +1,16 @@
 name: Windows Ingress Tool Transfer Using Explorer
 id: 76753bab-f116-4ea3-8fb9-89b638be58a9
-version: 1
-date: '2022-08-01'
+version: 2
+date: '2022-08-30'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic detects an explorer.exe with a possible url link process command line on it.
-  Explorer.exe is known windows process that handle start menu, taskbar ,desktop and file manager. 
-  So many threat actor abuses this process like DCRat malware, where it tries to open the url link with the default process browser application 
-  in the target host by putting the url link as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check 
-  which user and how this process was executed, what is the parent process and what is the url link. This technique is not so common way to open an url link.
+description: The following analytic identifies the Windows Explorer process with a URL within the command-line.
+  Explorer.exe is known Windows process that handles start menu, taskbar, desktop and file manager. 
+  Many adversaries abuse this process, like DCRat malware, where it attempts to open the URL with the default browser application 
+  on the target host by putting the URL as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check 
+  which user and how this process was executed, what is the parent process and what is the URL link. This technique is not commonly used to open an URL.
 search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where (Processes.process_name = explorer.exe OR Processes.original_file_name = explorer.exe) AND NOT (Processes.parent_process_name IN("userinit.exe", "svchost.exe")) Processes.process IN ("* http://*", "* https://*")
   by  Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id Processes.dest Processes.user
@@ -23,7 +23,7 @@ how_to_implement: To successfully implement this search you need to be ingesting
   your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
   confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
   endpoint product.
-known_false_positives: unknown
+known_false_positives: False positives may be present based on legitimate applications or third party utilities. Filter out any additional parent process names. 
 references:
 - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
 tags:
@@ -43,16 +43,28 @@ tags:
   impact: 50
   kill_chain_phases:
   - Exploitation
-  message: a explorer process with url link $process$ in $dest$
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a remote payload.
   mitre_attack_id:
   - T1105
   nist:
   - DE.CM
   observable:
+  - name: user
+    type: User
+    role:
+    - Victim
   - name: dest
     type: Hostname
     role:
     - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -71,4 +83,4 @@ tags:
   - Processes.process_path
   - Processes.parent_process_id
   risk_score: 25
-  security_domain: endpoint
+  security_domain: endpoint
\ No newline at end of file

From affae7229d165131a993083c8b9fb1a723a295b8 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 1 Sep 2022 15:02:44 -0600
Subject: [PATCH 03/29] SSA all things

---
 .../endpoint/dump_lsass_via_procdump.yml      |  5 +-
 ...ows_lolbin_binary_in_non_standard_path.yml |  8 +-
 ...tial_dumping_with_ntdsutil_export_ntds.yml | 90 +++++++++++++++++++
 ...ws_os_credential_dumping_with_procdump.yml | 87 ++++++++++++++++++
 ...xy_execution_msiexec_dllregisterserver.yml | 78 ++++++++++++++++
 ...roxy_execution_msiexec_remote_download.yml | 78 ++++++++++++++++
 ...proxy_execution_msiexec_unregister_dll.yml | 78 ++++++++++++++++
 ...execution_compiled_html_file_decompile.yml | 79 ++++++++++++++++
 ...dumping_with_ntdsutil_export_ntds.test.yml |  9 ++
 ..._credential_dumping_with_procdump.test.yml |  9 ++
 ...ecution_msiexec_dllregisterserver.test.yml |  9 ++
 ...execution_msiexec_remote_download.test.yml |  9 ++
 ..._execution_msiexec_unregister_dll.test.yml |  9 ++
 ...tion_compiled_html_file_decompile.test.yml | 13 +++
 14 files changed, 555 insertions(+), 6 deletions(-)
 create mode 100644 detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
 create mode 100644 detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
 create mode 100644 detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
 create mode 100644 detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
 create mode 100644 detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
 create mode 100644 detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
 create mode 100644 tests/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.test.yml
 create mode 100644 tests/endpoint/ssa___windows_os_credential_dumping_with_procdump.test.yml
 create mode 100644 tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.test.yml
 create mode 100644 tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.test.yml
 create mode 100644 tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.test.yml
 create mode 100644 tests/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml

diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
index 42f12b5b6e..4c00cb3b3d 100644
--- a/detections/endpoint/dump_lsass_via_procdump.yml
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -1,7 +1,7 @@
 name: Dump LSASS via procdump
 id: 3742ebfe-64c2-11eb-ae93-0242ac130002
-version: 2
-date: '2021-09-16'
+version: 3
+date: '2022-08-31'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -31,6 +31,7 @@ references:
 - https://attack.mitre.org/techniques/T1003/001/
 - https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
+- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
 tags:
   analytic_story:
   - Credential Dumping
diff --git a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
index 15ebfb6e05..0d1be4f702 100644
--- a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
+++ b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
@@ -1,7 +1,7 @@
 name: Windows LOLBin Binary in Non Standard Path
 id: 25689101-012a-324a-94d3-08301e6c065a
-version: 3
-date: '2022-07-19'
+version: 4
+date: '2022-08-31'
 author: Michael Haag, Splunk
 type: Anomaly
 datamodel:
@@ -16,11 +16,11 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
   null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
 
-  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bash.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR 
+  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR 
   process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR 
   process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe" OR 
   process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="msconfig.exe" OR process_name="msdt.exe" OR process_name="mshta.exe" OR 
-  process_name="msiexec.exe" OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="onedrivestandaloneupdater.exe" OR process_name="pcalua.exe" OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe" OR process_name="psr.exe" OR process_name="rasautou.exe" OR 
+  process_name="msiexec.exe" OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="pcalua.exe" OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe" OR process_name="psr.exe" OR process_name="rasautou.exe" OR 
   process_name="reg.exe" OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe" OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR 
   process_name="settingsynchost.exe" OR process_name="syncappvpublishingserver.exe" OR process_name="ttdinject.exe" OR process_name="tttracer.exe" OR process_name="vbc.exe" OR process_name="verclsid.exe" OR process_name="wab.exe" OR process_name="wlrmdr.exe" OR process_name="wmic.exe" OR process_name="workfolders.exe" OR process_name="wscript.exe" OR process_name="wsreset.exe" OR process_name="wuauclt.exe" OR process_name="xwizard.exe";
 
diff --git a/detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
new file mode 100644
index 0000000000..e42761953e
--- /dev/null
+++ b/detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
@@ -0,0 +1,90 @@
+name: Windows OS Credential Dumping with Ntdsutil Export NTDS
+id: f111cdc1-43ee-4429-a3c0-qpce4fed7a85
+version: 1
+date: '2022-08-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory
+  database - NTDS.dit, typically used for offline password cracking. It may be used
+  in normal circumstances with no command line arguments or shorthand variations of
+  more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical
+  command used to dump ntds.dit \
+
+  ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \
+
+  This technique uses "Install from Media" (IFM), which will extract a copy of the
+  Active Directory database. A successful export of the Active Directory database
+  will yield a file modification named ntds.dit to the destination.'
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="ntdsutil.exe"
+  AND (like (cmd_line, "%ntds%") AND like (cmd_line, "%create%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: Highly possible Server Administrators will troubleshoot with
+  ntdsutil.exe, generating false positives.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11)
+- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html
+tags:
+  analytic_story:
+  - Credential Dumping
+  - HAFNIUM Group
+  - Living Off The Land
+  cis20: []
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
+  impact: 100
+  kill_chain_phases:
+  - Exploitation
+  message: Active Directory NTDS export on $dest_device_id$ using $process_name$ by $dest_user_id$.
+  mitre_attack_id:
+  - T1003.003
+  - T1003
+  nist: []
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 50
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml b/detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
new file mode 100644
index 0000000000..39ae0a2f14
--- /dev/null
+++ b/detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
@@ -0,0 +1,87 @@
+name: Windows OS Credential Dumping with Procdump
+id: f111cdc1-43ee-3921-a3z0-fx9ce4fed7a85
+version: 1
+date: '2022-08-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: 'Detect procdump.exe dumping the lsass process. This query looks for
+  both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump
+  file with all process memory. Both are highly suspect and should be reviewed. This
+  query does not monitor for the internal name (original_file_name=procdump) of the
+  PE or look for procdump64.exe. Modify the query as needed.\
+
+  During triage, confirm this is procdump.exe executing. If it is the first time a
+  Sysinternals utility has been ran, it is possible there will be a -accepteula on
+  the command line. Review other endpoint data sources for cross process (injection)
+  into lsass.exe.'
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND (process_name="procdump.exe" OR process_name="procdump64.exe")
+  AND (like (cmd_line, "%-mm %") OR like (cmd_line, "%-ma %")) AND like (cmd_line, "%lsass%") | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: None identified.
+references:
+- https://attack.mitre.org/techniques/T1003/001/
+- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
+- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
+tags:
+  analytic_story:
+  - Credential Dumping
+  - HAFNIUM Group
+  cis20: []
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Credential Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: Procdump was utilized to dump lsass on $dest_device_id$ by $dest_user_id$.
+  mitre_attack_id:
+  - T1003.001
+  - T1003
+  nist: []
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
new file mode 100644
index 0000000000..3123fe983c
--- /dev/null
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
@@ -0,0 +1,78 @@
+name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer
+id: f111cdc1-43ee-4429-z3c0-ffce4fed7xc5
+version: 1
+date: '2022-08-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies the usage of msiexec.exe using the
+  /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer.
+  Upon triage, review parent process and capture any artifacts for further review.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
+  AND (like (cmd_line, "%/y %") OR like (cmd_line, "%-y %")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: This analytic will need to be tuned for your environment based
+  on legitimate usage of msiexec.exe. Filter as needed.
+references:
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+tags:
+  analytic_story:
+  - Windows System Binary Proxy Execution MSIExec
+  cis20: []
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to register a file.
+  mitre_attack_id:
+  - T1218.007
+  nist: []
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
new file mode 100644
index 0000000000..97a8fcc230
--- /dev/null
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
@@ -0,0 +1,78 @@
+name: Windows System Binary Proxy Execution MSIExec Remote Download
+id: f111cdc1-z3ee-4429-a3c0-ffzse4fed7a85
+version: 1
+date: '2022-08-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies msiexec.exe with http in the command-line.
+  This procedure will utilize msiexec.exe to download a remote file and load it. During
+  triage, review parallel processes and capture any artifacts on disk for review.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: False positives may be present, filter by destination or parent
+  process as needed.
+references:
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+tags:
+  analytic_story:
+  - Windows System Binary Proxy Execution MSIExec
+  cis20: []
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to download a file.
+  mitre_attack_id:
+  - T1218.007
+  nist: []
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
new file mode 100644
index 0000000000..3052faed21
--- /dev/null
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
@@ -0,0 +1,78 @@
+name: Windows System Binary Proxy Execution MSIExec Unregister DLL
+id: f111cdc1-43cp-4429-a3c0-ffcx4fed7a85
+version: 1
+date: '2022-08-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description:  The following analytic identifies the usage of msiexec.exe using the
+  /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer.
+  Upon triage, review parent process and capture any artifacts for further review.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
+  AND (like (cmd_line, "%/z %") OR like (cmd_line, "%-z %")) | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. 
+known_false_positives: False positives may be present, filter by destination or parent
+  process as needed.
+references:
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+tags:
+  analytic_story:
+  - Windows System Binary Proxy Execution MSIExec
+  cis20: []
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to unregister a DLL.
+  mitre_attack_id:
+  - T1218.007
+  nist: []
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
new file mode 100644
index 0000000000..46c2483c02
--- /dev/null
+++ b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
@@ -0,0 +1,79 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Decompile
+id: 2acf0e19-4149-451c-a3f3-39cd3c77e37d
+version: 1
+date: '2022-08-31'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the decompile parameter with the HTML Help application, HH.exe. This is a uncommon command to see ran and behavior. Most recently this was seen in a APT41 campaign where a CHM file was delivered and a script inside used a technique for running an arbitrary command in a CHM file via an ActiveX object. This unpacks an HTML help file to a specified path for launching the next stage.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where `process_hh`
+  Processes.process=*-decompile* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `windows_system_binary_proxy_execution_compiled_html_file_decompile_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives should be limited, filter as needed.
+references:
+  - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
+  - https://redcanary.com/blog/introducing-atomictestharnesses/
+  - https://attack.mitre.org/techniques/T1218/001/
+  - https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/hh_decom_windows-sysmon.log
+  impact: 100
+  kill_chain_phases:
+  - Delivery
+  message:  $process_name$ has been identified using decompile against a CHM on $dest$ under user $user$.
+  mitre_attack_id:
+  - T1218.001
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 90
+  security_domain: endpoint
diff --git a/tests/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.test.yml b/tests/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.test.yml
new file mode 100644
index 0000000000..19e31e71ea
--- /dev/null
+++ b/tests/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.test.yml
@@ -0,0 +1,9 @@
+name: Windows OS Credential Dumping with Ntdsutil Export NTDS Unit Test
+tests:
+- name: Windows OS Credential Dumping with Ntdsutil Export NTDS
+  file: endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/4688_windows-security.log
+    source: XmlWinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_os_credential_dumping_with_procdump.test.yml b/tests/endpoint/ssa___windows_os_credential_dumping_with_procdump.test.yml
new file mode 100644
index 0000000000..7b61656534
--- /dev/null
+++ b/tests/endpoint/ssa___windows_os_credential_dumping_with_procdump.test.yml
@@ -0,0 +1,9 @@
+name: Windows OS Credential Dumping with Procdump Unit Test
+tests:
+- name: Windows OS Credential Dumping with Procdump
+  file: endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: procdump_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log
+    source: XmlWinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.test.yml
new file mode 100644
index 0000000000..484fba41b2
--- /dev/null
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.test.yml
@@ -0,0 +1,9 @@
+name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer Unit Test
+tests:
+- name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer
+  file: endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_msiexec-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+    source: XmlWinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.test.yml
new file mode 100644
index 0000000000..c84e6686b6
--- /dev/null
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.test.yml
@@ -0,0 +1,9 @@
+name: Windows System Binary Proxy Execution MSIExec Remote Download Unit Test
+tests:
+- name: Windows System Binary Proxy Execution MSIExec Remote Download
+  file: endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_msiexec-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+    source: XmlWinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.test.yml
new file mode 100644
index 0000000000..3ced45f3a0
--- /dev/null
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.test.yml
@@ -0,0 +1,9 @@
+name: Windows System Binary Proxy Execution MSIExec Unregister DLL Unit Test
+tests:
+- name: Windows System Binary Proxy Execution MSIExec Unregister DLL
+  file: endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_msiexec-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+    source: XmlWinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml b/tests/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
new file mode 100644
index 0000000000..a390c10984
--- /dev/null
+++ b/tests/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
@@ -0,0 +1,13 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Decompile Unit Test
+tests:
+- name: Windows System Binary Proxy Execution Compiled HTML File Decompile
+  file: endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: hh_decom_windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/hh_decom_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 171f7e2b801c1cdaa7bcdb6f1c70f2425613330a Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 1 Sep 2022 15:10:29 -0600
Subject: [PATCH 04/29] id fix

---
 ..._windows_os_credential_dumping_with_ntdsutil_export_ntds.yml | 2 +-
 .../ssa___windows_os_credential_dumping_with_procdump.yml       | 2 +-
 ..._system_binary_proxy_execution_msiexec_dllregisterserver.yml | 2 +-
 ...ws_system_binary_proxy_execution_msiexec_remote_download.yml | 2 +-
 ...ows_system_binary_proxy_execution_msiexec_unregister_dll.yml | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
index e42761953e..40fc576c6e 100644
--- a/detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
+++ b/detections/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
@@ -1,5 +1,5 @@
 name: Windows OS Credential Dumping with Ntdsutil Export NTDS
-id: f111cdc1-43ee-4429-a3c0-qpce4fed7a85
+id: dad9ddec-a72a-47be-87b6-a0f7ba98ed6e
 version: 1
 date: '2022-08-31'
 author: Michael Haag, Splunk
diff --git a/detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml b/detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
index 39ae0a2f14..950bad3447 100644
--- a/detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
+++ b/detections/endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
@@ -1,5 +1,5 @@
 name: Windows OS Credential Dumping with Procdump
-id: f111cdc1-43ee-3921-a3z0-fx9ce4fed7a85
+id: e102e297-dbe6-4a19-b319-5c08f4c19a06
 version: 1
 date: '2022-08-31'
 author: Michael Haag, Splunk
diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
index 3123fe983c..5f60b75dfa 100644
--- a/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
@@ -1,5 +1,5 @@
 name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer
-id: f111cdc1-43ee-4429-z3c0-ffce4fed7xc5
+id: 8d1d5570-722c-49a3-996c-2e2cceef5163
 version: 1
 date: '2022-08-31'
 author: Michael Haag, Splunk
diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
index 97a8fcc230..d8d6547ffc 100644
--- a/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
@@ -1,5 +1,5 @@
 name: Windows System Binary Proxy Execution MSIExec Remote Download
-id: f111cdc1-z3ee-4429-a3c0-ffzse4fed7a85
+id: 92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5
 version: 1
 date: '2022-08-31'
 author: Michael Haag, Splunk
diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
index 3052faed21..8a6a38d13e 100644
--- a/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
@@ -1,5 +1,5 @@
 name: Windows System Binary Proxy Execution MSIExec Unregister DLL
-id: f111cdc1-43cp-4429-a3c0-ffcx4fed7a85
+id: df76a8d1-92e1-4ec9-b8f7-695b5838703e
 version: 1
 date: '2022-08-31'
 author: Michael Haag, Splunk

From 6287645f489845bc53e621fca844f66892c9bc10 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 2 Sep 2022 14:44:39 -0600
Subject: [PATCH 05/29] BA

---
 ...execution_compiled_html_file_decompile.yml | 82 ++++++++++++++++
 ...compiled_html_file_url_in_command_line.yml | 94 ++++++++++++++++++
 ...l_file_using_infotech_storage_handlers.yml | 96 +++++++++++++++++++
 ...execution_compiled_html_file_decompile.yml |  3 +-
 ...tion_compiled_html_file_decompile.test.yml |  9 ++
 ...led_html_file_url_in_command_line.test.yml |  9 ++
 ...e_using_infotech_storage_handlers.test.yml |  9 ++
 7 files changed, 301 insertions(+), 1 deletion(-)
 create mode 100644 detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
 create mode 100644 detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
 create mode 100644 detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
 create mode 100644 tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
 create mode 100644 tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
 create mode 100644 tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml

diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
new file mode 100644
index 0000000000..3f41e40fdc
--- /dev/null
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
@@ -0,0 +1,82 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Decompile
+id: 11c32b19-05a6-48a8-ab28-18dbd9ec5d50
+version: 1
+date: '2022-09-02'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies the decompile parameter with the HTML Help application, HH.exe. This is a uncommon command to see ran and behavior. Most recently this was seen in a APT41 campaign where a CHM file was delivered and a script inside used a technique for running an arbitrary command in a CHM file via an ActiveX object. This unpacks an HTML help file to a specified path for launching the next stage.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe"
+  AND like (cmd_line, "%-decompile%")| eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives should be limited, filter as needed.
+references:
+  - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
+  - https://redcanary.com/blog/introducing-atomictestharnesses/
+  - https://attack.mitre.org/techniques/T1218/001/
+  - https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+  impact: 100
+  kill_chain_phases:
+  - Exploitation
+  message: $process_name$ has been identified using decompile against a CHM on $dest_device_id$ under user $dest_user_id$.
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
new file mode 100644
index 0000000000..7170164ac1
--- /dev/null
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
@@ -0,0 +1,94 @@
+name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line
+id: 0fec631a-7c9b-4e4c-b28b-93260953e25f
+version: 1
+date: '2022-09-02'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
+  HTML Help (CHM) file from a remote url. This particular technique will load Windows
+  script code from a compiled help file. CHM files may  contain nearly any file type
+  embedded, but only execute html/htm. Upon a successful execution, the following
+  script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode,
+  JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe
+  upon execution. The "htm" and "html" file extensions were the only extensions observed
+  to be supported for the execution of Shortcut commands or WSH script code. During
+  investigation, identify script content origination. Review reputation of remote
+  IP and domain. Some instances, it is worth decompiling the .chm file to review its
+  original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe"
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%"))| eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives:  Although unlikely, some legitimate applications may retrieve
+  a CHM remotely, filter as needed.
+references:
+  - https://attack.mitre.org/techniques/T1218/001/
+  - https://www.kb.cert.org/vuls/id/851869
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
+  - https://lolbas-project.github.io/lolbas/Binaries/Hh/
+  - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
+  - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ contacting a remote destination.
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
new file mode 100644
index 0000000000..c0a90aeb79
--- /dev/null
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
@@ -0,0 +1,96 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers
+id: ba0c2450-caea-4086-ac3a-a71e2659754b
+version: 1
+date: '2022-09-02'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
+  HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique
+  will load Windows script code from a compiled help file, using InfoTech Storage
+  Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are
+  supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm
+  file from within a CHM file. CHM files may contain nearly any file type embedded.
+  Upon a successful execution, the following script engines may be used for execution
+  - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may
+  identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm"
+  and "html" file extensions were the only extensions observed to be supported for
+  the execution of Shortcut commands or WSH script code. During investigation, identify
+  script content origination. hh.exe is natively found in C:\Windows\system32 and
+  C:\Windows\syswow64.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe"
+  AND (like (cmd_line, "%its:%") OR like (cmd_line, "%-y %"))| eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: It is rare to see instances of InfoTech Storage Handlers being
+  used, but it does happen in some legitimate instances. Filter as needed.
+references:
+  - https://attack.mitre.org/techniques/T1218/001/
+  - https://www.kb.cert.org/vuls/id/851869
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
+  - https://lolbas-project.github.io/lolbas/Binaries/Hh/
+  - https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
+  - https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: $process_name$ has been identified using Infotech Storage Handlers to load
+    a specific file within a CHM on $dest_device_id$ under user $dest_user_id$.
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 72
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
index 46c2483c02..ef44ccfb51 100644
--- a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+++ b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
@@ -40,9 +40,10 @@ tags:
   impact: 100
   kill_chain_phases:
   - Delivery
-  message:  $process_name$ has been identified using decompile against a CHM on $dest$ under user $user$.
+  message: $process_name$ has been identified using decompile against a CHM on $dest$ under user $user$.
   mitre_attack_id:
   - T1218.001
+  - T1218
   nist:
   - DE.CM
   observable:
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
new file mode 100644
index 0000000000..d5901517a6
--- /dev/null
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
@@ -0,0 +1,9 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Decompile Unit Test
+tests:
+- name: Windows System Binary Proxy Execution Compiled HTML File Decompile
+  file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+    source: XmlWinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
new file mode 100644
index 0000000000..f52f91bf5e
--- /dev/null
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
@@ -0,0 +1,9 @@
+name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line Unit Test
+tests:
+- name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line
+  file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_url_in_command_line.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+    source: XmlWinEventLog:Security
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml
new file mode 100644
index 0000000000..5965ef46ed
--- /dev/null
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml
@@ -0,0 +1,9 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers Unit Test
+tests:
+- name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage Handlers
+  file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_using_infotech_storage_handlers.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: 4688_windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+    source: XmlWinEventLog:Security
\ No newline at end of file

From f0601e4f9d0124c9682a1528e71e72e90606b2f5 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 2 Sep 2022 15:04:47 -0600
Subject: [PATCH 06/29] Update
 ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml

---
 ...stem_binary_proxy_execution_compiled_html_file_decompile.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
index 3f41e40fdc..5ce482a836 100644
--- a/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
@@ -77,6 +77,6 @@ tags:
   - dest_user_id
   - process
   - cmd_line
-  risk_score: 80
+  risk_score: 90
   security_domain: endpoint
   asset_type: Endpoint

From 6ea742801105dc6c1d6b7e301064ce2662cd6b4d Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 8 Sep 2022 10:23:08 -0600
Subject: [PATCH 07/29] test test

---
 ...s_os_credential_dumping_with_ntdsutil_export_ntds.test.yml | 4 +++-
 ...ssa___windows_os_credential_dumping_with_procdump.test.yml | 4 +++-
 ...nary_proxy_execution_compiled_html_file_decompile.test.yml | 4 +++-
 ..._execution_compiled_html_file_url_in_command_line.test.yml | 2 +-
 4 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/tests/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.test.yml b/tests/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.test.yml
index 19e31e71ea..2a80b82852 100644
--- a/tests/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.test.yml
+++ b/tests/endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.test.yml
@@ -6,4 +6,6 @@ tests:
   attack_data:
   - file_name: 4688_windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/4688_windows-security.log
-    source: XmlWinEventLog:Security
\ No newline at end of file
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_os_credential_dumping_with_procdump.test.yml b/tests/endpoint/ssa___windows_os_credential_dumping_with_procdump.test.yml
index 7b61656534..f4e4fb3bc8 100644
--- a/tests/endpoint/ssa___windows_os_credential_dumping_with_procdump.test.yml
+++ b/tests/endpoint/ssa___windows_os_credential_dumping_with_procdump.test.yml
@@ -6,4 +6,6 @@ tests:
   attack_data:
   - file_name: procdump_windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log
-    source: XmlWinEventLog:Security
\ No newline at end of file
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
index d5901517a6..910f26b248 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
@@ -6,4 +6,6 @@ tests:
   attack_data:
   - file_name: 4688_windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
-    source: XmlWinEventLog:Security
\ No newline at end of file
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
index f52f91bf5e..66d703c44f 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
@@ -6,4 +6,4 @@ tests:
   attack_data:
   - file_name: 4688_windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
-    source: XmlWinEventLog:Security
\ No newline at end of file
+    source: xmlwineventLog:security
\ No newline at end of file

From 1c928ebffe3fad2311c8ecb915a1b46ea4f2a708 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 8 Sep 2022 10:27:54 -0600
Subject: [PATCH 08/29] fixord

---
 ...ompiled_html_file_using_infotech_storage_handlers.test.yml | 4 +++-
 ..._binary_proxy_execution_msiexec_dllregisterserver.test.yml | 4 +++-
 ...em_binary_proxy_execution_msiexec_remote_download.test.yml | 4 +++-
 ...tem_binary_proxy_execution_msiexec_unregister_dll.test.yml | 4 +++-
 4 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml
index 5965ef46ed..affc26c0a0 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml
@@ -6,4 +6,6 @@ tests:
   attack_data:
   - file_name: 4688_windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
-    source: XmlWinEventLog:Security
\ No newline at end of file
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.test.yml
index 484fba41b2..0d1e393cec 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.test.yml
@@ -6,4 +6,6 @@ tests:
   attack_data:
   - file_name: 4688_msiexec-windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
-    source: XmlWinEventLog:Security
\ No newline at end of file
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.test.yml
index c84e6686b6..322571edfe 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.test.yml
@@ -6,4 +6,6 @@ tests:
   attack_data:
   - file_name: 4688_msiexec-windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
-    source: XmlWinEventLog:Security
\ No newline at end of file
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.test.yml
index 3ced45f3a0..cee7bc84e1 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.test.yml
@@ -6,4 +6,6 @@ tests:
   attack_data:
   - file_name: 4688_msiexec-windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
-    source: XmlWinEventLog:Security
\ No newline at end of file
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file

From 6531d4350ec85d2207a86b49d8c8b9452c9bb748 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 8 Sep 2022 10:34:08 -0600
Subject: [PATCH 09/29] Update
 ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml

---
 ..._execution_compiled_html_file_url_in_command_line.test.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
index 66d703c44f..9efcc203e0 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
@@ -6,4 +6,6 @@ tests:
   attack_data:
   - file_name: 4688_windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
-    source: xmlwineventLog:security
\ No newline at end of file
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file

From 442955c826fd6474b0b41a803f41abf6019c910e Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 8 Sep 2022 10:48:20 -0600
Subject: [PATCH 10/29] chm fixes

---
 ...xy_execution_compiled_html_file_url_in_command_line.yml | 2 +-
 ..._compiled_html_file_using_infotech_storage_handlers.yml | 4 ++--
 ...ecution_compiled_html_file_url_in_command_line.test.yml | 7 +++----
 ...iled_html_file_using_infotech_storage_handlers.test.yml | 7 +++----
 4 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
index 7170164ac1..a088ee9522 100644
--- a/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
@@ -53,7 +53,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
   impact: 90
   kill_chain_phases:
   - Exploitation
diff --git a/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
index c0a90aeb79..f77c4fbcdc 100644
--- a/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
+++ b/detections/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
@@ -26,7 +26,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
   cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe"
-  AND (like (cmd_line, "%its:%") OR like (cmd_line, "%-y %"))| eval start_time=timestamp, end_time=timestamp,
+  AND (like (cmd_line, "%its:%") OR like (cmd_line, "%mk:@MSITStore:%"))| eval start_time=timestamp, end_time=timestamp,
   entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
   "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
   cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
@@ -55,7 +55,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
   impact: 80
   kill_chain_phases:
   - Exploitation
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
index 9efcc203e0..47a7566587 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml
@@ -4,8 +4,7 @@ tests:
   file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_url_in_command_line.yml
   pass_condition: '@count_gt(0)'
   attack_data:
-  - file_name: 4688_windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
-    source: XmlWinEventLog
-    sourcetype: XmlWinEventLog
+  - file_name: chm-wineventlog-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
+    source: WinEventLog:Security
     update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml
index affc26c0a0..9850d4e8b2 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml
@@ -4,8 +4,7 @@ tests:
   file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_using_infotech_storage_handlers.yml
   pass_condition: '@count_gt(0)'
   attack_data:
-  - file_name: 4688_windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
-    source: XmlWinEventLog
-    sourcetype: XmlWinEventLog
+  - file_name: chm-wineventlog-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
+    source: WinEventLog:Security
     update_timestamp: true
\ No newline at end of file

From f0324892d5fefa621476f5ce4dcef0e4f3b4a6dd Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 9 Sep 2022 06:50:43 -0600
Subject: [PATCH 11/29] hunt Windows Event Triggered Image File Execution
 Options Injection

---
 ...image_file_execution_options_injection.yml | 61 +++++++++++++++++++
 macros/wineventlog_application.yml            |  4 ++
 ..._file_execution_options_injection.test.yml | 13 ++++
 3 files changed, 78 insertions(+)
 create mode 100644 detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
 create mode 100644 macros/wineventlog_application.yml
 create mode 100644 tests/endpoint/windows_event_triggered_image_file_execution_options_injection.test.yml

diff --git a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
new file mode 100644
index 0000000000..a1bbb9177e
--- /dev/null
+++ b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
@@ -0,0 +1,61 @@
+name: Windows Event Triggered Image File Execution Options Injection
+id: f7abfab9-12ea-44e8-8745-475f9ca6e0a4
+version: 1
+date: '2022-09-08'
+author: Michael Haag, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following hunting analytic identifies EventCode 3000 in Application channel indicating a process exit. This behavior is based on process names being added to the Image File Execution Options under HKLM \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ and \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit. Once these are set for a process, an eventcode 3000 will generate. 
+  The example used is from Thinkst Canary where a CanaryToken is setup to monitor for a commonly abused living off the land binary (ex. Klist.exe) and generate an event when it occurs. This can be seen as settings traps to monitor for suspicious behavior.
+  Monitor and tune this hunting analytic and setup traps across your organization and begin monitoring.
+search: '`wineventlog_application` EventCode=3000 
+| rename param1 AS "Process" param2 AS "Exit_Code"
+| stats count min(_time) as firstTime max(_time) as lastTime by Process Exit_Code dest
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`
+| `windows_event_triggered_image_file_execution_options_injection_filter`'
+how_to_implement: This analytic requires capturing the Windows Event Log Application channel in XML. 
+known_false_positives: False positives may be present and tuning will be required before turning into a TTP or notable.
+references:
+- https://blog.thinkst.com/2022/09/sensitive-command-token-so-much-offense.html
+- https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/registry-entries-for-silent-process-exit
+tags:
+  analytic_story:
+  - Windows Persistence Techniques
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.012/atomic_red_team/windows-application.log
+  impact: 50
+  kill_chain_phases:
+  - Installation
+  message: Windows eventcode 3000 triggered on $dest$ potentially indicating persistence or a monitoring of a process has occurred.
+  mitre_attack_id:
+  - T1546.012
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Process 
+  - Exit_Code 
+  - dest
+  - EventCode
+  risk_score: 25
+  security_domain: endpoint
diff --git a/macros/wineventlog_application.yml b/macros/wineventlog_application.yml
new file mode 100644
index 0000000000..a3a889062e
--- /dev/null
+++ b/macros/wineventlog_application.yml
@@ -0,0 +1,4 @@
+definition: eventtype=wineventlog_application
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: wineventlog_application
diff --git a/tests/endpoint/windows_event_triggered_image_file_execution_options_injection.test.yml b/tests/endpoint/windows_event_triggered_image_file_execution_options_injection.test.yml
new file mode 100644
index 0000000000..0631360604
--- /dev/null
+++ b/tests/endpoint/windows_event_triggered_image_file_execution_options_injection.test.yml
@@ -0,0 +1,13 @@
+name: Windows Event Triggered Image File Execution Options Injection Unit Test
+tests:
+- name: Windows Event Triggered Image File Execution Options Injection
+  file: endpoint/windows_event_triggered_image_file_execution_options_injection.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-application.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.012/atomic_red_team/windows-application.log
+    source: XmlWinEventLog:Application
+    sourcetype: XmlWinEventLog
+    update_timestamp: true

From c3653c14043a2a441ecc101ed2ede95f68229fef Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 12 Sep 2022 07:57:53 -0600
Subject: [PATCH 12/29] test

---
 ...s_event_triggered_image_file_execution_options_injection.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
index a1bbb9177e..38f54490fb 100644
--- a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
+++ b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
@@ -9,7 +9,7 @@ datamodel:
 description: The following hunting analytic identifies EventCode 3000 in Application channel indicating a process exit. This behavior is based on process names being added to the Image File Execution Options under HKLM \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ and \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit. Once these are set for a process, an eventcode 3000 will generate. 
   The example used is from Thinkst Canary where a CanaryToken is setup to monitor for a commonly abused living off the land binary (ex. Klist.exe) and generate an event when it occurs. This can be seen as settings traps to monitor for suspicious behavior.
   Monitor and tune this hunting analytic and setup traps across your organization and begin monitoring.
-search: '`wineventlog_application` EventCode=3000 
+search: 'source="XmlWinEventLog:Application" EventCode=3000 
 | rename param1 AS "Process" param2 AS "Exit_Code"
 | stats count min(_time) as firstTime max(_time) as lastTime by Process Exit_Code dest
 | `security_content_ctime(firstTime)` 

From 00a2a9596181329e194547f269419558bccc90ab Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 12 Sep 2022 08:18:30 -0600
Subject: [PATCH 13/29] space or tab, we'll never know

---
 ...ggered_image_file_execution_options_injection.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
index 38f54490fb..c09fc6be0d 100644
--- a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
+++ b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
@@ -9,12 +9,12 @@ datamodel:
 description: The following hunting analytic identifies EventCode 3000 in Application channel indicating a process exit. This behavior is based on process names being added to the Image File Execution Options under HKLM \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ and \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit. Once these are set for a process, an eventcode 3000 will generate. 
   The example used is from Thinkst Canary where a CanaryToken is setup to monitor for a commonly abused living off the land binary (ex. Klist.exe) and generate an event when it occurs. This can be seen as settings traps to monitor for suspicious behavior.
   Monitor and tune this hunting analytic and setup traps across your organization and begin monitoring.
-search: 'source="XmlWinEventLog:Application" EventCode=3000 
-| rename param1 AS "Process" param2 AS "Exit_Code"
-| stats count min(_time) as firstTime max(_time) as lastTime by Process Exit_Code dest
-| `security_content_ctime(firstTime)` 
-| `security_content_ctime(lastTime)`
-| `windows_event_triggered_image_file_execution_options_injection_filter`'
+search: '`wineventlog_application` EventCode=3000 
+  | rename param1 AS "Process" param2 AS "Exit_Code"
+  | stats count min(_time) as firstTime max(_time) as lastTime by Process Exit_Code dest
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `windows_event_triggered_image_file_execution_options_injection_filter`'
 how_to_implement: This analytic requires capturing the Windows Event Log Application channel in XML. 
 known_false_positives: False positives may be present and tuning will be required before turning into a TTP or notable.
 references:

From 7507b45e78f89e881eb1656783440f54bb1cd003 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 12 Sep 2022 08:44:58 -0600
Subject: [PATCH 14/29] Update
 windows_event_triggered_image_file_execution_options_injection.yml

---
 ..._event_triggered_image_file_execution_options_injection.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
index c09fc6be0d..0e3deecdc2 100644
--- a/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
+++ b/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml
@@ -4,8 +4,7 @@ version: 1
 date: '2022-09-08'
 author: Michael Haag, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: The following hunting analytic identifies EventCode 3000 in Application channel indicating a process exit. This behavior is based on process names being added to the Image File Execution Options under HKLM \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ and \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit. Once these are set for a process, an eventcode 3000 will generate. 
   The example used is from Thinkst Canary where a CanaryToken is setup to monitor for a commonly abused living off the land binary (ex. Klist.exe) and generate an event when it occurs. This can be seen as settings traps to monitor for suspicious behavior.
   Monitor and tune this hunting analytic and setup traps across your organization and begin monitoring.

From 36ffb11950d12ee072e752fedd826f5d162ef0c8 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 12 Sep 2022 08:53:24 -0600
Subject: [PATCH 15/29] Update wineventlog_application.yml

---
 macros/wineventlog_application.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/macros/wineventlog_application.yml b/macros/wineventlog_application.yml
index a3a889062e..e3e98c58c7 100644
--- a/macros/wineventlog_application.yml
+++ b/macros/wineventlog_application.yml
@@ -1,4 +1,4 @@
-definition: eventtype=wineventlog_application
+definition: eventtype=wineventlog_application OR source="XmlWinEventLog:Application"
 description: customer specific splunk configurations(eg- index, source, sourcetype).
   Replace the macro definition with configurations for your Splunk Environmnent.
-name: wineventlog_application
+name: wineventlog_application
\ No newline at end of file

From fb15ba799aca24ce1ed954af8be21660e18e574b Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 13 Sep 2022 10:48:22 -0600
Subject: [PATCH 16/29] Update windows_identify_protocol_handlers.yml

---
 detections/endpoint/windows_identify_protocol_handlers.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/windows_identify_protocol_handlers.yml b/detections/endpoint/windows_identify_protocol_handlers.yml
index a0042656bc..13e5fe4474 100644
--- a/detections/endpoint/windows_identify_protocol_handlers.yml
+++ b/detections/endpoint/windows_identify_protocol_handlers.yml
@@ -1,13 +1,13 @@
 name: Windows Identify Protocol Handlers
 id: bd5c311e-a6ea-48ae-a289-19a3398e3648
-version: 1
-date: '2022-07-11'
+version: 2
+date: '2022-09-13'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel:
 - Endpoint
 description: 'The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings).
-  To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL in the property to limit the scope of this query to similar handlers as ms-msdt.'
+  To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes  by Processes.dest Processes.user Processes.process_name Processes.process 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
@@ -17,6 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives will be found. https and http is a URL Protocol handler that will trigger this analytic. Tune based on process or command-line.
 references:
+  - https://gist.github.com/MHaggis/a0d3edb57d36e0916c94c0a464b2722e
   - https://www.oreilly.com/library/view/learning-java/1565927184/apas02.html
   - https://blogs.windows.com/msedgedev/2022/01/20/getting-started-url-protocol-handlers-microsoft-edge/
   - https://github.com/Mr-Un1k0d3r/PoisonHandler

From 2fa429127b0cea5e4abb321921353ac741f03b3d Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 15 Sep 2022 10:07:38 -0600
Subject: [PATCH 17/29] CISA AA22-257A tag

---
 .../dump_lsass_via_procdump_rename.yml        |  1 +
 ...ate_local_admin_accounts_using_net_exe.yml |  1 +
 .../creation_of_lsass_dump_with_taskmgr.yml   |  1 +
 .../endpoint/detect_exchange_web_shell.yml    |  1 +
 .../detect_mimikatz_using_loaded_images.yml   |  1 +
 .../detect_new_local_admin_account.yml        |  1 +
 .../endpoint/dump_lsass_via_comsvcs_dll.yml   |  1 +
 .../endpoint/dump_lsass_via_procdump.yml      |  1 +
 .../endpoint/extraction_of_registry_hives.yml |  1 +
 ...eduled_task_deleted_or_created_via_cmd.yml |  1 +
 .../endpoint/schtasks_run_task_on_demand.yml  |  1 +
 .../endpoint/short_lived_scheduled_task.yml   |  1 +
 detections/endpoint/w3wp_spawning_shell.yml   |  1 +
 .../windows_hidden_schedule_task_settings.yml |  1 +
 .../windows_possible_credential_dumping.yml   |  1 +
 ..._scheduled_task_created_to_spawn_shell.yml |  1 +
 ...eduled_task_created_within_public_path.yml |  1 +
 ...ws_task_scheduler_event_action_started.yml |  1 +
 ...randomly_generated_scheduled_task_name.yml |  1 +
 ...g4shell_jndi_payload_injection_attempt.yml |  1 +
 stories/cisa_aa22_257a.yml                    | 25 +++++++++++++++++++
 21 files changed, 45 insertions(+)
 create mode 100644 stories/cisa_aa22_257a.yml

diff --git a/detections/deprecated/dump_lsass_via_procdump_rename.yml b/detections/deprecated/dump_lsass_via_procdump_rename.yml
index efc9b72471..33d6deb514 100644
--- a/detections/deprecated/dump_lsass_via_procdump_rename.yml
+++ b/detections/deprecated/dump_lsass_via_procdump_rename.yml
@@ -31,6 +31,7 @@ tags:
   analytic_story:
   - Credential Dumping
   - HAFNIUM Group
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
index 42a9b1a862..f7d2a8d1fd 100644
--- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
@@ -27,6 +27,7 @@ tags:
   analytic_story:
   - DHS Report TA18-074A
   - Azorult
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 8
diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
index 15df5f062f..7697ca97a5 100644
--- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
+++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml
@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - Credential Dumping
+  - CISA AA22-257A
   asset_type: Windows
   cis20:
   - CIS 6
diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml
index 104bd72ffd..119515b9bd 100644
--- a/detections/endpoint/detect_exchange_web_shell.yml
+++ b/detections/endpoint/detect_exchange_web_shell.yml
@@ -51,6 +51,7 @@ tags:
   analytic_story:
   - HAFNIUM Group
   - ProxyShell
+  - CISA AA22-257A
   confidence: 90
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml
index ae5cc07725..94612a9d97 100644
--- a/detections/endpoint/detect_mimikatz_using_loaded_images.yml
+++ b/detections/endpoint/detect_mimikatz_using_loaded_images.yml
@@ -30,6 +30,7 @@ tags:
   - Detect Zerologon Attack
   - Cloud Federated Credential Abuse
   - DarkSide Ransomware
+  - CISA AA22-257A
   asset_type: Windows
   cis20:
   - CIS 6
diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml
index 6fd9b5685a..38fb529965 100644
--- a/detections/endpoint/detect_new_local_admin_account.yml
+++ b/detections/endpoint/detect_new_local_admin_account.yml
@@ -22,6 +22,7 @@ tags:
   analytic_story:
   - DHS Report TA18-074A
   - HAFNIUM Group
+  - CISA AA22-257A
   asset_type: Windows
   cis20:
   - CIS 16
diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
index fcb38967de..f9668aa825 100644
--- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
+++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml
@@ -28,6 +28,7 @@ tags:
   - HAFNIUM Group
   - Living Off The Land
   - Industroyer2
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml
index 4c00cb3b3d..65fbe9114e 100644
--- a/detections/endpoint/dump_lsass_via_procdump.yml
+++ b/detections/endpoint/dump_lsass_via_procdump.yml
@@ -36,6 +36,7 @@ tags:
   analytic_story:
   - Credential Dumping
   - HAFNIUM Group
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml
index 9c32749838..94d8d37474 100644
--- a/detections/endpoint/extraction_of_registry_hives.yml
+++ b/detections/endpoint/extraction_of_registry_hives.yml
@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - DarkSide Ransomware
   - Credential Dumping
+  - CISA AA22-257A
   confidence: 70
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
index 4ef0b987f3..fbf982672e 100644
--- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
+++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
@@ -33,6 +33,7 @@ tags:
   - Living Off The Land
   - Azorult
   - DarkCrystal RAT
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml
index f846173778..ed33560e2e 100644
--- a/detections/endpoint/schtasks_run_task_on_demand.yml
+++ b/detections/endpoint/schtasks_run_task_on_demand.yml
@@ -28,6 +28,7 @@ tags:
   analytic_story:
   - XMRig
   - Industroyer2
+  - CISA AA22-257A
   confidence: 80
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/short_lived_scheduled_task.yml b/detections/endpoint/short_lived_scheduled_task.yml
index 4ac14b69ff..a67b39894a 100644
--- a/detections/endpoint/short_lived_scheduled_task.yml
+++ b/detections/endpoint/short_lived_scheduled_task.yml
@@ -26,6 +26,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Lateral Movement
+  - CISA AA22-257A
   confidence: 90
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml
index 488789d381..76f464f205 100644
--- a/detections/endpoint/w3wp_spawning_shell.yml
+++ b/detections/endpoint/w3wp_spawning_shell.yml
@@ -38,6 +38,7 @@ tags:
   - Hermetic Wiper
   - HAFNIUM Group
   - ProxyShell
+  - CISA AA22-257A
   confidence: 80
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/windows_hidden_schedule_task_settings.yml b/detections/endpoint/windows_hidden_schedule_task_settings.yml
index 2e55b57627..a5465c156e 100644
--- a/detections/endpoint/windows_hidden_schedule_task_settings.yml
+++ b/detections/endpoint/windows_hidden_schedule_task_settings.yml
@@ -29,6 +29,7 @@ tags:
   analytic_story:
   - Industroyer2
   - Active Directory Discovery
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/detections/endpoint/windows_possible_credential_dumping.yml b/detections/endpoint/windows_possible_credential_dumping.yml
index f3cd362cc9..d0bc444de2 100644
--- a/detections/endpoint/windows_possible_credential_dumping.yml
+++ b/detections/endpoint/windows_possible_credential_dumping.yml
@@ -44,6 +44,7 @@ tags:
   - Credential Dumping
   - Detect Zerologon Attack
   - DarkSide Ransomware
+  - CISA AA22-257A
   automated_detection_testing: passed
   confidence: 80
   context:
diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
index ea36328a45..82fc6cf309 100644
--- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml
@@ -46,6 +46,7 @@ tags:
   - Windows Persistence Techniques
   - Ransomware
   - Ryuk Ransomware
+  - CISA AA22-257A
   confidence: 100
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
index 5f063fbc8e..cc4957c93b 100644
--- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
@@ -49,6 +49,7 @@ tags:
   - IcedID
   - Active Directory Lateral Movement
   - Industroyer2
+  - CISA AA22-257A
   confidence: 100
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
index 6741d19efd..65237b9068 100644
--- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
+++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
@@ -33,6 +33,7 @@ tags:
   - Windows Persistence Techniques
   - Industroyer2
   - DarkCrystal RAT
+  - CISA AA22-257A
   confidence: 100
   context:
   - Source:Endpoint
diff --git a/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml
index d09385d7d4..f8e4e35a53 100644
--- a/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml
+++ b/detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml
@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Lateral Movement
+  - CISA AA22-257A
   asset_type: Endpoint
   confidence: 50
   context:
diff --git a/detections/web/log4shell_jndi_payload_injection_attempt.yml b/detections/web/log4shell_jndi_payload_injection_attempt.yml
index fadb559859..77f3346d18 100644
--- a/detections/web/log4shell_jndi_payload_injection_attempt.yml
+++ b/detections/web/log4shell_jndi_payload_injection_attempt.yml
@@ -36,6 +36,7 @@ references:
 tags:
   analytic_story:
   - Log4Shell CVE-2021-44228
+  - CISA AA22-257A
   asset_type: Endpoint
   cis20:
   - CIS 3
diff --git a/stories/cisa_aa22_257a.yml b/stories/cisa_aa22_257a.yml
new file mode 100644
index 0000000000..489a6ba149
--- /dev/null
+++ b/stories/cisa_aa22_257a.yml
@@ -0,0 +1,25 @@
+name: CISA AA22-257A
+id: e1aec96e-bc7d-4edf-8ff7-3da9b7b29147
+version: 1
+date: '2022-09-15'
+author: Michael Haag, Splunk
+description: The Iranian government-sponsored APT actors are actively targeting a broad range of victims across multiple U.S. critical infrastructure sectors, including the Transportation Sector and the Healthcare and Public Health Sector, as well as Australian organizations.
+narrative: This advisory updates joint CSA Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities, which provides information on these Iranian government-sponsored APT actors exploiting known Fortinet and Microsoft Exchange vulnerabilities to gain initial access to a broad range of targeted entities in furtherance of malicious activities, including ransom operations. The authoring agencies now judge these actors are an APT group affiliated with the IRGC.
+  Since the initial reporting of this activity in the FBI Liaison Alert System (FLASH) report APT Actors Exploiting Fortinet Vulnerabilities to Gain Access for Malicious Activity from May 2021, the authoring agencies have continued to observe these IRGC-affiliated actors exploiting known vulnerabilities for initial access. In addition to exploiting Fortinet and Microsoft Exchange vulnerabilities, the authoring agencies have observed these APT actors exploiting VMware Horizon Log4j vulnerabilities for initial access. The IRGC-affiliated actors have used this access for follow-on activity, including disk encryption and data extortion, to support ransom operations.
+  The IRGC-affiliated actors are actively targeting a broad range of entities, including entities across multiple U.S. critical infrastructure sectors as well as Australian, Canadian, and United Kingdom organizations. These actors often operate under the auspices of Najee Technology Hooshmand Fater LLC, based in Karaj, Iran, and Afkar System Yazd Company, based in Yazd, Iran. The authoring agencies assess the actors are exploiting known vulnerabilities on unprotected networks rather than targeting specific targeted entities or sectors.
+  This advisory provides observed tactics, techniques, and indicators of compromise (IOCs) that the authoring agencies assess are likely associated with this IRGC-affiliated APT. The authoring agencies urge organizations, especially critical infrastructure organizations, to apply the recommendations listed in the Mitigations section of this advisory to mitigate risk of compromise from these IRGC-affiliated cyber actors.
+references:
+  - https://www.cisa.gov/uscert/ncas/alerts/aa21-321a
+  - https://www.cisa.gov/uscert/ncas/alerts/aa22-257a
+  - https://www.ic3.gov/Media/News/2021/210527.pdf
+  - https://www.us-cert.gov/sites/default/files/AA22-257A.stix.xml
+  - https://www.us-cert.cisa.gov/iran
+tags:
+  analytic_story: CISA AA22-257A
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

From 615b24fe6d79f3328c3b82e64d2adbb3bf360642 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 15 Sep 2022 10:52:56 -0600
Subject: [PATCH 18/29] PLINK

---
 .../windows_protocol_tunneling_with_plink.yml | 82 +++++++++++++++++++
 ...ows_protocol_tunneling_with_plink.test.yml | 13 +++
 2 files changed, 95 insertions(+)
 create mode 100644 detections/endpoint/windows_protocol_tunneling_with_plink.yml
 create mode 100644 tests/endpoint/windows_protocol_tunneling_with_plink.test.yml

diff --git a/detections/endpoint/windows_protocol_tunneling_with_plink.yml b/detections/endpoint/windows_protocol_tunneling_with_plink.yml
new file mode 100644
index 0000000000..a97fc7bdc1
--- /dev/null
+++ b/detections/endpoint/windows_protocol_tunneling_with_plink.yml
@@ -0,0 +1,82 @@
+name: Windows Protocol Tunneling with Plink
+id: 8aac5e1e-0fab-4437-af0b-c6e60af23eed
+version: 1
+date: '2022-09-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the use of Plink being utilized to proxy egress or laterally in an organization. The analytic is limited to specific Plink options on the command-line, including -R -L and -D which will have the remote and local IP address or port and -l for a username. Modify the options as seen fit for your organization. 
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=plink.exe OR Processes.original_file_name=Plink
+  Processes.process IN ("*-R *", "*-L *", "*-D *", "*-l *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`| `windows_protocol_tunneling_with_plink_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+known_false_positives: False positives may be present if the organization allows for SSH tunneling outbound or internally. Filter as needed.
+references:
+  - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+  - https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html
+  - https://attack.mitre.org/techniques/T1572/
+  - https://documentation.help/PuTTY/using-cmdline-portfwd.html#S3.8.3.5
+tags:
+  analytic_story:
+  - CISA AA22-257A
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/plink/plink-windows-sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Command & Control
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to tunnel to a remote destination.
+  mitre_attack_id:
+  - T1572
+  - T1021.004
+  nist:
+  - DE.CM
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 56
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/windows_protocol_tunneling_with_plink.test.yml b/tests/endpoint/windows_protocol_tunneling_with_plink.test.yml
new file mode 100644
index 0000000000..613ffac228
--- /dev/null
+++ b/tests/endpoint/windows_protocol_tunneling_with_plink.test.yml
@@ -0,0 +1,13 @@
+name: Windows Protocol Tunneling with Plink Unit Test
+tests:
+- name: Windows Protocol Tunneling with Plink
+  file: endpoint/windows_protocol_tunneling_with_plink.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: plink-windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/plink/plink-windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true

From 5e85c0dd7cd6dd04d0b85b80f31be7ba05232a7d Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 15 Sep 2022 12:19:18 -0600
Subject: [PATCH 19/29] Windows Ingress Tool Transfer Using Explorer SSA

---
 ...s_ingress_tool_transfer_using_explorer.yml | 88 +++++++++++++++++++
 ...ress_tool_transfer_using_explorer.test.yml | 11 +++
 2 files changed, 99 insertions(+)
 create mode 100644 detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
 create mode 100644 tests/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.test.yml

diff --git a/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
new file mode 100644
index 0000000000..b89e750284
--- /dev/null
+++ b/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
@@ -0,0 +1,88 @@
+name: Windows Ingress Tool Transfer Using Explorer
+id: 9b35c538-94ef-11ec-9439-acde4800322z
+version: 1
+date: '2022-09-13'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies the Windows Explorer process with a URL within the command-line.
+  Explorer.exe is known Windows process that handles start menu, taskbar, desktop and file manager. 
+  Many adversaries abuse this process, like DCRat malware, where it attempts to open the URL with the default browser application 
+  on the target host by putting the URL as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check 
+  which user and how this process was executed, what is the parent process and what is the URL link. This technique is not commonly used to open an URL.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="explorer.exe" 
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%"))
+| NOT (like(parent_process_name, "userinit.exe") OR like(parent_process_name, "svchost.exe"))
+| eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints.
+known_false_positives: False positives may be present based on legitimate applications or third party utilities. Filter out any additional parent process names. 
+references:
+  - https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
+tags:
+  analytic_story:
+  - DarkCrystal RAT
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
+    destination to download an additional payload.
+  mitre_attack_id:
+  - T1105
+  nist:
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Process
+    role:
+    - Parent Process
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 25
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/tests/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.test.yml b/tests/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.test.yml
new file mode 100644
index 0000000000..b1c18f3e38
--- /dev/null
+++ b/tests/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.test.yml
@@ -0,0 +1,11 @@
+name: Windows Ingress Tool Transfer Using Explorer Unit Test
+tests:
+- name: Windows Ingress Tool Transfer Using Explorer
+  file: endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: T1105_explorer-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
+    update_timestamp: true
\ No newline at end of file

From 7a95a27a2c70c21bb398b973dde3f0babac32c1f Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 15 Sep 2022 12:42:34 -0600
Subject: [PATCH 20/29] ODBC

---
 ...s_ingress_tool_transfer_using_explorer.yml |  2 +-
 ...___windows_odbcconf_load_response_file.yml | 84 +++++++++++++++++++
 ...tion_compiled_html_file_decompile.test.yml |  3 +-
 ...tml_file_url_in_command_line.test copy.yml | 10 +++
 4 files changed, 96 insertions(+), 3 deletions(-)
 create mode 100644 detections/endpoint/ssa___windows_odbcconf_load_response_file.yml
 create mode 100644 tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test copy.yml

diff --git a/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
index b89e750284..dfb7da4827 100644
--- a/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
+++ b/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
@@ -1,5 +1,5 @@
 name: Windows Ingress Tool Transfer Using Explorer
-id: 9b35c538-94ef-11ec-9439-acde4800322z
+id: 695bfad6-9662-4f9e-a576-bf02a951aa60
 version: 1
 date: '2022-09-13'
 author: Michael Haag, Splunk
diff --git a/detections/endpoint/ssa___windows_odbcconf_load_response_file.yml b/detections/endpoint/ssa___windows_odbcconf_load_response_file.yml
new file mode 100644
index 0000000000..972d563a6c
--- /dev/null
+++ b/detections/endpoint/ssa___windows_odbcconf_load_response_file.yml
@@ -0,0 +1,84 @@
+name: Windows Odbcconf Load Response File
+id: 7b6c3fac-0c37-4efc-a85e-de88f42b6763
+version: 1
+date: '2022-09-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies the odbcconf.exe, Windows Open Database
+  Connectivity utility, loading up a resource file. The file extension is arbitrary
+  and may be named anything. The resource file itself may have different commands
+  supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands.
+  During triage, review file modifications and parallel processes.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="odbcconf.exe"
+  AND (like (cmd_line, "%-f %") OR like (cmd_line, "%/f %")) AND like (cmd_line, "%.rsp%") | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present and filtering may need to occur
+  based on legitimate application usage. Filter as needed.
+references:
+  - https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html
+  - https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw
+tags:
+  analytic_story:
+  - Living Off The Land
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: $process_name$ has been identified on $dest_device_id$ under user $dest_user_id$ attempting to circumvent controls.
+  mitre_attack_id:
+  - T1218.008
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
index 910f26b248..2edf7f07ae 100644
--- a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml
@@ -6,6 +6,5 @@ tests:
   attack_data:
   - file_name: 4688_windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
-    source: XmlWinEventLog
-    sourcetype: XmlWinEventLog
+    source: WinEventLog:Security
     update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test copy.yml b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test copy.yml
new file mode 100644
index 0000000000..9f67c39c8d
--- /dev/null
+++ b/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test copy.yml	
@@ -0,0 +1,10 @@
+name: Windows Odbcconf Load Response File Unit Test
+tests:
+- name: Windows Odbcconf Load Response File
+  file: endpoint/ssa___windows_odbcconf_load_response_file.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: odbcconf-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log
+    source: WinEventLog:Security
+    update_timestamp: true
\ No newline at end of file

From 81dcbae81c31a1791330a5d84551d5ab75ace99b Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 15 Sep 2022 13:02:54 -0600
Subject: [PATCH 21/29] Update ssa___windows_odbcconf_load_response_file.yml

---
 .../endpoint/ssa___windows_odbcconf_load_response_file.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___windows_odbcconf_load_response_file.yml b/detections/endpoint/ssa___windows_odbcconf_load_response_file.yml
index 972d563a6c..0e581d803b 100644
--- a/detections/endpoint/ssa___windows_odbcconf_load_response_file.yml
+++ b/detections/endpoint/ssa___windows_odbcconf_load_response_file.yml
@@ -79,6 +79,6 @@ tags:
   - dest_user_id
   - process
   - cmd_line
-  risk_score: 90
+  risk_score: 42
   security_domain: endpoint
   asset_type: Endpoint

From 0597208d3d06bb00b299031754dfbb7fa867ac96 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 15 Sep 2022 13:06:37 -0600
Subject: [PATCH 22/29] cant type

---
 ...opy.yml => ssa___windows_odbcconf_load_response_file.test.yml} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename tests/endpoint/{ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test copy.yml => ssa___windows_odbcconf_load_response_file.test.yml} (100%)

diff --git a/tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test copy.yml b/tests/endpoint/ssa___windows_odbcconf_load_response_file.test.yml
similarity index 100%
rename from tests/endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test copy.yml
rename to tests/endpoint/ssa___windows_odbcconf_load_response_file.test.yml

From 6d1734b9025c4cf8a40c5e2706f1f14d493034e9 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 15 Sep 2022 13:43:28 -0600
Subject: [PATCH 23/29] msdt

---
 ...s_execute_arbitrary_commands_with_msdt.yml | 92 +++++++++++++++++++
 ...cute_arbitrary_commands_with_msdt.test.yml | 10 ++
 2 files changed, 102 insertions(+)
 create mode 100644 detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
 create mode 100644 tests/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.test.yml

diff --git a/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
new file mode 100644
index 0000000000..e9052cce23
--- /dev/null
+++ b/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
@@ -0,0 +1,92 @@
+name: Windows Execute Arbitrary Commands with MSDT
+id: f253f9c2-10f0-4cc8-b469-f505ba8c2038
+version: 1
+date: '2022-09-15'
+author: Michael Haag, Splunk
+type: TTP
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies a recently disclosed arbitraty command
+  execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample
+  identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve
+  a remote payload. During triage, review file modifications for html. Identify parallel
+  process execution that may be related, including an Office Product.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msdt.exe"
+  AND (like (cmd_line, "%msdt%") OR like (cmd_line, "%ms-msdt:%") OR like (cmd_line, "%ms-msdt:/id%") OR like (cmd_line, "%ms-msdt:-id%") OR like (cmd_line, "%ms-msdt:/id%"))
+  AND (like (cmd_line, "%IT_BrowseForFile=%") OR like (cmd_line, "%IT_RebrowseForFile=%") OR like (cmd_line, ".xml"))
+  AND like (cmd_line, "%PCWDiagnostic%")
+  | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present, filter as needed. Added .xml
+  to potentially capture any answer file usage. Remove as needed.
+references:
+  - https://isc.sans.edu/diary/rss/28694
+  - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
+  - https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
+  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
+  - https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
+  - https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
+tags:
+  analytic_story:
+  - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log
+  impact: 100 
+  cve:
+  - CVE-2022-30190
+  kill_chain_phases:
+  - Exploitation
+  message: $process_name$ on $dest_device_id$ under user $dest_user_id$ possibly indicative of indirect command execution.
+  mitre_attack_id:
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: process_name
+    type: Process
+    role:
+    - Child Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 100
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/tests/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.test.yml b/tests/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.test.yml
new file mode 100644
index 0000000000..b7aff1a4fa
--- /dev/null
+++ b/tests/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.test.yml
@@ -0,0 +1,10 @@
+name: Windows Execute Arbitrary Commands with MSDT Unit Test
+tests:
+- name: Windows Execute Arbitrary Commands with MSDT
+  file: endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
+  pass_condition: '@count_gt(0)'
+  attack_data:
+  - file_name: msdt-windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log
+    source: WinEventLog:Security
+    update_timestamp: true
\ No newline at end of file

From 593c433ae8c473f5e4730882113483fee8488664 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 16 Sep 2022 12:47:19 -0600
Subject: [PATCH 24/29] fixes

fixes
---
 ...sa___windows_ingress_tool_transfer_using_explorer.yml | 9 +++------
 ...tart_execution_lsass_driver_registry_modification.yml | 2 +-
 ...windows_execute_arbitrary_commands_with_msdt.test.yml | 3 ++-
 .../ssa___windows_odbcconf_load_response_file.test.yml   | 3 ++-
 4 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
index dfb7da4827..4c6fb09e33 100644
--- a/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
+++ b/detections/endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
@@ -18,9 +18,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
   cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="explorer.exe" 
-  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%"))
-| NOT (like(parent_process_name, "userinit.exe") OR like(parent_process_name, "svchost.exe"))
-| eval start_time=timestamp,
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) AND NOT (like(parent_process_name, "userinit.exe") OR like(parent_process_name, "svchost.exe"))
+  | eval start_time=timestamp,
   end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
   "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
   body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
@@ -48,9 +47,7 @@ tags:
   impact: 50
   kill_chain_phases:
   - Exploitation
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote
-    destination to download an additional payload.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest_device_id$ by user $dest_user_id$ attempting to access a remote destination to download an additional payload.
   mitre_attack_id:
   - T1105
   nist:
diff --git a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml
index 129df31941..9d027b5d02 100644
--- a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml
+++ b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml
@@ -36,7 +36,7 @@ tags:
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: the registry values for DirectoryServiceExtPt or LsaDbExtPt were modified on $dest$.
+  message: The registry values for DirectoryServiceExtPt or LsaDbExtPt were modified on $dest$.
   mitre_attack_id:
   - T1547.008
   nist:
diff --git a/tests/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.test.yml b/tests/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.test.yml
index b7aff1a4fa..8dd5540c24 100644
--- a/tests/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.test.yml
+++ b/tests/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.test.yml
@@ -6,5 +6,6 @@ tests:
   attack_data:
   - file_name: msdt-windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log
-    source: WinEventLog:Security
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
     update_timestamp: true
\ No newline at end of file
diff --git a/tests/endpoint/ssa___windows_odbcconf_load_response_file.test.yml b/tests/endpoint/ssa___windows_odbcconf_load_response_file.test.yml
index 9f67c39c8d..843ce99214 100644
--- a/tests/endpoint/ssa___windows_odbcconf_load_response_file.test.yml
+++ b/tests/endpoint/ssa___windows_odbcconf_load_response_file.test.yml
@@ -6,5 +6,6 @@ tests:
   attack_data:
   - file_name: odbcconf-windows-security.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log
-    source: WinEventLog:Security
+    source: XmlWinEventLog
+    sourcetype: XmlWinEventLog
     update_timestamp: true
\ No newline at end of file

From 0e9f00f19fe1141bb1084f1da4dab2339714d262 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 16 Sep 2022 13:10:09 -0600
Subject: [PATCH 25/29] Update
 ssa___windows_execute_arbitrary_commands_with_msdt.yml

---
 ...___windows_execute_arbitrary_commands_with_msdt.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
index e9052cce23..4a45b12204 100644
--- a/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
+++ b/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
@@ -16,11 +16,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msdt.exe"
-  AND (like (cmd_line, "%msdt%") OR like (cmd_line, "%ms-msdt:%") OR like (cmd_line, "%ms-msdt:/id%") OR like (cmd_line, "%ms-msdt:-id%") OR like (cmd_line, "%ms-msdt:/id%"))
-  AND (like (cmd_line, "%IT_BrowseForFile=%") OR like (cmd_line, "%IT_RebrowseForFile=%") OR like (cmd_line, ".xml"))
-  AND like (cmd_line, "%PCWDiagnostic%")
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
+  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msdt.exe"
+  | where (like(cmd_line, "%msdt%") OR like(cmd_line, %ms-msdt:%") OR like(cmd_line, "%ms-msdt:/id%")) 
+  | where (like(cmd_line, "%it_browseforfile=%") OR like(cmd_line, "%it_rebrowseforfile=%") OR like(cmd_line, "%.xml%"))
+  | where like(cmd_line, "%pcwdiagnostic%")
   | eval start_time=timestamp, end_time=timestamp,
   entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
   "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",

From 206e8264923e540aa68d58e31f1ca506a2b21cd0 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 16 Sep 2022 13:29:25 -0600
Subject: [PATCH 26/29] Update
 ssa___windows_execute_arbitrary_commands_with_msdt.yml

---
 ...___windows_execute_arbitrary_commands_with_msdt.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
index 4a45b12204..9ab9a62874 100644
--- a/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
+++ b/detections/endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
@@ -16,11 +16,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) 
-  | where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msdt.exe"
-  | where (like(cmd_line, "%msdt%") OR like(cmd_line, %ms-msdt:%") OR like(cmd_line, "%ms-msdt:/id%")) 
-  | where (like(cmd_line, "%it_browseforfile=%") OR like(cmd_line, "%it_rebrowseforfile=%") OR like(cmd_line, "%.xml%"))
-  | where like(cmd_line, "%pcwdiagnostic%")
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msdt.exe"
+  AND (like (cmd_line, "%msdt%") OR like (cmd_line, "%ms-msdt:%") OR like (cmd_line, "%ms-msdt:/id%") OR like (cmd_line, "%ms-msdt:-id%") OR like (cmd_line, "%ms-msdt:/id%"))
+  AND (like (cmd_line, "%it_browseforfile=%") OR like (cmd_line, "%it_rebrowseforfile=%") OR like (cmd_line, "%.xml%"))
+  AND like (cmd_line, "%pcwdiagnostic%")
   | eval start_time=timestamp, end_time=timestamp,
   entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
   "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",

From 713c605097b11351d66210af54450b0bb252d965 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Fri, 16 Sep 2022 14:37:13 -0500
Subject: [PATCH 27/29] adding files into dist

---
 ...s_execute_arbitrary_commands_with_msdt.yml | 74 +++++++++++++++++
 ...s_ingress_tool_transfer_using_explorer.yml | 68 +++++++++++++++
 ...ows_lolbin_binary_in_non_standard_path.yml | 35 ++++----
 ...___windows_odbcconf_load_response_file.yml | 68 +++++++++++++++
 ...tial_dumping_with_ntdsutil_export_ntds.yml | 73 +++++++++++++++++
 ...ws_os_credential_dumping_with_procdump.yml | 70 ++++++++++++++++
 ...execution_compiled_html_file_decompile.yml | 70 ++++++++++++++++
 ...compiled_html_file_url_in_command_line.yml | 79 ++++++++++++++++++
 ...l_file_using_infotech_storage_handlers.yml | 82 +++++++++++++++++++
 ...xy_execution_msiexec_dllregisterserver.yml | 60 ++++++++++++++
 ...roxy_execution_msiexec_remote_download.yml | 60 ++++++++++++++
 ...proxy_execution_msiexec_unregister_dll.yml | 60 ++++++++++++++
 12 files changed, 781 insertions(+), 18 deletions(-)
 create mode 100644 dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml
 create mode 100644 dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml
 create mode 100644 dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml
 create mode 100644 dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
 create mode 100644 dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml
 create mode 100644 dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
 create mode 100644 dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
 create mode 100644 dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
 create mode 100644 dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
 create mode 100644 dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
 create mode 100644 dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml

diff --git a/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml
new file mode 100644
index 0000000000..ab8dbda383
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_execute_arbitrary_commands_with_msdt.yml
@@ -0,0 +1,74 @@
+name: Windows Execute Arbitrary Commands with MSDT
+id: f253f9c2-10f0-4cc8-b469-f505ba8c2038
+version: 1
+description: The following analytic identifies a recently disclosed arbitraty command
+  execution using Windows msdt.exe - a Diagnostics Troubleshooting Wizard. The sample
+  identified will use the ms-msdt:/ protocol handler to load msdt.exe to retrieve
+  a remote payload. During triage, review file modifications for html. Identify parallel
+  process execution that may be related, including an Office Product.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msdt.exe" AND
+  (like (cmd_line, "%msdt%") OR like (cmd_line, "%ms-msdt:%") OR like (cmd_line, "%ms-msdt:/id%")
+  OR like (cmd_line, "%ms-msdt:-id%") OR like (cmd_line, "%ms-msdt:/id%")) AND (like
+  (cmd_line, "%it_browseforfile=%") OR like (cmd_line, "%it_rebrowseforfile=%") OR
+  like (cmd_line, "%.xml%")) AND like (cmd_line, "%pcwdiagnostic%") | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present, filter as needed. Added .xml
+  to potentially capture any answer file usage. Remove as needed.
+references:
+- https://isc.sans.edu/diary/rss/28694
+- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
+- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A
+- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
+- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection
+- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html
+tags:
+  analytic_story:
+  - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 100
+  security_domain: endpoint
+  risk_severity: high
+  research_site_url: https://research.splunk.com/endpoint/f253f9c2-10f0-4cc8-b469-f505ba8c2038/
+test:
+  name: Windows Execute Arbitrary Commands with MSDT Unit Test
+  tests:
+  - name: Windows Execute Arbitrary Commands with MSDT
+    file: endpoint/ssa___windows_execute_arbitrary_commands_with_msdt.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: msdt-windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt-windows-security.log
+      source: XmlWinEventLog
diff --git a/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml
new file mode 100644
index 0000000000..82711dd489
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_ingress_tool_transfer_using_explorer.yml
@@ -0,0 +1,68 @@
+name: Windows Ingress Tool Transfer Using Explorer
+id: 695bfad6-9662-4f9e-a576-bf02a951aa60
+version: 1
+description: The following analytic identifies the Windows Explorer process with a
+  URL within the command-line. Explorer.exe is known Windows process that handles
+  start menu, taskbar, desktop and file manager. Many adversaries abuse this process,
+  like DCRat malware, where it attempts to open the URL with the default browser application
+  on the target host by putting the URL as a parameter on explorer.exe process. This
+  anomaly detection might be a good pivot to check which user and how this process
+  was executed, what is the parent process and what is the URL link. This technique
+  is not commonly used to open an URL.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="explorer.exe"
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) AND NOT (like(parent_process_name,
+  "userinit.exe") OR like(parent_process_name, "svchost.exe")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints.
+known_false_positives: False positives may be present based on legitimate applications
+  or third party utilities. Filter out any additional parent process names.
+references:
+- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
+tags:
+  analytic_story:
+  - DarkCrystal RAT
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1105
+  nist:
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 25
+  security_domain: endpoint
+  risk_severity: low
+  research_site_url: https://research.splunk.com/endpoint/695bfad6-9662-4f9e-a576-bf02a951aa60/
+test:
+  name: Windows Ingress Tool Transfer Using Explorer Unit Test
+  tests:
+  - name: Windows Ingress Tool Transfer Using Explorer
+    file: endpoint/ssa___windows_ingress_tool_transfer_using_explorer.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: T1105_explorer-windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/T1105_explorer-windows-security.log
+      source: XmlWinEventLog
diff --git a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
index e60a9df909..f0428a0b28 100644
--- a/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
+++ b/dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
@@ -14,24 +14,23 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
 
   $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe"
-  OR process_name="at.exe" OR process_name="atbroker.exe"
-  OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe"
-  OR process_name="certutil.exe" OR process_name="cmdkey.exe" OR process_name="cmdl32.exe"
-  OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe"
-  OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe"
-  OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR process_name="diskshadow.exe"
-  OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe"
-  OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="extexport.exe"
-  OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe"
-  OR process_name="fltmc.exe" OR process_name="forfiles.exe" OR process_name="ftp.exe"
-  OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="imewdbld.exe"
-  OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe"
-  OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe"
-  OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="msconfig.exe"
-  OR process_name="msdt.exe" OR process_name="mshta.exe" OR process_name="msiexec.exe"
-  OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe"
-  OR process_name="pcalua.exe" OR
-  process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe"
+  OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bitsadmin.exe"
+  OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe"
+  OR process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe"
+  OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="cscript.exe"
+  OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe"
+  OR process_name="diantz.exe" OR process_name="diskshadow.exe" OR process_name="dllhost.exe"
+  OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe"
+  OR process_name="expand.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe"
+  OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe"
+  OR process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe"
+  OR process_name="gpscript.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe"
+  OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe"
+  OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe"
+  OR process_name="mmc.exe" OR process_name="msconfig.exe" OR process_name="msdt.exe"
+  OR process_name="mshta.exe" OR process_name="msiexec.exe" OR process_name="netsh.exe"
+  OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="pcalua.exe"
+  OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe"
   OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe"
   OR process_name="psr.exe" OR process_name="rasautou.exe" OR process_name="reg.exe"
   OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe"
diff --git a/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml
new file mode 100644
index 0000000000..a3f28966b7
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_odbcconf_load_response_file.yml
@@ -0,0 +1,68 @@
+name: Windows Odbcconf Load Response File
+id: 7b6c3fac-0c37-4efc-a85e-de88f42b6763
+version: 1
+description: The following analytic identifies the odbcconf.exe, Windows Open Database
+  Connectivity utility, loading up a resource file. The file extension is arbitrary
+  and may be named anything. The resource file itself may have different commands
+  supported by Odbcconf to load up a DLL (REGSVR) on disk or additional commands.
+  During triage, review file modifications and parallel processes.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="odbcconf.exe"
+  AND (like (cmd_line, "%-f %") OR like (cmd_line, "%/f %")) AND like (cmd_line, "%.rsp%")
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "parent_process_name", parent_process_name, "process_path", process_path])
+  | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present and filtering may need to occur
+  based on legitimate application usage. Filter as needed.
+references:
+- https://strontic.github.io/xcyclopedia/library/odbcconf.exe-07FBA12552331355C103999806627314.html
+- https://twitter.com/redcanary/status/1541838407894171650?s=20&t=kp3WBPtfnyA3xW7D7wx0uw
+tags:
+  analytic_story:
+  - Living Off The Land
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.008
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 42
+  security_domain: endpoint
+  risk_severity: low
+  research_site_url: https://research.splunk.com/endpoint/7b6c3fac-0c37-4efc-a85e-de88f42b6763/
+test:
+  name: Windows Odbcconf Load Response File Unit Test
+  tests:
+  - name: Windows Odbcconf Load Response File
+    file: endpoint/ssa___windows_odbcconf_load_response_file.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: odbcconf-windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.008/atomic_red_team/odbcconf-windows-security.log
+      source: XmlWinEventLog
diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
new file mode 100644
index 0000000000..2ee634c347
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
@@ -0,0 +1,73 @@
+name: Windows OS Credential Dumping with Ntdsutil Export NTDS
+id: dad9ddec-a72a-47be-87b6-a0f7ba98ed6e
+version: 1
+description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory
+  database - NTDS.dit, typically used for offline password cracking. It may be used
+  in normal circumstances with no command line arguments or shorthand variations of
+  more common arguments. Ntdsutil.exe is typically seen run on a Windows Server. Typical
+  command used to dump ntds.dit \
+
+  ntdsutil "ac i ntds" "ifm" "create full C:\Temp" q q \
+
+  This technique uses "Install from Media" (IFM), which will extract a copy of the
+  Active Directory database. A successful export of the Active Directory database
+  will yield a file modification named ntds.dit to the destination.'
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="ntdsutil.exe"
+  AND (like (cmd_line, "%ntds%") AND like (cmd_line, "%create%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Highly possible Server Administrators will troubleshoot with
+  ntdsutil.exe, generating false positives.
+references:
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.003/T1003.003.md#atomic-test-3---dump-active-directory-database-with-ntdsutil
+- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753343(v=ws.11)
+- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
+- https://strontic.github.io/xcyclopedia/library/vss_ps.dll-97B15BDAE9777F454C9A6BA25E938DB3.html
+tags:
+  analytic_story:
+  - Credential Dumping
+  - HAFNIUM Group
+  - Living Off The Land
+  cis20: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1003.003
+  - T1003
+  nist: []
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 50
+  security_domain: endpoint
+  risk_severity: medium
+  research_site_url: https://research.splunk.com/endpoint/dad9ddec-a72a-47be-87b6-a0f7ba98ed6e/
+test:
+  name: Windows OS Credential Dumping with Ntdsutil Export NTDS Unit Test
+  tests:
+  - name: Windows OS Credential Dumping with Ntdsutil Export NTDS
+    file: endpoint/ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: 4688_windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/4688_windows-security.log
+      source: XmlWinEventLog
diff --git a/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml
new file mode 100644
index 0000000000..5baa10def5
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_os_credential_dumping_with_procdump.yml
@@ -0,0 +1,70 @@
+name: Windows OS Credential Dumping with Procdump
+id: e102e297-dbe6-4a19-b319-5c08f4c19a06
+version: 1
+description: 'Detect procdump.exe dumping the lsass process. This query looks for
+  both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump
+  file with all process memory. Both are highly suspect and should be reviewed. This
+  query does not monitor for the internal name (original_file_name=procdump) of the
+  PE or look for procdump64.exe. Modify the query as needed.\
+
+  During triage, confirm this is procdump.exe executing. If it is the first time a
+  Sysinternals utility has been ran, it is possible there will be a -accepteula on
+  the command line. Review other endpoint data sources for cross process (injection)
+  into lsass.exe.'
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND (process_name="procdump.exe"
+  OR process_name="procdump64.exe") AND (like (cmd_line, "%-mm %") OR like (cmd_line,
+  "%-ma %")) AND like (cmd_line, "%lsass%") | eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: None identified.
+references:
+- https://attack.mitre.org/techniques/T1003/001/
+- https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-2---dump-lsassexe-memory-using-procdump
+- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
+tags:
+  analytic_story:
+  - Credential Dumping
+  - HAFNIUM Group
+  cis20: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1003.001
+  - T1003
+  nist: []
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 80
+  security_domain: endpoint
+  risk_severity: high
+  research_site_url: https://research.splunk.com/endpoint/e102e297-dbe6-4a19-b319-5c08f4c19a06/
+test:
+  name: Windows OS Credential Dumping with Procdump Unit Test
+  tests:
+  - name: Windows OS Credential Dumping with Procdump
+    file: endpoint/ssa___windows_os_credential_dumping_with_procdump.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: procdump_windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/procdump_windows-security.log
+      source: XmlWinEventLog
diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
new file mode 100644
index 0000000000..111da21cfc
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
@@ -0,0 +1,70 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Decompile
+id: 11c32b19-05a6-48a8-ab28-18dbd9ec5d50
+version: 1
+description: The following analytic identifies the decompile parameter with the HTML
+  Help application, HH.exe. This is a uncommon command to see ran and behavior. Most
+  recently this was seen in a APT41 campaign where a CHM file was delivered and a
+  script inside used a technique for running an arbitrary command in a CHM file via
+  an ActiveX object. This unpacks an HTML help file to a specified path for launching
+  the next stage.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe" AND
+  like (cmd_line, "%-decompile%")| eval start_time=timestamp, end_time=timestamp,
+  entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
+  "dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
+  cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
+  "process_path", process_path]) | into write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives should be limited, filter as needed.
+references:
+- https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
+- https://redcanary.com/blog/introducing-atomictestharnesses/
+- https://attack.mitre.org/techniques/T1218/001/
+- https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  security_domain: endpoint
+  risk_severity: high
+  research_site_url: https://research.splunk.com/endpoint/11c32b19-05a6-48a8-ab28-18dbd9ec5d50/
+test:
+  name: Windows System Binary Proxy Execution Compiled HTML File Decompile Unit Test
+  tests:
+  - name: Windows System Binary Proxy Execution Compiled HTML File Decompile
+    file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: 4688_windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/4688_windows-security.log
+      source: WinEventLog:Security
diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
new file mode 100644
index 0000000000..fa03eca60d
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
@@ -0,0 +1,79 @@
+name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line
+id: 0fec631a-7c9b-4e4c-b28b-93260953e25f
+version: 1
+description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
+  HTML Help (CHM) file from a remote url. This particular technique will load Windows
+  script code from a compiled help file. CHM files may  contain nearly any file type
+  embedded, but only execute html/htm. Upon a successful execution, the following
+  script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode,
+  JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe
+  upon execution. The "htm" and "html" file extensions were the only extensions observed
+  to be supported for the execution of Shortcut commands or WSH script code. During
+  investigation, identify script content origination. Review reputation of remote
+  IP and domain. Some instances, it is worth decompiling the .chm file to review its
+  original contents. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe" AND
+  (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%"))| eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Although unlikely, some legitimate applications may retrieve
+  a CHM remotely, filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1218/001/
+- https://www.kb.cert.org/vuls/id/851869
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
+- https://lolbas-project.github.io/lolbas/Binaries/Hh/
+- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
+- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 90
+  security_domain: endpoint
+  risk_severity: high
+  research_site_url: https://research.splunk.com/endpoint/0fec631a-7c9b-4e4c-b28b-93260953e25f/
+test:
+  name: Windows System Binary Proxy Execution Compiled HTML File URL In Command Line
+    Unit Test
+  tests:
+  - name: Windows System Binary Proxy Execution Compiled HTML File URL In Command
+      Line
+    file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_url_in_command_line.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: chm-wineventlog-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
+      source: WinEventLog:Security
diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
new file mode 100644
index 0000000000..a00b77cc59
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
@@ -0,0 +1,82 @@
+name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage
+  Handlers
+id: ba0c2450-caea-4086-ac3a-a71e2659754b
+version: 1
+description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled
+  HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique
+  will load Windows script code from a compiled help file, using InfoTech Storage
+  Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are
+  supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm
+  file from within a CHM file. CHM files may contain nearly any file type embedded.
+  Upon a successful execution, the following script engines may be used for execution
+  - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may
+  identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm"
+  and "html" file extensions were the only extensions observed to be supported for
+  the execution of Shortcut commands or WSH script code. During investigation, identify
+  script content origination. hh.exe is natively found in C:\Windows\system32 and
+  C:\Windows\syswow64.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="hh.exe" AND
+  (like (cmd_line, "%its:%") OR like (cmd_line, "%mk:@MSITStore:%"))| eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: It is rare to see instances of InfoTech Storage Handlers being
+  used, but it does happen in some legitimate instances. Filter as needed.
+references:
+- https://attack.mitre.org/techniques/T1218/001/
+- https://www.kb.cert.org/vuls/id/851869
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.001/T1218.001.md
+- https://lolbas-project.github.io/lolbas/Binaries/Hh/
+- https://gist.github.com/mgeeky/cce31c8602a144d8f2172a73d510e0e7
+- https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/
+tags:
+  analytic_story:
+  - Suspicious Compiled HTML Activity
+  - Living Off The Land
+  cis20:
+  - CIS 8
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.001
+  - T1218
+  nist:
+  - PR.PT
+  - DE.CM
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 72
+  security_domain: endpoint
+  risk_severity: medium
+  research_site_url: https://research.splunk.com/endpoint/ba0c2450-caea-4086-ac3a-a71e2659754b/
+test:
+  name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech Storage
+    Handlers Unit Test
+  tests:
+  - name: Windows System Binary Proxy Execution Compiled HTML File Using InfoTech
+      Storage Handlers
+    file: endpoint/ssa___windows_system_binary_proxy_execution_compiled_html_using_infotech_storage_handlers.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: chm-wineventlog-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.001/atomic_red_team/chm-wineventlog-security.log
+      source: WinEventLog:Security
diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
new file mode 100644
index 0000000000..7d8c7f0b1f
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
@@ -0,0 +1,60 @@
+name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer
+id: 8d1d5570-722c-49a3-996c-2e2cceef5163
+version: 1
+description: The following analytic identifies the usage of msiexec.exe using the
+  /y switch parameter, which grants the ability for msiexec to load DLLRegisterServer.
+  Upon triage, review parent process and capture any artifacts for further review.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
+  AND (like (cmd_line, "%/y %") OR like (cmd_line, "%-y %")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: This analytic will need to be tuned for your environment based
+  on legitimate usage of msiexec.exe. Filter as needed.
+references:
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+tags:
+  analytic_story:
+  - Windows System Binary Proxy Execution MSIExec
+  cis20: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.007
+  nist: []
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  security_domain: endpoint
+  risk_severity: low
+  research_site_url: https://research.splunk.com/endpoint/8d1d5570-722c-49a3-996c-2e2cceef5163/
+test:
+  name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer Unit Test
+  tests:
+  - name: Windows System Binary Proxy Execution MSIExec DLLRegisterServer
+    file: endpoint/ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: 4688_msiexec-windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+      source: XmlWinEventLog
diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
new file mode 100644
index 0000000000..1cb8e6a1f6
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
@@ -0,0 +1,60 @@
+name: Windows System Binary Proxy Execution MSIExec Remote Download
+id: 92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5
+version: 1
+description: The following analytic identifies msiexec.exe with http in the command-line.
+  This procedure will utilize msiexec.exe to download a remote file and load it. During
+  triage, review parallel processes and capture any artifacts on disk for review.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
+  AND (like (cmd_line, "%http://%") OR like (cmd_line, "%https://%")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present, filter by destination or parent
+  process as needed.
+references:
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+tags:
+  analytic_story:
+  - Windows System Binary Proxy Execution MSIExec
+  cis20: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.007
+  nist: []
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  security_domain: endpoint
+  risk_severity: low
+  research_site_url: https://research.splunk.com/endpoint/92cbbf0f-9a6b-4e9d-8c35-cc9244a4e3d5/
+test:
+  name: Windows System Binary Proxy Execution MSIExec Remote Download Unit Test
+  tests:
+  - name: Windows System Binary Proxy Execution MSIExec Remote Download
+    file: endpoint/ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: 4688_msiexec-windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+      source: XmlWinEventLog
diff --git a/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
new file mode 100644
index 0000000000..488030cdcc
--- /dev/null
+++ b/dist/ssa/srs/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
@@ -0,0 +1,60 @@
+name: Windows System Binary Proxy Execution MSIExec Unregister DLL
+id: df76a8d1-92e1-4ec9-b8f7-695b5838703e
+version: 1
+description: The following analytic identifies the usage of msiexec.exe using the
+  /z switch parameter, which grants the ability for msiexec to unload DLLRegisterServer.
+  Upon triage, review parent process and capture any artifacts for further review.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
+  "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
+  "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
+  "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
+  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="msiexec.exe"
+  AND (like (cmd_line, "%/z %") OR like (cmd_line, "%-z %")) | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
+  "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
+  body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
+  "parent_process_name", parent_process_name, "process_path", process_path]) | into
+  write_ssa_detected_events();'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: False positives may be present, filter by destination or parent
+  process as needed.
+references:
+- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md
+tags:
+  analytic_story:
+  - Windows System Binary Proxy Execution MSIExec
+  cis20: []
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1218.007
+  nist: []
+  required_fields:
+  - _time
+  - dest_device_id
+  - process_name
+  - parent_process_name
+  - process_path
+  - dest_user_id
+  - process
+  - cmd_line
+  risk_score: 35
+  security_domain: endpoint
+  risk_severity: low
+  research_site_url: https://research.splunk.com/endpoint/df76a8d1-92e1-4ec9-b8f7-695b5838703e/
+test:
+  name: Windows System Binary Proxy Execution MSIExec Unregister DLL Unit Test
+  tests:
+  - name: Windows System Binary Proxy Execution MSIExec Unregister DLL
+    file: endpoint/ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
+    pass_condition: '@count_gt(0)'
+    attack_data:
+    - file_name: 4688_msiexec-windows-security.log
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/4688_msiexec-windows-security.log
+      source: XmlWinEventLog

From 3041fd1e9e79fd16842f7fa4ef2095cacb250602 Mon Sep 17 00:00:00 2001
From: research bot <research@splunk.com>
Date: Tue, 20 Sep 2022 15:17:35 +0000
Subject: [PATCH 28/29] updating docs and package bits [ci skip]

---
 dist/escu/app.manifest                        |    2 +-
 dist/escu/default/analyticstories.conf        |  353 +++-
 dist/escu/default/app.conf                    |    4 +-
 dist/escu/default/collections.conf            |    2 +-
 dist/escu/default/content-version.conf        |    2 +-
 dist/escu/default/es_investigations.conf      |    2 +-
 dist/escu/default/macros.conf                 |  122 +-
 dist/escu/default/savedsearches.conf          | 1499 +++++++++++++++--
 dist/escu/default/transforms.conf             |   10 +-
 dist/escu/default/workflow_actions.conf       |    2 +-
 .../lookups/privileged_azure_ad_roles.csv     |   29 +
 docs/mitre-map/coverage.json                  |  138 +-
 12 files changed, 1935 insertions(+), 230 deletions(-)
 create mode 100644 dist/escu/lookups/privileged_azure_ad_roles.csv

diff --git a/dist/escu/app.manifest b/dist/escu/app.manifest
index e1aaa25d21..f1cfd7c3bb 100644
--- a/dist/escu/app.manifest
+++ b/dist/escu/app.manifest
@@ -5,7 +5,7 @@
     "id": {
       "group": null, 
       "name": "DA-ESS-ContentUpdate", 
-      "version": "3.48.0"
+      "version": "3.49.0"
     }, 
     "author": [
       {
diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf
index c623eec4f8..4135bd7b74 100644
--- a/dist/escu/default/analyticstories.conf
+++ b/dist/escu/default/analyticstories.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-08-29T17:38:30 UTC
+# On Date: 2022-09-20T15:09:11 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -22,7 +22,7 @@ type = detection
 asset_type = Endpoint
 confidence = medium
 explanation = On May 3rd, 2022, Splunk published a security advisory for a Path traversal in search parameter that can potentiall allow SPL injection. An attacker can cause the application to load data from incorrect endpoints, urls leading to outcomes such as running arbitrary SPL queries.
-how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts.
+how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. This detection is meant for on premise environments, and if executed on internet facing servers without a WAF may produce a lot of results. This detection will not work against obfuscated path traversal requests.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1083"]}
 known_false_positives = This search may find additional path traversal exploitation attempts.
 providing_technologies = null
@@ -521,12 +521,32 @@ providing_technologies = null
 type = detection
 asset_type = Azure Active Directory
 confidence = medium
-explanation = The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge. This behavior may represent an adversary trying to authenticate with compromised credentials. In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request.
-how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents log category.
+explanation = The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge. Error Code 500121 represents a failed attempt to authenticate using a second factor. This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled. 
+how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.004", "T1621"], "nist": ["DE.CM"]}
 known_false_positives = Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake.
 providing_technologies = null
 
+[savedsearch://ESCU - Azure AD External Guest User Invited - Rule]
+type = detection
+asset_type = Azure Active Directory
+confidence = medium
+explanation = The following analytic identifies the invitation of an external guest user within Azure AD. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. External guest account invitations should be monitored by security teams as they could potentially lead to unauthorized access. An example of this attack vector was described at BlackHat 2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking Azure AD Accounts by Abusing External Identities`
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1136.003"], "nist": ["DE.CM"]}
+known_false_positives = Administrator may legitimately invite external guest users. Filter as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - Azure AD Global Administrator Role Assigned - Rule]
+type = detection
+asset_type = Azure Active Directory
+confidence = medium
+explanation = The following analytic identifies the assignment of the Azure AD Global Administrator role to an Azure AD user. The Global Administrator role is the most powerful administrator role in Azure AD and provides almost unlimited access to data, resources and settings. It is equivalent to the Domain Administrator group in an Active Directory environment. While Azure AD roles do not grant access to Azure services and resources, it is possible for a Global Administrator account to gain control of Azure resources. Adversaries and red teams alike may assign this role to a compromised account to establish Persistence in an Azure AD environment.
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1098.003"], "nist": ["DE.CM"]}
+known_false_positives = Administrators may legitimately assign the Global Administrator role to a user. Filter as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - Azure AD Multi-Factor Authentication Disabled - Rule]
 type = detection
 asset_type = Azure Active Directory
@@ -537,23 +557,93 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Ins
 known_false_positives = Legitimate use case may require for users to disable MFA. Filter as needed.
 providing_technologies = null
 
+[savedsearch://ESCU - Azure AD Multiple Failed MFA Requests For User - Rule]
+type = detection
+asset_type = Azure Active Directory
+confidence = medium
+explanation = The following analytic identifies multiple failed multi-factor authentication requests for a single user within an Azure AD tenant. Error Code 500121 represents a failed attempt to authenticate using a second factor. Specifically, the analytic triggers when more than 10 MFA user prompts fail within 10 minutes. Azure AD tenants can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls potentially resulting in the user finally accepting the authentication request. Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others.
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621", "T1078", "T1078.004"], "nist": ["DE.CM"]}
+known_false_positives = Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - Azure AD Multiple Users Failing To Authenticate From Ip - Rule]
 type = detection
 asset_type = Azure Active Directory
 confidence = medium
 explanation = The following analytic identifies one source Ip failing to authenticate with 30 unique valid users within 5 minutes. This behavior could represent an adversary performing a Password Spraying attack against an Azure Active Directory tenant to obtain initial access or elevate privileges. Error Code 50126 represents an invalid password. This logic can be used for real time security monitoring as well as threat hunting exercises.\
 Azure AD tenants can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold if needed.
-how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs. log category.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110", "T1110.003"], "nist": ["DE.CM"]}
 known_false_positives = A source Ip failing to authenticate with multiple users is not a common for legitimate behavior.
 providing_technologies = null
 
+[savedsearch://ESCU - Azure AD New Custom Domain Added - Rule]
+type = detection
+asset_type = Azure Active Directory
+confidence = medium
+explanation = The following analytic identifies the addition of a new custom domain within an Azure Active Directory tenant. Adding a custom domain is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA.
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1484", "T1484.002"], "nist": ["DE.CM"]}
+known_false_positives = In most organizations, new customm domains will be updated infrequently. Filter as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - Azure AD New Federated Domain Added - Rule]
+type = detection
+asset_type = Azure Active Directory
+confidence = medium
+explanation = The following analytic identifies the addition of a new federated domain within an Azure Active Directory tenant. This event could represent the execution of the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA.
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1484", "T1484.002"], "nist": ["DE.CM"]}
+known_false_positives = In most organizations, domain federation settings will be updated infrequently. Filter as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - Azure AD Privileged Role Assigned - Rule]
+type = detection
+asset_type = Azure Active Directory
+confidence = medium
+explanation = The following analytic identifies the assignment of sensitive and privileged Azure Active Directory roles to an Azure AD user. Adversaries and red teams alike may assign these roles to a compromised account to establish Persistence in an Azure AD environment.
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1098", "T1098.003"], "nist": ["DE.CM"]}
+known_false_positives = Administrators will legitimately assign the privileged roles users as part of administrative tasks. Filter as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - Azure AD Service Principal Created - Rule]
+type = detection
+asset_type = Azure Active Directory
+confidence = medium
+explanation = The following analytic identifies the creation of a Service Principal in an Azure AD environment. An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. Service Principal authentication does not support multi-factor authentication nor conditional access policies. Adversaries and red teams alike who have obtained administrative access may create a Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment.
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1136.003"], "nist": ["DE.CM"]}
+known_false_positives = Administrator may legitimately create Service Principal. Filter as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - Azure AD Service Principal New Client Credentials - Rule]
+type = detection
+asset_type = Azure Active Directory
+confidence = medium
+explanation = The following analytic identifies the creation of credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD. These credentials include both x509 certificates and passwords. With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules. Adversaries and red teams alike who have obtained privileged access to Azure AD may add credentials to Service Principals to maintain persistent access to victim accounts and other instances within the Azure environment.
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1098", "T1098.001"], "nist": ["DE.CM"]}
+known_false_positives = Service Principal client credential modifications may be part of legitimate administrative operations. Filter as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - Azure AD Service Principal Owner Added - Rule]
+type = detection
+asset_type = Azure Active Directory
+confidence = medium
+explanation = The following analytic identifies the addition of a new owner for a Service Principal within an Azure AD tenant. An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. Service Principal authentication does not support multi-factor authentication nor conditional access policies. Adversaries and red teams alike who have obtained administrative access may add a new owner for an existing Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment.
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1098"], "nist": ["DE.CM"]}
+known_false_positives = Administrator may legitimately add new owners for Service Principals. Filter as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - Azure AD Successful PowerShell Authentication - Rule]
 type = detection
 asset_type = Azure Active Directory
 confidence = medium
 explanation = The following analytic identifies a successful authentication event against an Azure AD tenant using PowerShell commandlets. This behavior is not common for regular, non administrative users. After compromising an account in Azure AD, attackers and red teams  alike will perform enumeration and discovery techniques. One method of executing these techniques is leveraging the native PowerShell modules.
-how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
+how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.004"], "nist": ["DE.CM"]}
 known_false_positives = Administrative users will likely use PowerShell commandlets to troubleshoot and maintain the environment. Filter as needed.
 providing_technologies = null
@@ -563,7 +653,7 @@ type = detection
 asset_type = Azure Active Directory
 confidence = medium
 explanation = The following analytic identifies a successful authentication event against Azure Active Directory for an account without Multi-Factor Authentication enabled. This could be evidence of a missconfiguration, a policy violation or an account take over attempt that should be investigated
-how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
+how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"]}
 known_false_positives = Although not recommended, certain users may be required without multi-factor authentication. Filter as needed
 providing_technologies = null
@@ -575,11 +665,61 @@ confidence = medium
 explanation = The following analytic identifies one source Ip failing to authenticate with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against an Azure Active Directory tenant to obtain initial access or elevate privileges. Error Code 50126 represents an invalid password.\
 The detection calculates the standard deviation for source Ip and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\
 While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `Azure AD Multiple Users Failing To Authenticate From Ip`.
-how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
+how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110", "T1110.003"], "nist": ["DE.CM"]}
 known_false_positives = A source Ip failing to authenticate with multiple users is not a common for legitimate behavior.
 providing_technologies = null
 
+[savedsearch://ESCU - Azure AD User Enabled And Password Reset - Rule]
+type = detection
+asset_type = Azure Active Directory
+confidence = medium
+explanation = The following analytic identifies an Azure AD user enabling a previously disabled account and resetting its password within 2 minutes. This behavior could represent an adversary who has obtained administrative access and is trying to establish a backdoor identity within an Azure AD tenant.
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1098"], "nist": ["DE.CM"]}
+known_false_positives = While not common, Administrators may enable accounts and reset their passwords for legitimate reasons. Filter as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - Azure AD User ImmutableId Attribute Updated - Rule]
+type = detection
+asset_type = Azure Active Directory
+confidence = medium
+explanation = The following analytic identifies the modification of the SourceAnchor (also called ImmutableId) attribute for an Azure Active Directory user. Updating this attribute is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA.
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1098"], "nist": ["DE.CM"]}
+known_false_positives = The SourceAnchor (also called ImmutableId) Azure AD attribute has legitimate uses for directory synchronization. Investigate and filter as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - Azure Automation Account Created - Rule]
+type = detection
+asset_type = Azure
+confidence = medium
+explanation = The following analytic identifies the creation of a new Azure Automation account within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure using PowerShell and Python. Azure Automation can also be configured to automate tasks on on premise infrastructure using a component called a Hybrid Runbook Worker. Automation accounts serve as a container to isolate Automation resources, runbooks, assets, and configurations from the resources of other accounts. They allow administrators to separate resources into logical environments or delegated responsibilities. Adversaries or red teams who have obtained privileged access to an Azure tenant may create an Azure Automation account with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc.
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. Specifically, this analytic leverages the Azure Activity log category.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1136", "T1136.003"], "nist": ["DE.CM"]}
+known_false_positives = Administrators may legitimately create Azure Automation accounts. Filter as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - Azure Automation Runbook Created - Rule]
+type = detection
+asset_type = Azure
+confidence = medium
+explanation = The following analytic identifies the creation of a new Azure Automation Runbook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python. Adversaries or red teams who have obtained privileged access to an Azure tenant may create an Azure Automation Runbook that runs with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc.
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. Specifically, this analytic leverages the Azure Activity log category.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1136", "T1136.003"], "nist": ["DE.CM"]}
+known_false_positives = Administrators may legitimately create Azure Automation Runbooks. Filter as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - Azure Runbook Webhook Created - Rule]
+type = detection
+asset_type = Azure
+confidence = medium
+explanation = The following analytic identifies the creation of a new Automation Runbook Webhook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python. One of the ways administrators can configure a Runbook to be executed is through HTTP Webhooks. Webhooks leverage custom unauthenticated URLs that are exposed to the Internet. An adversary who has obtained privileged access to an Azure tenant may create a Webhook to trigger the execution of an Automation Runbook with malicious code that can create users or execute code on a VM. This provides a persistent foothold on the environment.
+how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. Specifically, this analytic leverages the Azure Activity log category.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.004"], "nist": ["DE.CM"]}
+known_false_positives = Administrators may legitimately create Azure Runbook Webhooks. Filter as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - Circle CI Disable Security Job - Rule]
 type = detection
 asset_type = CircleCI
@@ -4181,7 +4321,7 @@ providing_technologies = ["Microsoft Windows"]
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = This analytics are designed to indentify a high frequency of process termination on a machine which is a common behavior of ransomware malware before encrypting files. This technique is designed to avoid an exception error while accessing (docs, images, database and etc..) in the infected machine for encryption.
+explanation = This analytic is designed to identify a high frequency of process termination events on a computer in a short period of time, which is a common behavior of ransomware malware before encrypting files. This technique is designed to avoid an exception error while accessing (docs, images, database and etc..) in the infected machine for encryption.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the Image (process full path of terminated process) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1486"]}
 known_false_positives = admin or user tool that can terminate multiple process.
@@ -7619,6 +7759,36 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]}
 known_false_positives = False positives should be limited, however filtering may be required.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows Access Token Manipulation SeDebugPrivilege - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a suspicious process enabling the "SeDebugPrivilege" privilege token. SeDebugPrivilege allows a process to inspect and adjust the memory of other processes, and has long been a security concern. SeDebugPrivilege allows the token bearer to access any process or thread, regardless of security descriptors, per Palantir. This technique is abused by adversaries to gain debug privileges with their malicious software to be able to access or debug a process to dump credentials or to inject malicious code.
+how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4703 EventCode enabled. The Windows TA is also required.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134.002", "T1134"], "nist": ["DE.CM"]}
+known_false_positives = Some native binaries and browser applications may request SeDebugPrivilege. Filter as needed.
+providing_technologies = ["Microsoft Windows"]
+
+[savedsearch://ESCU - Windows Access Token Manipulation Winlogon Duplicate Token Handle - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a process requesting access to winlogon.exe attempting to duplicate its handle. This technique was seen in several adversaries to gain privileges for their process. Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens.
+how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134.001", "T1134"], "nist": ["DE.CM"]}
+known_false_positives = It is possible legitimate applications will request access to winlogon, filter as needed.
+providing_technologies = null
+
+[savedsearch://ESCU - Windows Access Token Winlogon Duplicate Handle In Uncommon Path - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a process requesting access in winlogon.exe to duplicate its handle with a non-common or public process source path. This technique was seen where adversaries attempt to gain privileges to their process. This duplicate handle access technique, may refer to a malicious process duplicating the process token of winlogon.exe and using it to a new process instance. Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens.
+how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134.001", "T1134"], "nist": ["DE.CM"]}
+known_false_positives = It is possible legitimate applications will request access to winlogon, filter as needed.
+providing_technologies = null
+
 [savedsearch://ESCU - Windows AdFind Exe - Rule]
 type = detection
 asset_type = Endpoint
@@ -7745,6 +7915,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]}
 known_false_positives = False positives may be limited to source control applications and may be required to be filtered out.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows Defacement Modify Transcodedwallpaper File - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a modification to the Transcodedwallpaper file in the wallpaper theme directory to change the wallpaper of the host machine. This technique was seen in adversaries attempting to deface or change the desktop wallpaper of the targeted host. During our testing, the common process that affects or changes the wallpaper if a user changes it via desktop personalized setting is explorer.exe.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"], "nist": ["DE.CM"]}
+known_false_positives = 3rd part software application can change the wallpaper. Filter is needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Defender Exclusion Registry Entry - Rule]
 type = detection
 asset_type = Endpoint
@@ -7968,6 +8148,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Acti
 known_false_positives = It is possible that these logs may be legitimately cleared by Administrators. Filter as needed.
 providing_technologies = ["Microsoft Windows"]
 
+[savedsearch://ESCU - Windows Event Triggered Image File Execution Options Injection - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following hunting analytic identifies EventCode 3000 in Application channel indicating a process exit. This behavior is based on process names being added to the Image File Execution Options under HKLM \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ and \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit. Once these are set for a process, an eventcode 3000 will generate. The example used is from Thinkst Canary where a CanaryToken is setup to monitor for a commonly abused living off the land binary (ex. Klist.exe) and generate an event when it occurs. This can be seen as settings traps to monitor for suspicious behavior. Monitor and tune this hunting analytic and setup traps across your organization and begin monitoring.
+how_to_implement = This analytic requires capturing the Windows Event Log Application channel in XML.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1546.012"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present and tuning will be required before turning into a TTP or notable.
+providing_technologies = null
+
 [savedsearch://ESCU - Windows Excessive Disabled Services Event - Rule]
 type = detection
 asset_type = Endpoint
@@ -8008,6 +8198,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Rec
 known_false_positives = Administrators may execute this powershell command to get hardware information related to camera.
 providing_technologies = ["Microsoft Windows"]
 
+[savedsearch://ESCU - Windows Gather Victim Identity SAM Info - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a process that loads the samlib.dll module. This module is being abused by adversaries, threat actors and red teamers to access information of SAM objects or access credentials information in DC. This hunting query can be a good indicator that a process is capable of accessing the SAM object.
+how_to_implement = The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1589.001", "T1589"], "nist": ["DE.CM"]}
+known_false_positives = this module can be loaded by a third party application. Filter is needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Gather Victim Network Info Through Ip Check Web Services - Rule]
 type = detection
 asset_type = Endpoint
@@ -8058,6 +8258,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"]}
 known_false_positives = user may delete bunch of pictures or files in a folder.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows Hijack Execution Flow Version Dll Side Load - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = This analytic is to detect a process loading version.dll that is not in %windir%\\system32 or %windir%\\syswow64 dir path. This event is seen in ransomware and APT malware that executes malicious version.dll placed in the same folder of onedrive application that will execute that module. This technique is known to be DLL side loading. This technique was used to execute an agent of Brute Ratel C4 red teaming tools to serve as remote admin tool to collect and compromise target host.
+how_to_implement = The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.001", "T1574"], "nist": ["DE.CM"]}
+known_false_positives = unknown
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Hunting System Account Targeting Lsass - Rule]
 type = detection
 asset_type = Endpoint
@@ -8072,7 +8282,7 @@ providing_technologies = null
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings). To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL in the property to limit the scope of this query to similar handlers as ms-msdt.
+explanation = The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings). To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]}
 known_false_positives = False positives will be found. https and http is a URL Protocol handler that will trigger this analytic. Tune based on process or command-line.
@@ -8152,10 +8362,20 @@ providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response"
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = The following analytic detects an explorer.exe with a possible url link process command line on it. Explorer.exe is known windows process that handle start menu, taskbar ,desktop and file manager. So many threat actor abuses this process like DCRat malware, where it tries to open the url link with the default process browser application in the target host by putting the url link as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check which user and how this process was executed, what is the parent process and what is the url link. This technique is not so common way to open an url link.
+explanation = The following analytic identifies the Windows Explorer process with a URL within the command-line. Explorer.exe is known Windows process that handles start menu, taskbar, desktop and file manager. Many adversaries abuse this process, like DCRat malware, where it attempts to open the URL with the default browser application on the target host by putting the URL as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check which user and how this process was executed, what is the parent process and what is the URL link. This technique is not commonly used to open an URL.
 how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "nist": ["DE.CM"]}
-known_false_positives = unknown
+known_false_positives = False positives may be present based on legitimate applications or third party utilities. Filter out any additional parent process names.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
+[savedsearch://ESCU - Windows Input Capture Using Credential UI Dll - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a process that loads the credui.dll module. This legitimate module is typically abused by adversaries, threat actors and red teamers to create a credential UI prompt dialog box to lure users for possible credential theft or can be used to dump the credentials of a targeted host. This hunting query is a good pivot to check why the process loaded this dll and if it is a legitimate file. This hunting query may hit false positive for a third party application that uses a credential login UI for user login.
+how_to_implement = The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1056.002", "T1056"], "nist": ["DE.CM"]}
+known_false_positives = this module can be loaded by a third party application. Filter is needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
 [savedsearch://ESCU - Windows InstallUtil Credential Theft - Rule]
@@ -8498,6 +8718,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = False positives should be limited, however filter as needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows Phishing Recent ISO Exec Registry - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following hunting analytic identifies registry artifacts when an ISO container is opened, clicked or mounted on the Windows operating system. As Microsoft makes changes to macro based document execution, adversaries have begun to utilize container based initial access based phishing campaigns to evade preventative controls. Once the ISO is clicked or mounted it will create a registry artifact related to this event as a recent application executed or opened.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001", "T1566"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be high depending on the environment and consistent use of ISOs. Restrict to servers, or filter out based on commonly used ISO names. Filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Possible Credential Dumping - Rule]
 type = detection
 asset_type = Endpoint
@@ -8562,6 +8792,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Rec
 known_false_positives = Administrators or power users may leverage PowerView for system management or troubleshooting.
 providing_technologies = ["Microsoft Windows"]
 
+[savedsearch://ESCU - Windows Process Injection With Public Source Path - Rule]
+type = detection
+asset_type = 80
+confidence = medium
+explanation = The following analytic identifies a process in a non-standard file path on Windows attempting to create a remote thread into a process. This Windows API,CreateRemoteThread, is commonly used by adversaries for process injection to evade detections or gain privilege escalation.
+how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1055.002"], "nist": ["DE.CM"]}
+known_false_positives = Some security products or third party applications may utilize CreateRemoteThread, filter as needed before enabling as a notable.
+providing_technologies = null
+
 [savedsearch://ESCU - Windows Process With NamedPipe CommandLine - Rule]
 type = detection
 asset_type = Endpoint
@@ -8582,6 +8822,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = False positives are possible if legitimate applications are allowed to terminate this process during testing or updates. Filter as needed based on paths that are used legitimately.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows Protocol Tunneling with Plink - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies the use of Plink being utilized to proxy egress or laterally in an organization. The analytic is limited to specific Plink options on the command-line, including -R -L and -D which will have the remote and local IP address or port and -l for a username. Modify the options as seen fit for your organization.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1572", "T1021.004"], "nist": ["DE.CM"]}
+known_false_positives = False positives may be present if the organization allows for SSH tunneling outbound or internally. Filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Raccine Scheduled Task Deletion - Rule]
 type = detection
 asset_type = Endpoint
@@ -8652,6 +8902,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.00
 known_false_positives = updated windows application needed in safe boot may used this registry
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows Remote Access Software BRC4 Loaded Dll - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following anomaly detection identifies the behavior related to 4 native Windows DLLs being loaded by a non-standard process. Identified by MDSec during their research into Brute Ratel, MDSec identified a high signal analytic by calling out these 4 DLLs being loaded into a process. LogonCLI.dll is the Net Logon Client DLL and is related to users and other domain services to get authenticated. Credui.dll is Credential Manager User Interface. Credential managers receive notifications when authentication information changes. For example, credential managers are notified when a user logs on or an account password changes. Samcli.dll is the Security Accounts Manager Client DLL. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. Dbghelp.dll is Windows Image Helper. Windows Image Helper is commonly seen in credential dumping due to native functions. All of these modules are important to monitor and track and combined may lead to credentail access or dumping.
+how_to_implement = The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1219", "T1003"], "nist": ["DE.CM"]}
+known_false_positives = This module can be loaded by a third party application. Filter is needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Remote Access Software Hunt - Rule]
 type = detection
 asset_type = Endpoint
@@ -8762,11 +9022,11 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Ins
 known_false_positives = False positives may be present based on common applications adding new drivers, however, filter as needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
-[savedsearch://ESCU - Windows Service Created With Suspicious Service Path - Rule]
+[savedsearch://ESCU - Windows Service Created with Suspicious Service Path - Rule]
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = The following analytc uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path path is located in a non-common Service folder in Windows. Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution as well as persistence and execution. The Clop ransomware has also been seen in the wild abusing Windows services.
+explanation = The following analytics uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path path is located in a non-common Service folder in Windows. Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution as well as persistence and execution. The Clop ransomware has also been seen in the wild abusing Windows services.
 how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
 annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569", "T1569.002"]}
 known_false_positives = Legitimate applications may install services with uncommon services paths.
@@ -8802,6 +9062,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = Third party tools may used this technique to create services but not so common.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows Service Deletion In Registry - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies a service being deleted from the Windows Registry under CurrentControlSet\Services. Adversaries may delete a service as part of defense evasion.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "nist": ["DE.CM"]}
+known_false_positives = This event can be seen when administrator delete a service or uninstall/reinstall a software that creates service entry, but it is still recommended to check this alert with high priority.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows Service Initiation on Remote Endpoint - Rule]
 type = detection
 asset_type = Endpoint
@@ -8822,6 +9092,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp
 known_false_positives = It is possible administrative scripts may start/stop/delete services. Filter as needed.
 providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 
+[savedsearch://ESCU - Windows System Binary Proxy Execution Compiled HTML File Decompile - Rule]
+type = detection
+asset_type = Endpoint
+confidence = medium
+explanation = The following analytic identifies the decompile parameter with the HTML Help application, HH.exe. This is a uncommon command to see ran and behavior. Most recently this was seen in a APT41 campaign where a CHM file was delivered and a script inside used a technique for running an arbitrary command in a CHM file via an ActiveX object. This unpacks an HTML help file to a specified path for launching the next stage.
+how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1218.001", "T1218"], "nist": ["DE.CM"]}
+known_false_positives = False positives should be limited, filter as needed.
+providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+
 [savedsearch://ESCU - Windows System File on Disk - Rule]
 type = detection
 asset_type = Endpoint
@@ -10378,7 +10658,7 @@ version = 3
 references = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html", "http://www.irongeek.com/i.php?page=videos/derbycon7/t405-hunting-lateral-movement-for-fun-and-profit-mauricio-velazco"]
 maintainers = [{"company": "Mauricio Velazco Splunk", "email": "-", "name": "David Dorsey"}]
 spec_version = 3
-searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Interactive Session on Remote Endpoint with PowerShell - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and Winrs - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell Script Block - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Short Lived Scheduled Task - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Windows Service Created With Suspicious Service Path - Rule", "ESCU - Windows Service Created Within Public Path - Rule", "ESCU - Windows Service Creation on Remote Endpoint - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - Windows Service Initiation on Remote Endpoint - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Wmiprsve LOLBAS Execution Process Spawn - Rule", "ESCU - Wsmprovhost LOLBAS Execution Process Spawn - Rule", "ESCU - Randomly Generated Scheduled Task Name - Rule", "ESCU - Randomly Generated Windows Service Name - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Unusual Number of Computer Service Tickets Requested - Rule", "ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"]
+searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Executable File Written in Administrative SMB Share - Rule", "ESCU - Impacket Lateral Movement Commandline Parameters - Rule", "ESCU - Interactive Session on Remote Endpoint with PowerShell - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell - Rule", "ESCU - Remote Process Instantiation via DCOM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell - Rule", "ESCU - Remote Process Instantiation via WinRM and PowerShell Script Block - Rule", "ESCU - Remote Process Instantiation via WinRM and Winrs - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell - Rule", "ESCU - Remote Process Instantiation via WMI and PowerShell Script Block - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Short Lived Scheduled Task - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Windows Service Created with Suspicious Service Path - Rule", "ESCU - Windows Service Created Within Public Path - Rule", "ESCU - Windows Service Creation on Remote Endpoint - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - Windows Service Initiation on Remote Endpoint - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Wmiprsve LOLBAS Execution Process Spawn - Rule", "ESCU - Wsmprovhost LOLBAS Execution Process Spawn - Rule", "ESCU - Randomly Generated Scheduled Task Name - Rule", "ESCU - Randomly Generated Windows Service Name - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Unusual Number of Computer Service Tickets Requested - Rule", "ESCU - Unusual Number of Remote Endpoint Authentication Events - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"]
 description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within an Active Directory environment. Since lateral movement is often a necessary step in a breach, it is important for cyber defenders to deploy detection coverage.
 narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\
 Indications of lateral movement in an Active Directory network can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, Service Control Manager, the DCOM protocol, WinRM or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or "crown jewels" to a persistent threat actor.\
@@ -10546,10 +10826,21 @@ version = 2
 references = ["https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis", "https://azure.microsoft.com/en-us/services/active-directory/#overview", "https://attack.mitre.org/techniques/T1586/", "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad", "https://www.imperva.com/learn/application-security/account-takeover-ato/", "https://www.varonis.com/blog/azure-active-directory", "https://www.barracuda.com/glossary/account-takeover"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}]
 spec_version = 3
-searches = ["ESCU - Azure Active Directory High Risk Sign-in - Rule", "ESCU - Azure AD Authentication Failed During MFA Challenge - Rule", "ESCU - Azure AD Multi-Factor Authentication Disabled - Rule", "ESCU - Azure AD Multiple Users Failing To Authenticate From Ip - Rule", "ESCU - Azure AD Successful PowerShell Authentication - Rule", "ESCU - Azure AD Successful Single-Factor Authentication - Rule", "ESCU - Azure AD Unusual Number of Failed Authentications From Ip - Rule"]
+searches = ["ESCU - Azure Active Directory High Risk Sign-in - Rule", "ESCU - Azure AD Authentication Failed During MFA Challenge - Rule", "ESCU - Azure AD Multi-Factor Authentication Disabled - Rule", "ESCU - Azure AD Multiple Failed MFA Requests For User - Rule", "ESCU - Azure AD Multiple Users Failing To Authenticate From Ip - Rule", "ESCU - Azure AD Successful PowerShell Authentication - Rule", "ESCU - Azure AD Successful Single-Factor Authentication - Rule", "ESCU - Azure AD Unusual Number of Failed Authentications From Ip - Rule"]
 description = Monitor for activities and techniques associated with Account Takover attacks against Azure Active Directory tenants.
 narrative = Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\ Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization.\ This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.
 
+[analytic_story://Azure Active Directory Persistence]
+category = Cloud Security
+last_updated = 2022-08-17
+version = 1
+references = ["https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis", "https://azure.microsoft.com/en-us/services/active-directory/#overview", "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-compare-azure-ad-to-ad", "https://attack.mitre.org/tactics/TA0003/", "https://microsoft.github.io/Azure-Threat-Research-Matrix/Persistence/Persistence/"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}]
+spec_version = 3
+searches = ["ESCU - Azure AD External Guest User Invited - Rule", "ESCU - Azure AD Global Administrator Role Assigned - Rule", "ESCU - Azure AD New Custom Domain Added - Rule", "ESCU - Azure AD New Federated Domain Added - Rule", "ESCU - Azure AD Privileged Role Assigned - Rule", "ESCU - Azure AD Service Principal Created - Rule", "ESCU - Azure AD Service Principal New Client Credentials - Rule", "ESCU - Azure AD Service Principal Owner Added - Rule", "ESCU - Azure AD User Enabled And Password Reset - Rule", "ESCU - Azure AD User ImmutableId Attribute Updated - Rule", "ESCU - Azure Automation Account Created - Rule", "ESCU - Azure Automation Runbook Created - Rule", "ESCU - Azure Runbook Webhook Created - Rule"]
+description = Monitor for activities and techniques associated with the execution of Persistence techniques against Azure Active Directory tenants.
+narrative = Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day.\ Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. This analytic storic groups detections that can help security operations teams identify the potential execution of Persistence techniques targeting Azure Active Directory tenants. 
+
 [analytic_story://Baron Samedit CVE-2021-3156]
 category = Adversary Tactics
 last_updated = 2021-01-27
@@ -10585,6 +10876,17 @@ narrative = While you can educate your users and customers about the risks and t
 You can use our adaptation of `DNSTwist`, together with the support searches in this Analytic Story, to generate permutations of specified brands and external domains. Splunk can monitor email, DNS requests, and web traffic for these permutations and provide you with early warnings and situational awareness--powerful elements of an effective defense.\
 Notable events will include IP addresses, URLs, and user data. Drilling down can provide you with even more actionable intelligence, including likely geographic information, contextual searches to help you scope the problem, and investigative searches.
 
+[analytic_story://Brute Ratel C4]
+category = Data Destruction
+last_updated = 2022-08-23
+version = 1
+references = ["https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/", "https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Teoderick Contreras"}]
+spec_version = 3
+searches = ["ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - Windows Access Token Manipulation SeDebugPrivilege - Rule", "ESCU - Windows Access Token Manipulation Winlogon Duplicate Token Handle - Rule", "ESCU - Windows Access Token Winlogon Duplicate Handle In Uncommon Path - Rule", "ESCU - Windows Defacement Modify Transcodedwallpaper File - Rule", "ESCU - Windows Gather Victim Identity SAM Info - Rule", "ESCU - Windows Hijack Execution Flow Version Dll Side Load - Rule", "ESCU - Windows Input Capture Using Credential UI Dll - Rule", "ESCU - Windows ISO LNK File Creation - Rule", "ESCU - Windows Phishing Recent ISO Exec Registry - Rule", "ESCU - Windows Process Injection With Public Source Path - Rule", "ESCU - Windows Remote Access Software BRC4 Loaded Dll - Rule", "ESCU - Windows Service Created with Suspicious Service Path - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - Windows Service Deletion In Registry - Rule"]
+description = Leverage searches that allow you to detect and investigate unusual activities that may be related to Brute Ratel Red Teaming tool. This includes creation, modification and deletion of services, collection or data, ping IP, DNS cache, process injection, debug privileges adjustment, winlogon process duplicate token, lock workstation, get clipboard or screenshot and much more.
+narrative = Brute RATEL BRC4 is the latest red-teaming tool that simulate several TTP's. It uses several techniques like syscall, patching ETW/AMSI and written in native C to minimize noise in process command-line. This tool was seen in the wild being abused by some ransomware (blackcat) and adversaries in their campaigns to install the BRC4 agent that can serve as remote admin tool to compromise the target host or network.
+
 [analytic_story://Caddy Wiper]
 category = Data Destruction
 last_updated = 2022-03-25
@@ -10596,6 +10898,17 @@ searches = ["ESCU - Windows Raw Access To Disk Volume Partition - Rule", "ESCU -
 description = Caddy Wiper is a destructive payload that detects if its running on a Domain Controller and executes killswitch if detected. If not in a DC it destroys Users and subsequent mapped drives. This wiper also destroys drive partitions inculding boot partitions.
 narrative = Caddy Wiper is destructive malware operation found by ESET multiple organizations in Ukraine. This malicious payload destroys user files, avoids executing on Dnomain Controllers and destroys boot and drive partitions.
 
+[analytic_story://CISA AA22-257A]
+category = Adversary Tactics
+last_updated = 2022-09-15
+version = 1
+references = ["https://www.cisa.gov/uscert/ncas/alerts/aa21-321a", "https://www.cisa.gov/uscert/ncas/alerts/aa22-257a", "https://www.ic3.gov/Media/News/2021/210527.pdf", "https://www.us-cert.gov/sites/default/files/AA22-257A.stix.xml", "https://www.us-cert.cisa.gov/iran"]
+maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
+spec_version = 3
+searches = ["ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Create local admin accounts using net exe - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Detect Exchange Web Shell - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Extraction of Registry Hives - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks Run Task On Demand - Rule", "ESCU - Short Lived Scheduled Task - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Windows Hidden Schedule Task Settings - Rule", "ESCU - Windows Possible Credential Dumping - Rule", "ESCU - Windows Protocol Tunneling with Plink - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Randomly Generated Scheduled Task Name - Rule", "ESCU - Log4Shell JNDI Payload Injection Attempt - Rule"]
+description = The Iranian government-sponsored APT actors are actively targeting a broad range of victims across multiple U.S. critical infrastructure sectors, including the Transportation Sector and the Healthcare and Public Health Sector, as well as Australian organizations.
+narrative = This advisory updates joint CSA Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities, which provides information on these Iranian government-sponsored APT actors exploiting known Fortinet and Microsoft Exchange vulnerabilities to gain initial access to a broad range of targeted entities in furtherance of malicious activities, including ransom operations. The authoring agencies now judge these actors are an APT group affiliated with the IRGC. Since the initial reporting of this activity in the FBI Liaison Alert System (FLASH) report APT Actors Exploiting Fortinet Vulnerabilities to Gain Access for Malicious Activity from May 2021, the authoring agencies have continued to observe these IRGC-affiliated actors exploiting known vulnerabilities for initial access. In addition to exploiting Fortinet and Microsoft Exchange vulnerabilities, the authoring agencies have observed these APT actors exploiting VMware Horizon Log4j vulnerabilities for initial access. The IRGC-affiliated actors have used this access for follow-on activity, including disk encryption and data extortion, to support ransom operations. The IRGC-affiliated actors are actively targeting a broad range of entities, including entities across multiple U.S. critical infrastructure sectors as well as Australian, Canadian, and United Kingdom organizations. These actors often operate under the auspices of Najee Technology Hooshmand Fater LLC, based in Karaj, Iran, and Afkar System Yazd Company, based in Yazd, Iran. The authoring agencies assess the actors are exploiting known vulnerabilities on unprotected networks rather than targeting specific targeted entities or sectors. This advisory provides observed tactics, techniques, and indicators of compromise (IOCs) that the authoring agencies assess are likely associated with this IRGC-affiliated APT. The authoring agencies urge organizations, especially critical infrastructure organizations, to apply the recommendations listed in the Mitigations section of this advisory to mitigate risk of compromise from these IRGC-affiliated cyber actors.
+
 [analytic_story://Cloud Cryptomining]
 category = Cloud Security
 last_updated = 2019-10-02
@@ -11274,7 +11587,7 @@ version = 2
 references = ["https://lolbas-project.github.io/"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}]
 spec_version = 3
-searches = ["ESCU - BITS Job Persistence - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - CertUtil With Decode Argument - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Control Loading from World Writable Directory - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regsvcs with Network Connection - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Living Off The Land - Rule", "ESCU - MacOS LOLbin - Rule", "ESCU - MacOS plutil - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Rundll32 Shimcache Flush - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious microsoft workflow compiler usage - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Windows Binary Proxy Execution Mavinject DLL Injection - Rule", "ESCU - Windows Diskshadow Proxy Execution - Rule", "ESCU - Windows DLL Search Order Hijacking Hunt - Rule", "ESCU - Windows DLL Search Order Hijacking Hunt with Sysmon - Rule", "ESCU - Windows DLL Search Order Hijacking with iscsicpl - Rule", "ESCU - Windows Identify Protocol Handlers - Rule", "ESCU - Windows Indirect Command Execution Via forfiles - Rule", "ESCU - Windows Indirect Command Execution Via pcalua - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows InstallUtil Remote Network Connection - Rule", "ESCU - Windows InstallUtil Uninstall Option - Rule", "ESCU - Windows InstallUtil Uninstall Option with Network - Rule", "ESCU - Windows InstallUtil URL in Command Line - Rule", "ESCU - Windows MOF Event Triggered Execution via WMI - Rule", "ESCU - Windows Odbcconf Hunting - Rule", "ESCU - Windows Odbcconf Load DLL - Rule", "ESCU - Windows Odbcconf Load Response File - Rule", "ESCU - WSReset UAC Bypass - Rule"]
+searches = ["ESCU - BITS Job Persistence - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - CertUtil With Decode Argument - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Control Loading from World Writable Directory - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regsvcs with Network Connection - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Living Off The Land - Rule", "ESCU - MacOS LOLbin - Rule", "ESCU - MacOS plutil - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Rundll32 Shimcache Flush - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious microsoft workflow compiler usage - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Windows Binary Proxy Execution Mavinject DLL Injection - Rule", "ESCU - Windows Diskshadow Proxy Execution - Rule", "ESCU - Windows DLL Search Order Hijacking Hunt - Rule", "ESCU - Windows DLL Search Order Hijacking Hunt with Sysmon - Rule", "ESCU - Windows DLL Search Order Hijacking with iscsicpl - Rule", "ESCU - Windows Identify Protocol Handlers - Rule", "ESCU - Windows Indirect Command Execution Via forfiles - Rule", "ESCU - Windows Indirect Command Execution Via pcalua - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows InstallUtil Remote Network Connection - Rule", "ESCU - Windows InstallUtil Uninstall Option - Rule", "ESCU - Windows InstallUtil Uninstall Option with Network - Rule", "ESCU - Windows InstallUtil URL in Command Line - Rule", "ESCU - Windows MOF Event Triggered Execution via WMI - Rule", "ESCU - Windows Odbcconf Hunting - Rule", "ESCU - Windows Odbcconf Load DLL - Rule", "ESCU - Windows Odbcconf Load Response File - Rule", "ESCU - Windows System Binary Proxy Execution Compiled HTML File Decompile - Rule", "ESCU - WSReset UAC Bypass - Rule"]
 description = Leverage analytics that allow you to identify the presence of an adversary leveraging native applications within your environment.
 narrative = Living Off The Land refers to an adversary methodology of using native applications already installed on the target operating system to achieve their objective. Native utilities provide the adversary with reduced chances of detection by antivirus software or EDR tools. This allows the adversary to blend in with native process behavior.
 
@@ -11559,7 +11872,7 @@ version = 1
 references = ["https://www.hhs.gov/sites/default/files/analyst-note-cl0p-tlp-white.pdf", "https://securityaffairs.co/wordpress/115250/data-breach/qualys-clop-ransomware.html", "https://www.darkreading.com/attacks-breaches/qualys-is-the-latest-victim-of-accellion-data-breach/d/d-id/1340323"]
 maintainers = [{"company": "Teoderick Contreras, Splunk", "email": "-", "name": "Rod Soto"}]
 spec_version = 3
-searches = ["ESCU - Clop Common Exec Parameter - Rule", "ESCU - Clop Ransomware Known Service Name - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - High Process Termination Frequency - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - Resize ShadowStorage volume - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows High File Deletion Frequency - Rule", "ESCU - Windows Service Created With Suspicious Service Path - Rule"]
+searches = ["ESCU - Clop Common Exec Parameter - Rule", "ESCU - Clop Ransomware Known Service Name - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - High Process Termination Frequency - Rule", "ESCU - Process Deleting Its Process File Path - Rule", "ESCU - Ransomware Notes bulk creation - Rule", "ESCU - Resize ShadowStorage volume - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows High File Deletion Frequency - Rule", "ESCU - Windows Service Created with Suspicious Service Path - Rule"]
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Clop ransomware, including looking for file writes associated with Clope, encrypting network shares, deleting and resizing shadow volume storage, registry key modification, deleting of security logs, and more.
 narrative = Clop ransomware campaigns targeting healthcare and other vertical sectors, involve the use of ransomware payloads along with exfiltration of data per HHS bulletin. Malicious actors demand payment for ransome of data and threaten deletion and exposure of exfiltrated data.
 
@@ -11833,7 +12146,7 @@ version = 1
 references = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://attack.mitre.org/techniques/T1218/001/", "https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}]
 spec_version = 3
-searches = ["ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule"]
+searches = ["ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule", "ESCU - Windows System Binary Proxy Execution Compiled HTML File Decompile - Rule"]
 description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code.
 narrative = Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe). \
 HH.exe relies upon hhctrl.ocx to load CHM topics.This will load upon execution of a chm file. \
@@ -12153,7 +12466,7 @@ version = 2
 references = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"]
 maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}]
 spec_version = 3
-searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Active Setup Registry Autostart - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Windows Registry Delete Task SD - Rule", "ESCU - Windows Schtasks Create Run As System - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Print Processor Registry Autostart - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
+searches = ["ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Active Setup Registry Autostart - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - Change Default File Association - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - ETW Registry Disabled - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Logon Script Event Trigger Execution - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Screensaver Event Trigger Execution - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Time Provider Persistence Registry - Rule", "ESCU - Windows Event Triggered Image File Execution Options Injection - Rule", "ESCU - Windows Registry Delete Task SD - Rule", "ESCU - Windows Schtasks Create Run As System - Rule", "ESCU - Windows Service Creation Using Registry Entry - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule", "ESCU - Print Processor Registry Autostart - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"]
 description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment.
 narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment.
 
diff --git a/dist/escu/default/app.conf b/dist/escu/default/app.conf
index 5308378a7c..45b84bfb54 100644
--- a/dist/escu/default/app.conf
+++ b/dist/escu/default/app.conf
@@ -4,7 +4,7 @@
 is_configured = false
 state = enabled
 state_change_requires_restart = false
-build = 9578
+build = 10018
 
 [triggers]
 reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
 
 [launcher]
 author = Splunk
-version = 3.48.0
+version = 3.49.0
 description = Explore the Analytic Stories included with ES Content Updates.
 
 [ui]
diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf
index fb77dcd3ec..09ea68cf6f 100644
--- a/dist/escu/default/collections.conf
+++ b/dist/escu/default/collections.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-08-29T17:38:30 UTC
+# On Date: 2022-09-20T15:09:11 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/content-version.conf b/dist/escu/default/content-version.conf
index 1c75589111..e17e082e60 100644
--- a/dist/escu/default/content-version.conf
+++ b/dist/escu/default/content-version.conf
@@ -1,2 +1,2 @@
 [content-version]
-version = 3.48.0
+version = 3.49.0
diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf
index e08d520389..3f4e51bfd1 100644
--- a/dist/escu/default/es_investigations.conf
+++ b/dist/escu/default/es_investigations.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-08-29T17:38:30 UTC
+# On Date: 2022-09-20T15:09:11 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf
index 8790a48932..7c7ac28d1f 100644
--- a/dist/escu/default/macros.conf
+++ b/dist/escu/default/macros.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-08-29T17:38:30 UTC
+# On Date: 2022-09-20T15:09:11 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -213,14 +213,50 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[azure_ad_external_guest_user_invited_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[azure_ad_global_administrator_role_assigned_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [azure_ad_multi_factor_authentication_disabled_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[azure_ad_multiple_failed_mfa_requests_for_user_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [azure_ad_multiple_users_failing_to_authenticate_from_ip_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[azure_ad_new_custom_domain_added_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[azure_ad_new_federated_domain_added_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[azure_ad_privileged_role_assigned_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[azure_ad_service_principal_created_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[azure_ad_service_principal_new_client_credentials_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[azure_ad_service_principal_owner_added_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [azure_ad_successful_powershell_authentication_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -233,6 +269,26 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[azure_ad_user_enabled_and_password_reset_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[azure_ad_user_immutableid_attribute_updated_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[azure_automation_account_created_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[azure_automation_runbook_created_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[azure_runbook_webhook_created_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [circle_ci_disable_security_job_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -2989,6 +3045,18 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_access_token_manipulation_sedebugprivilege_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_access_token_manipulation_winlogon_duplicate_token_handle_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
+[windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_adfind_exe_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3037,6 +3105,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_defacement_modify_transcodedwallpaper_file_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_defender_exclusion_registry_entry_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3125,6 +3197,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_event_triggered_image_file_execution_options_injection_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_excessive_disabled_services_event_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3141,6 +3217,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_gather_victim_identity_sam_info_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_gather_victim_network_info_through_ip_check_web_services_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3161,6 +3241,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_hijack_execution_flow_version_dll_side_load_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_hunting_system_account_targeting_lsass_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3201,6 +3285,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_input_capture_using_credential_ui_dll_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_installutil_credential_theft_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3329,6 +3417,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_phishing_recent_iso_exec_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_possible_credential_dumping_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3353,6 +3445,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_process_injection_with_public_source_path_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_process_with_namedpipe_commandline_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3361,6 +3457,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_protocol_tunneling_with_plink_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_raccine_scheduled_task_deletion_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3389,6 +3489,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_remote_access_software_brc4_loaded_dll_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_remote_access_software_hunt_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3449,6 +3553,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_service_deletion_in_registry_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_service_initiation_on_remote_endpoint_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -3457,6 +3565,10 @@ description = Update this macro to limit the output results to filter out false
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
 
+[windows_system_binary_proxy_execution_compiled_html_file_decompile_filter]
+definition = search *
+description = Update this macro to limit the output results to filter out false positives.
+
 [windows_system_file_on_disk_filter]
 definition = search *
 description = Update this macro to limit the output results to filter out false positives.
@@ -4062,6 +4174,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet
 definition = sourcetype="aws:securityhub:firehose"
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
+[azure_audit]
+definition = sourcetype=mscs:azure:audit
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [azuread]
 definition = sourcetype=mscs:azure:eventhub
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
@@ -4587,6 +4703,10 @@ description = This macro limits the output to processes that have been marked as
 definition = (Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe)
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
 
+[wineventlog_application]
+definition = eventtype=wineventlog_application OR source="XmlWinEventLog:Application"
+description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
+
 [wineventlog_security]
 definition = eventtype=wineventlog_security
 description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf
index 418f41bf83..8e560e9b73 100644
--- a/dist/escu/default/savedsearches.conf
+++ b/dist/escu/default/savedsearches.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-08-29T17:38:30 UTC
+# On Date: 2022-09-20T15:09:11 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -53,14 +53,14 @@ description = On May 3rd, 2022, Splunk published a security advisory for a Path
 action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1083"]}
 action.escu.data_models = []
 action.escu.eli5 = On May 3rd, 2022, Splunk published a security advisory for a Path traversal in search parameter that can potentiall allow SPL injection. An attacker can cause the application to load data from incorrect endpoints, urls leading to outcomes such as running arbitrary SPL queries.
-action.escu.how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts.
+action.escu.how_to_implement = This detection does not require you to ingest any new data. The detection does require the ability to search the _internal index. This search will provide search UI requests with path traversal parameter ("../../../../../../../../../") which shows exploitation attempts. This detection is meant for on premise environments, and if executed on internet facing servers without a WAF may produce a lot of results. This detection will not work against obfuscated path traversal requests.
 action.escu.known_false_positives = This search may find additional path traversal exploitation attempts.
 action.escu.creation_date = 2022-04-29
 action.escu.modification_date = 2022-04-29
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Path traversal SPL injection - Rule
 action.escu.search_type = detection
-action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security"]
 action.escu.providing_technologies = null
 action.escu.analytic_story = ["Splunk Vulnerabilities"]
 action.risk = 1
@@ -2181,11 +2181,11 @@ search =  `azuread` body.category=UserRiskEvents body.properties.riskLevel=high
 [ESCU - Azure AD Authentication Failed During MFA Challenge - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge. This behavior may represent an adversary trying to authenticate with compromised credentials. In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request.
+description = The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge. Error Code 500121 represents a failed attempt to authenticate using a second factor. This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled. 
 action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.004", "T1621"], "nist": ["DE.CM"]}
 action.escu.data_models = []
-action.escu.eli5 = The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge. This behavior may represent an adversary trying to authenticate with compromised credentials. In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request.
-action.escu.how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the RiskyUsers and UserRiskEvents log category.
+action.escu.eli5 = The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge. Error Code 500121 represents a failed attempt to authenticate using a second factor. This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled. 
+action.escu.how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
 action.escu.known_false_positives = Legitimate users may miss to reply the MFA challenge within the time window or deny it by mistake.
 action.escu.creation_date = 2022-07-14
 action.escu.modification_date = 2022-07-14
@@ -2209,7 +2209,7 @@ action.correlationsearch.annotations = {"analytic_story": ["Azure Active Directo
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge. This behavior may represent an adversary trying to authenticate with compromised credentials. In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request.
+action.notable.param.rule_description = The following analytic identifies an authentication attempt event against an Azure AD tenant that fails during the Multi Factor Authentication challenge. Error Code 500121 represents a failed attempt to authenticate using a second factor. This behavior may represent an adversary trying to authenticate with compromised credentials for an account that has multi-factor authentication enabled. 
 action.notable.param.rule_title = Azure AD Authentication Failed During MFA Challenge
 action.notable.param.security_domain = identity
 action.notable.param.severity = high
@@ -2224,6 +2224,98 @@ realtime_schedule = 0
 is_visible = false
 search =  `azuread` body.category=SignInLogs body.properties.status.errorCode=500121 | rename body.properties.* as * | stats values(userPrincipalName) by _time, ipAddress, status.additionalDetails, appDisplayName, userAgent | `azure_ad_authentication_failed_during_mfa_challenge_filter`
 
+[ESCU - Azure AD External Guest User Invited - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the invitation of an external guest user within Azure AD. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. External guest account invitations should be monitored by security teams as they could potentially lead to unauthorized access. An example of this attack vector was described at BlackHat 2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking Azure AD Accounts by Abusing External Identities`
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1136.003"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies the invitation of an external guest user within Azure AD. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. External guest account invitations should be monitored by security teams as they could potentially lead to unauthorized access. An example of this attack vector was described at BlackHat 2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking Azure AD Accounts by Abusing External Identities`
+action.escu.how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+action.escu.known_false_positives = Administrator may legitimately invite external guest users. Filter as needed.
+action.escu.creation_date = 2022-08-18
+action.escu.modification_date = 2022-08-18
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Azure AD External Guest User Invited - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Azure Active Directory Persistence"]
+action.risk = 1
+action.risk.param._risk_message = External Guest User $userPrincipalName$ initiated by $initiatedBy$
+action.risk.param._risk = [{"risk_object_field": "userPrincipalName", "risk_object_type": "user", "risk_score": 45}, {"risk_object_field": "initiatedBy", "risk_object_type": "user", "risk_score": 45}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Azure AD External Guest User Invited - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azure Active Directory Persistence"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Cloud Data", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1136.003"], "nist": ["DE.CM"], "observable": [{"name": "userPrincipalName", "role": ["Victim"], "type": "User"}, {"name": "initiatedBy", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the invitation of an external guest user within Azure AD. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. External guest account invitations should be monitored by security teams as they could potentially lead to unauthorized access. An example of this attack vector was described at BlackHat 2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking Azure AD Accounts by Abusing External Identities`
+action.notable.param.rule_title = Azure AD External Guest User Invited
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `azuread` "body.operationName"="Invite external user" | rename body.properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.type as type | stats values(userPrincipalName) by _time, type, initiatedBy, result, body.operationName | `azure_ad_external_guest_user_invited_filter`
+
+[ESCU - Azure AD Global Administrator Role Assigned - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the assignment of the Azure AD Global Administrator role to an Azure AD user. The Global Administrator role is the most powerful administrator role in Azure AD and provides almost unlimited access to data, resources and settings. It is equivalent to the Domain Administrator group in an Active Directory environment. While Azure AD roles do not grant access to Azure services and resources, it is possible for a Global Administrator account to gain control of Azure resources. Adversaries and red teams alike may assign this role to a compromised account to establish Persistence in an Azure AD environment.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1098.003"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies the assignment of the Azure AD Global Administrator role to an Azure AD user. The Global Administrator role is the most powerful administrator role in Azure AD and provides almost unlimited access to data, resources and settings. It is equivalent to the Domain Administrator group in an Active Directory environment. While Azure AD roles do not grant access to Azure services and resources, it is possible for a Global Administrator account to gain control of Azure resources. Adversaries and red teams alike may assign this role to a compromised account to establish Persistence in an Azure AD environment.
+action.escu.how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+action.escu.known_false_positives = Administrators may legitimately assign the Global Administrator role to a user. Filter as needed.
+action.escu.creation_date = 2022-08-17
+action.escu.modification_date = 2022-08-17
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Azure AD Global Administrator Role Assigned - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Azure Active Directory Persistence"]
+action.risk = 1
+action.risk.param._risk_message = Global Administrator Role assigned for User $userPrincipalName$ initiated by $initiatedBy$
+action.risk.param._risk = [{"risk_object_field": "userPrincipalName", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "initiatedBy", "risk_object_type": "user", "risk_score": 72}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Azure AD Global Administrator Role Assigned - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azure Active Directory Persistence"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Cloud Data", "Stage:Persistence"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1098.003"], "nist": ["DE.CM"], "observable": [{"name": "userPrincipalName", "role": ["Victim"], "type": "User"}, {"name": "initiatedBy", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the assignment of the Azure AD Global Administrator role to an Azure AD user. The Global Administrator role is the most powerful administrator role in Azure AD and provides almost unlimited access to data, resources and settings. It is equivalent to the Domain Administrator group in an Active Directory environment. While Azure AD roles do not grant access to Azure services and resources, it is possible for a Global Administrator account to gain control of Azure resources. Adversaries and red teams alike may assign this role to a compromised account to establish Persistence in an Azure AD environment.
+action.notable.param.rule_title = Azure AD Global Administrator Role Assigned
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `azuread` "body.operationName"="Add member to role"  "body.properties.targetResources{}.modifiedProperties{}.newValue"="\"Global Administrator\"" | rename body.properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName | `azure_ad_global_administrator_role_assigned_filter`
+
 [ESCU - Azure AD Multi-Factor Authentication Disabled - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -2270,6 +2362,46 @@ realtime_schedule = 0
 is_visible = false
 search = `azuread` "body.operationName"="Disable Strong Authentication" | rename body.properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename targetResources{}.type as type | rename initiatedBy.user.userPrincipalName as initiatedBy | stats values(userPrincipalName) by _time, type, body.operationName, initiatedBy, result | `azure_ad_multi_factor_authentication_disabled_filter`
 
+[ESCU - Azure AD Multiple Failed MFA Requests For User - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies multiple failed multi-factor authentication requests for a single user within an Azure AD tenant. Error Code 500121 represents a failed attempt to authenticate using a second factor. Specifically, the analytic triggers when more than 10 MFA user prompts fail within 10 minutes. Azure AD tenants can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls potentially resulting in the user finally accepting the authentication request. Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621", "T1078", "T1078.004"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies multiple failed multi-factor authentication requests for a single user within an Azure AD tenant. Error Code 500121 represents a failed attempt to authenticate using a second factor. Specifically, the analytic triggers when more than 10 MFA user prompts fail within 10 minutes. Azure AD tenants can be very different depending on the organization, Security teams should test this detection and customize these arbitrary thresholds. The detected behavior may represent an adversary who has obtained legitimate credentials for a user and continuously repeats login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls potentially resulting in the user finally accepting the authentication request. Threat actors like the Lapsus team and APT29 have leveraged this technique to bypass multi-factor authentication controls as reported by Mandiant and others.
+action.escu.how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
+action.escu.known_false_positives = Multiple Failed MFA requests may also be a sign of authentication or application issues. Filter as needed.
+action.escu.creation_date = 2022-08-25
+action.escu.modification_date = 2022-08-25
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Azure AD Multiple Failed MFA Requests For User - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Azure Active Directory Account Takeover"]
+action.risk = 1
+action.risk.param._risk_message = Multiple Failed MFA requests for user $body.properties.userPrincipalName$
+action.risk.param._risk = [{"risk_object_field": "userPrincipalName", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "ipAddress", "risk_object_type": "system", "risk_score": 63}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Azure AD Multiple Failed MFA Requests For User - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azure Active Directory Account Takeover"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Cloud Data", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1621", "T1078", "T1078.004"], "nist": ["DE.CM"], "observable": [{"name": "userPrincipalName", "role": ["Victim"], "type": "User"}, {"name": "ipAddress", "role": ["Attacker"], "type": "IP Address"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `azuread` body.category=SignInLogs body.properties.status.errorCode=500121 | rename body.properties.* as * | bucket span=10m _time | stats dc(_raw) AS mfa_prompts values(userPrincipalName) by userPrincipalName, status.additionalDetails, appDisplayName, userAgent, _time | where mfa_prompts > 10 | `azure_ad_multiple_failed_mfa_requests_for_user_filter`
+
 [ESCU - Azure AD Multiple Users Failing To Authenticate From Ip - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -2279,7 +2411,7 @@ action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phase
 action.escu.data_models = []
 action.escu.eli5 = The following analytic identifies one source Ip failing to authenticate with 30 unique valid users within 5 minutes. This behavior could represent an adversary performing a Password Spraying attack against an Azure Active Directory tenant to obtain initial access or elevate privileges. Error Code 50126 represents an invalid password. This logic can be used for real time security monitoring as well as threat hunting exercises.\
 Azure AD tenants can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold if needed.
-action.escu.how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
+action.escu.how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs. log category.
 action.escu.known_false_positives = A source Ip failing to authenticate with multiple users is not a common for legitimate behavior.
 action.escu.creation_date = 2022-07-12
 action.escu.modification_date = 2022-07-12
@@ -2312,6 +2444,282 @@ realtime_schedule = 0
 is_visible = false
 search =  `azuread` body.properties.status.errorCode= 50126 body.category= SignInLogs body.properties.authenticationDetails{}.succeeded= false | rename body.properties.* as * | bucket span=5m _time | stats  dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress | where unique_accounts > 30 | `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`
 
+[ESCU - Azure AD New Custom Domain Added - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the addition of a new custom domain within an Azure Active Directory tenant. Adding a custom domain is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1484", "T1484.002"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies the addition of a new custom domain within an Azure Active Directory tenant. Adding a custom domain is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA.
+action.escu.how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+action.escu.known_false_positives = In most organizations, new customm domains will be updated infrequently. Filter as needed.
+action.escu.creation_date = 2022-09-02
+action.escu.modification_date = 2022-09-02
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Azure AD New Custom Domain Added - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Azure Active Directory Persistence"]
+action.risk = 1
+action.risk.param._risk_message = A new custom domain, $domain$ , was added by $initiatedBy$
+action.risk.param._risk = [{"risk_object_field": "initiatedBy", "risk_object_type": "user", "risk_score": 54}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Azure AD New Custom Domain Added - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azure Active Directory Persistence"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Cloud Data", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1484", "T1484.002"], "nist": ["DE.CM"], "observable": [{"name": "initiatedBy", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the addition of a new custom domain within an Azure Active Directory tenant. Adding a custom domain is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA.
+action.notable.param.rule_title = Azure AD New Custom Domain Added
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `azuread` body.operationName="Add unverified domain" "body.properties.result"=success | rename body.properties.* as * | rename body.callerIpAddress as callerIpAddress | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.displayName as domain | stats values(domain) by _time, initiatedBy, result, body.operationName, callerIpAddress | `azure_ad_new_custom_domain_added_filter`
+
+[ESCU - Azure AD New Federated Domain Added - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the addition of a new federated domain within an Azure Active Directory tenant. This event could represent the execution of the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1484", "T1484.002"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies the addition of a new federated domain within an Azure Active Directory tenant. This event could represent the execution of the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA.
+action.escu.how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+action.escu.known_false_positives = In most organizations, domain federation settings will be updated infrequently. Filter as needed.
+action.escu.creation_date = 2022-09-02
+action.escu.modification_date = 2022-09-02
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Azure AD New Federated Domain Added - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Azure Active Directory Persistence"]
+action.risk = 1
+action.risk.param._risk_message = A new federated domain, $domain$ , was added by $initiatedBy$
+action.risk.param._risk = [{"risk_object_field": "initiatedBy", "risk_object_type": "user", "risk_score": 81}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Azure AD New Federated Domain Added - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azure Active Directory Persistence"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Cloud Data", "Stage:Persistence"], "impact": 90, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1484", "T1484.002"], "nist": ["DE.CM"], "observable": [{"name": "initiatedBy", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the addition of a new federated domain within an Azure Active Directory tenant. This event could represent the execution of the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA.
+action.notable.param.rule_title = Azure AD New Federated Domain Added
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `azuread` body.operationName="Set domain authentication" "body.properties.result"=success | rename body.properties.* as * | rename body.callerIpAddress as callerIpAddress | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.displayName as domain | stats values(domain) by _time, initiatedBy, result, body.operationName, callerIpAddress | `azure_ad_new_federated_domain_added_filter`
+
+[ESCU - Azure AD Privileged Role Assigned - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the assignment of sensitive and privileged Azure Active Directory roles to an Azure AD user. Adversaries and red teams alike may assign these roles to a compromised account to establish Persistence in an Azure AD environment.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1098", "T1098.003"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies the assignment of sensitive and privileged Azure Active Directory roles to an Azure AD user. Adversaries and red teams alike may assign these roles to a compromised account to establish Persistence in an Azure AD environment.
+action.escu.how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+action.escu.known_false_positives = Administrators will legitimately assign the privileged roles users as part of administrative tasks. Filter as needed.
+action.escu.creation_date = 2022-08-29
+action.escu.modification_date = 2022-08-29
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Azure AD Privileged Role Assigned - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Azure Active Directory Persistence"]
+action.risk = 1
+action.risk.param._risk_message = A privileged Azure AD role was assigned for User $userPrincipalName$ initiated by $initiatedBy$
+action.risk.param._risk = [{"risk_object_field": "userPrincipalName", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "initiatedBy", "risk_object_type": "user", "risk_score": 63}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Azure AD Privileged Role Assigned - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azure Active Directory Persistence"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Cloud Data", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1098", "T1098.003"], "nist": ["DE.CM"], "observable": [{"name": "userPrincipalName", "role": ["Victim"], "type": "User"}, {"name": "initiatedBy", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the assignment of sensitive and privileged Azure Active Directory roles to an Azure AD user. Adversaries and red teams alike may assign these roles to a compromised account to establish Persistence in an Azure AD environment.
+action.notable.param.rule_title = Azure AD Privileged Role Assigned
+action.notable.param.security_domain = audit
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `azuread` "body.operationName"="Add member to role" | rename body.properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.modifiedProperties{}.newValue as roles | eval role=mvindex(roles,1) | lookup privileged_azure_ad_roles azureadrole AS role OUTPUT isprvilegedadrole description | search isprvilegedadrole = True | stats values(userPrincipalName) by _time, initiatedBy, result, body.operationName, role, description | `azure_ad_privileged_role_assigned_filter`
+
+[ESCU - Azure AD Service Principal Created - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the creation of a Service Principal in an Azure AD environment. An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. Service Principal authentication does not support multi-factor authentication nor conditional access policies. Adversaries and red teams alike who have obtained administrative access may create a Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1136.003"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies the creation of a Service Principal in an Azure AD environment. An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. Service Principal authentication does not support multi-factor authentication nor conditional access policies. Adversaries and red teams alike who have obtained administrative access may create a Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment.
+action.escu.how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+action.escu.known_false_positives = Administrator may legitimately create Service Principal. Filter as needed.
+action.escu.creation_date = 2022-08-17
+action.escu.modification_date = 2022-08-17
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Azure AD Service Principal Created - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Azure Active Directory Persistence"]
+action.risk = 1
+action.risk.param._risk_message = Service Principal named $displayName$ created by $initiatedBy$
+action.risk.param._risk = [{"threat_object_field": "displayName", "threat_object_type": "other"}, {"risk_object_field": "initiatedBy", "risk_object_type": "user", "risk_score": 45}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Azure AD Service Principal Created - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azure Active Directory Persistence"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Cloud Data", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1136.003"], "nist": ["DE.CM"], "observable": [{"name": "displayName", "role": ["Victim"], "type": "Other"}, {"name": "initiatedBy", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the creation of a Service Principal in an Azure AD environment. An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. Service Principal authentication does not support multi-factor authentication nor conditional access policies. Adversaries and red teams alike who have obtained administrative access may create a Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment.
+action.notable.param.rule_title = Azure AD Service Principal Created
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `azuread` "body.operationName"="Add service principal" "body.properties.initiatedBy.user.id"=* | rename body.properties.* as * | rename targetResources{}.displayName as displayName | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.type as type | stats values(displayName) by _time, type, initiatedBy, result, body.operationName | `azure_ad_service_principal_created_filter`
+
+[ESCU - Azure AD Service Principal New Client Credentials - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the creation of credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD. These credentials include both x509 certificates and passwords. With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules. Adversaries and red teams alike who have obtained privileged access to Azure AD may add credentials to Service Principals to maintain persistent access to victim accounts and other instances within the Azure environment.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1098", "T1098.001"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies the creation of credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD. These credentials include both x509 certificates and passwords. With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules. Adversaries and red teams alike who have obtained privileged access to Azure AD may add credentials to Service Principals to maintain persistent access to victim accounts and other instances within the Azure environment.
+action.escu.how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
+action.escu.known_false_positives = Service Principal client credential modifications may be part of legitimate administrative operations. Filter as needed.
+action.escu.creation_date = 2022-08-17
+action.escu.modification_date = 2022-08-17
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Azure AD Service Principal New Client Credentials - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Azure Active Directory Persistence"]
+action.risk = 1
+action.risk.param._risk_message = New credentials added for Service Principal $body.properties.targetResources{}.displayName$
+action.risk.param._risk = [{"risk_object_field": "displayName", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "initiatedBy.user.userPrincipalName", "risk_object_type": "user", "risk_score": 63}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Azure AD Service Principal New Client Credentials - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azure Active Directory Persistence"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Cloud Data", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1098", "T1098.001"], "nist": ["DE.CM"], "observable": [{"name": "displayName", "role": ["Victim"], "type": "User"}, {"name": "initiatedBy.user.userPrincipalName", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the creation of credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD. These credentials include both x509 certificates and passwords. With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules. Adversaries and red teams alike who have obtained privileged access to Azure AD may add credentials to Service Principals to maintain persistent access to victim accounts and other instances within the Azure environment.
+action.notable.param.rule_title = Azure AD Service Principal New Client Credentials
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `azuread` body.category=AuditLogs body.operationName="Update application*Certificates and secrets management " | rename body.* as * | rename properties.* as * | rename targetResources{}.* as * | stats values(displayName) by _time, initiatedBy.user.userPrincipalName, modifiedProperties{}.newValue | `azure_ad_service_principal_new_client_credentials_filter`
+
+[ESCU - Azure AD Service Principal Owner Added - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the addition of a new owner for a Service Principal within an Azure AD tenant. An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. Service Principal authentication does not support multi-factor authentication nor conditional access policies. Adversaries and red teams alike who have obtained administrative access may add a new owner for an existing Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1098"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies the addition of a new owner for a Service Principal within an Azure AD tenant. An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. Service Principal authentication does not support multi-factor authentication nor conditional access policies. Adversaries and red teams alike who have obtained administrative access may add a new owner for an existing Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment.
+action.escu.how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+action.escu.known_false_positives = Administrator may legitimately add new owners for Service Principals. Filter as needed.
+action.escu.creation_date = 2022-08-30
+action.escu.modification_date = 2022-08-30
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Azure AD Service Principal Owner Added - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Azure Active Directory Persistence"]
+action.risk = 1
+action.risk.param._risk_message = A new owner was added for service principal $displayName$ by $initiatedBy$
+action.risk.param._risk = [{"threat_object_field": "displayName", "threat_object_type": "other"}, {"risk_object_field": "initiatedBy", "risk_object_type": "user", "risk_score": 54}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Azure AD Service Principal Owner Added - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azure Active Directory Persistence"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Cloud Data", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1098"], "nist": ["DE.CM"], "observable": [{"name": "displayName", "role": ["Victim"], "type": "Other"}, {"name": "initiatedBy", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the addition of a new owner for a Service Principal within an Azure AD tenant. An Azure Service Principal is an identity designed to be used with applications, services, and automated tools to access resources. It is similar to a service account within an Active Directory environment. Service Principal authentication does not support multi-factor authentication nor conditional access policies. Adversaries and red teams alike who have obtained administrative access may add a new owner for an existing Service Principal to establish Persistence and obtain single-factor access to an Azure AD environment.
+action.notable.param.rule_title = Azure AD Service Principal Owner Added
+action.notable.param.security_domain = audit
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `azuread` body.operationName="Add owner to application" | rename body.properties.* as * | rename initiatedBy.user.userPrincipalName as initiatedBy | rename targetResources{}.userPrincipalName as newOwner | rename targetResources{}.modifiedProperties{}.newValue as displayName | eval displayName = mvindex(displayName,1) | where  initiatedBy!=newOwner | stats values(displayName) by _time, initiatedBy, result, body.operationName, newOwner | `azure_ad_service_principal_owner_added_filter`
+
 [ESCU - Azure AD Successful PowerShell Authentication - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -2319,7 +2727,7 @@ description = The following analytic identifies a successful authentication even
 action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.004"], "nist": ["DE.CM"]}
 action.escu.data_models = []
 action.escu.eli5 = The following analytic identifies a successful authentication event against an Azure AD tenant using PowerShell commandlets. This behavior is not common for regular, non administrative users. After compromising an account in Azure AD, attackers and red teams  alike will perform enumeration and discovery techniques. One method of executing these techniques is leveraging the native PowerShell modules.
-action.escu.how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
+action.escu.how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
 action.escu.known_false_positives = Administrative users will likely use PowerShell commandlets to troubleshoot and maintain the environment. Filter as needed.
 action.escu.creation_date = 2022-07-13
 action.escu.modification_date = 2022-07-13
@@ -2365,7 +2773,7 @@ description = The following analytic identifies a successful authentication even
 action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "nist": ["DE.CM"]}
 action.escu.data_models = []
 action.escu.eli5 = The following analytic identifies a successful authentication event against Azure Active Directory for an account without Multi-Factor Authentication enabled. This could be evidence of a missconfiguration, a policy violation or an account take over attempt that should be investigated
-action.escu.how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
+action.escu.how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
 action.escu.known_false_positives = Although not recommended, certain users may be required without multi-factor authentication. Filter as needed
 action.escu.creation_date = 2022-07-12
 action.escu.modification_date = 2022-07-12
@@ -2415,7 +2823,7 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic identifies one source Ip failing to authenticate with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against an Azure Active Directory tenant to obtain initial access or elevate privileges. Error Code 50126 represents an invalid password.\
 The detection calculates the standard deviation for source Ip and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\
 While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `Azure AD Multiple Users Failing To Authenticate From Ip`.
-action.escu.how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
+action.escu.how_to_implement = You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs log category.
 action.escu.known_false_positives = A source Ip failing to authenticate with multiple users is not a common for legitimate behavior.
 action.escu.creation_date = 2022-07-11
 action.escu.modification_date = 2022-07-11
@@ -2448,6 +2856,236 @@ realtime_schedule = 0
 is_visible = false
 search =  `azuread` body.properties.status.errorCode= 50126 body.category= SignInLogs body.properties.authenticationDetails{}.succeeded= false | rename body.properties.* as * | bucket span=5m _time | stats  dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress | eventstats  avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by ipAddress | eval  upperBound=(ip_avg+ip_std*3) | eval  isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`
 
+[ESCU - Azure AD User Enabled And Password Reset - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies an Azure AD user enabling a previously disabled account and resetting its password within 2 minutes. This behavior could represent an adversary who has obtained administrative access and is trying to establish a backdoor identity within an Azure AD tenant.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1098"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies an Azure AD user enabling a previously disabled account and resetting its password within 2 minutes. This behavior could represent an adversary who has obtained administrative access and is trying to establish a backdoor identity within an Azure AD tenant.
+action.escu.how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+action.escu.known_false_positives = While not common, Administrators may enable accounts and reset their passwords for legitimate reasons. Filter as needed.
+action.escu.creation_date = 2022-08-29
+action.escu.modification_date = 2022-08-29
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Azure AD User Enabled And Password Reset - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Azure Active Directory Persistence"]
+action.risk = 1
+action.risk.param._risk_message = A user account, $displayName$, was enabled and its password reset within 2 minutes by $initiatedBy$
+action.risk.param._risk = [{"threat_object_field": "displayName", "threat_object_type": "other"}, {"risk_object_field": "initiatedBy", "risk_object_type": "user", "risk_score": 45}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Azure AD User Enabled And Password Reset - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azure Active Directory Persistence"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Cloud Data", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1098"], "nist": ["DE.CM"], "observable": [{"name": "displayName", "role": ["Victim"], "type": "Other"}, {"name": "initiatedBy", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies an Azure AD user enabling a previously disabled account and resetting its password within 2 minutes. This behavior could represent an adversary who has obtained administrative access and is trying to establish a backdoor identity within an Azure AD tenant.
+action.notable.param.rule_title = Azure AD User Enabled And Password Reset
+action.notable.param.security_domain = identity
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `azuread` (body.operationName="Enable account" OR body.operationName="Reset password (by admin)" OR body.operationName="Update user") | transaction body.properties.targetResources{}.userPrincipalName startsWith=(body.operationName="Enable account") endsWith=(body.operationName="Reset password (by admin)") maxspan=2m | rename body.properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy | stats values(body.operationName) values(initiatedBy) by _time, userPrincipalName, result | `azure_ad_user_enabled_and_password_reset_filter`
+
+[ESCU - Azure AD User ImmutableId Attribute Updated - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the modification of the SourceAnchor (also called ImmutableId) attribute for an Azure Active Directory user. Updating this attribute is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1098"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies the modification of the SourceAnchor (also called ImmutableId) attribute for an Azure Active Directory user. Updating this attribute is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA.
+action.escu.how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs log category.
+action.escu.known_false_positives = The SourceAnchor (also called ImmutableId) Azure AD attribute has legitimate uses for directory synchronization. Investigate and filter as needed.
+action.escu.creation_date = 2022-09-02
+action.escu.modification_date = 2022-09-02
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Azure AD User ImmutableId Attribute Updated - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Azure Active Directory Persistence"]
+action.risk = 1
+action.risk.param._risk_message = The SourceAnchor or ImmutableID attribute has been modified for user $userPrincipalName$ by $initiatedBy$
+action.risk.param._risk = [{"risk_object_field": "userPrincipalName", "risk_object_type": "user", "risk_score": 45}, {"risk_object_field": "initiatedBy", "risk_object_type": "user", "risk_score": 45}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Azure AD User ImmutableId Attribute Updated - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azure Active Directory Persistence"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Cloud Data", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1098"], "nist": ["DE.CM"], "observable": [{"name": "userPrincipalName", "role": ["Victim"], "type": "User"}, {"name": "initiatedBy", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the modification of the SourceAnchor (also called ImmutableId) attribute for an Azure Active Directory user. Updating this attribute is a step required to set up the Azure Active Directory identity federation backdoor technique discovered by security researcher Nestori Syynimaa. Similar to Active Directory, Azure AD uses the concept of domains to manage directories of identities. A new Azure AD tenant will initially contain a single domain that is commonly called the `cloud-only` onmicrosoft.com domain. Organizations can also add their registered custom domains to Azure AD for email addresses to match the organizations domain name. If the organization intends to use a third-party identity provider such as ADFS for authentication, the added custom domains can be configured as federated. An adversary who has obtained privileged access to an Azure AD tenant may leverage this technique to establish persistence and be able to authenticate to Azure AD impersonating any user and bypassing the requirement to have a valid password and/or perform MFA.
+action.notable.param.rule_title = Azure AD User ImmutableId Attribute Updated
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `azuread` body.operationName="Update user" body.properties.targetResources{}.modifiedProperties{}.displayName=SourceAnchor | rename body.properties.* as * | rename targetResources{}.userPrincipalName as userPrincipalName | rename initiatedBy.user.userPrincipalName as initiatedBy | rename body.callerIpAddress as callerIpAddress | rename targetResources{}.modifiedProperties{}.newValue as modifiedProperties | stats values(userPrincipalName) values(modifiedProperties) by _time, initiatedBy, callerIpAddress, result, body.operationName | `azure_ad_user_immutableid_attribute_updated_filter`
+
+[ESCU - Azure Automation Account Created - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the creation of a new Azure Automation account within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure using PowerShell and Python. Azure Automation can also be configured to automate tasks on on premise infrastructure using a component called a Hybrid Runbook Worker. Automation accounts serve as a container to isolate Automation resources, runbooks, assets, and configurations from the resources of other accounts. They allow administrators to separate resources into logical environments or delegated responsibilities. Adversaries or red teams who have obtained privileged access to an Azure tenant may create an Azure Automation account with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1136", "T1136.003"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies the creation of a new Azure Automation account within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure using PowerShell and Python. Azure Automation can also be configured to automate tasks on on premise infrastructure using a component called a Hybrid Runbook Worker. Automation accounts serve as a container to isolate Automation resources, runbooks, assets, and configurations from the resources of other accounts. They allow administrators to separate resources into logical environments or delegated responsibilities. Adversaries or red teams who have obtained privileged access to an Azure tenant may create an Azure Automation account with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc.
+action.escu.how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. Specifically, this analytic leverages the Azure Activity log category.
+action.escu.known_false_positives = Administrators may legitimately create Azure Automation accounts. Filter as needed.
+action.escu.creation_date = 2022-08-18
+action.escu.modification_date = 2022-08-18
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Azure Automation Account Created - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Azure Active Directory Persistence"]
+action.risk = 1
+action.risk.param._risk_message = A new Azure Automation account $object$ was created by $caller$
+action.risk.param._risk = [{"threat_object_field": "object", "threat_object_type": "other"}, {"risk_object_field": "caller", "risk_object_type": "user", "risk_score": 63}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Azure Automation Account Created - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azure Active Directory Persistence"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Cloud Data", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1136", "T1136.003"], "nist": ["DE.CM"], "observable": [{"name": "object", "role": ["Victim"], "type": "Other"}, {"name": "caller", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the creation of a new Azure Automation account within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure using PowerShell and Python. Azure Automation can also be configured to automate tasks on on premise infrastructure using a component called a Hybrid Runbook Worker. Automation accounts serve as a container to isolate Automation resources, runbooks, assets, and configurations from the resources of other accounts. They allow administrators to separate resources into logical environments or delegated responsibilities. Adversaries or red teams who have obtained privileged access to an Azure tenant may create an Azure Automation account with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc.
+action.notable.param.rule_title = Azure Automation Account Created
+action.notable.param.security_domain = audit
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `azure_audit` operationName.localizedValue="Create or Update an Azure Automation account" status.value=Succeeded | dedup object | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path | `azure_automation_account_created_filter`
+
+[ESCU - Azure Automation Runbook Created - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the creation of a new Azure Automation Runbook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python. Adversaries or red teams who have obtained privileged access to an Azure tenant may create an Azure Automation Runbook that runs with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1136", "T1136.003"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies the creation of a new Azure Automation Runbook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python. Adversaries or red teams who have obtained privileged access to an Azure tenant may create an Azure Automation Runbook that runs with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc.
+action.escu.how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. Specifically, this analytic leverages the Azure Activity log category.
+action.escu.known_false_positives = Administrators may legitimately create Azure Automation Runbooks. Filter as needed.
+action.escu.creation_date = 2022-08-22
+action.escu.modification_date = 2022-08-22
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Azure Automation Runbook Created - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Azure Active Directory Persistence"]
+action.risk = 1
+action.risk.param._risk_message = A new Azure Automation Runbook $object$ was created by $caller$
+action.risk.param._risk = [{"threat_object_field": "object", "threat_object_type": "other"}, {"risk_object_field": "caller", "risk_object_type": "user", "risk_score": 63}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Azure Automation Runbook Created - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azure Active Directory Persistence"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Cloud Data", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1136", "T1136.003"], "nist": ["DE.CM"], "observable": [{"name": "object", "role": ["Victim"], "type": "Other"}, {"name": "caller", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the creation of a new Azure Automation Runbook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python. Adversaries or red teams who have obtained privileged access to an Azure tenant may create an Azure Automation Runbook that runs with elevated privileges to maintain persistence in the Azure tenant. A malicious Automation Runbook can be created to create Global Administrators in Azure AD, execute code on VMs, etc.
+action.notable.param.rule_title = Azure Automation Runbook Created
+action.notable.param.security_domain = audit
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `azure_audit` operationName.localizedValue="Create or Update an Azure Automation Runbook" object!=AzureAutomationTutorial* status.value=Succeeded | dedup object | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path | `azure_automation_runbook_created_filter`
+
+[ESCU - Azure Runbook Webhook Created - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the creation of a new Automation Runbook Webhook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python. One of the ways administrators can configure a Runbook to be executed is through HTTP Webhooks. Webhooks leverage custom unauthenticated URLs that are exposed to the Internet. An adversary who has obtained privileged access to an Azure tenant may create a Webhook to trigger the execution of an Automation Runbook with malicious code that can create users or execute code on a VM. This provides a persistent foothold on the environment.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.004"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies the creation of a new Automation Runbook Webhook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python. One of the ways administrators can configure a Runbook to be executed is through HTTP Webhooks. Webhooks leverage custom unauthenticated URLs that are exposed to the Internet. An adversary who has obtained privileged access to an Azure tenant may create a Webhook to trigger the execution of an Automation Runbook with malicious code that can create users or execute code on a VM. This provides a persistent foothold on the environment.
+action.escu.how_to_implement = You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Audit events into your Splunk environment. Specifically, this analytic leverages the Azure Activity log category.
+action.escu.known_false_positives = Administrators may legitimately create Azure Runbook Webhooks. Filter as needed.
+action.escu.creation_date = 2022-08-23
+action.escu.modification_date = 2022-08-23
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Azure Runbook Webhook Created - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Azure Active Directory Persistence"]
+action.risk = 1
+action.risk.param._risk_message = A new Azure Runbook Webhook $object$ was created by $caller$
+action.risk.param._risk = [{"threat_object_field": "object", "threat_object_type": "other"}, {"risk_object_field": "caller", "risk_object_type": "user", "risk_score": 63}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Azure Runbook Webhook Created - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Azure Active Directory Persistence"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Cloud Data", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1078", "T1078.004"], "nist": ["DE.CM"], "observable": [{"name": "object", "role": ["Victim"], "type": "Other"}, {"name": "caller", "role": ["Attacker"], "type": "User"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the creation of a new Automation Runbook Webhook within an Azure tenant. Azure Automation is a cloud-based automation platform that allows administrators to automate Azure management tasks and orchestrate actions across external systems within Azure. Azure Automation script files called Runbooks that can be written in PowerShell or Python. One of the ways administrators can configure a Runbook to be executed is through HTTP Webhooks. Webhooks leverage custom unauthenticated URLs that are exposed to the Internet. An adversary who has obtained privileged access to an Azure tenant may create a Webhook to trigger the execution of an Automation Runbook with malicious code that can create users or execute code on a VM. This provides a persistent foothold on the environment.
+action.notable.param.rule_title = Azure Runbook Webhook Created
+action.notable.param.security_domain = threat
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search =  `azure_audit` operationName.localizedValue="Create or Update an Azure Automation webhook" status.value=Succeeded | stats values(object) by _time, caller, claims.ipaddr, resourceGroupName, object_path | `azure_runbook_webhook_created_filter`
+
 [ESCU - Circle CI Disable Security Job - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -2949,22 +3587,17 @@ action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops"]
-action.risk = 1
-action.risk.param._risk_message = Correlation triggered for user $user$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}]
-action.risk.param._risk_score = 0
-action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Correlation by Repository and Risk - Rule
+action.correlationsearch.label = ESCU - RIR - Correlation by Repository and Risk - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 100, "context": ["Unknown"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
 action.notable.param.rule_description = This search correlations detections by repository and risk_score
-action.notable.param.rule_title = Correlation by Repository and Risk
+action.notable.param.rule_title = RBA: Correlation by Repository and Risk
 action.notable.param.security_domain = network
 action.notable.param.severity = high
 alert.digest_mode = 1
@@ -2995,22 +3628,17 @@ action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = null
 action.escu.analytic_story = ["Dev Sec Ops"]
-action.risk = 1
-action.risk.param._risk_message = Correlation triggered for user $user$
-action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}]
-action.risk.param._risk_score = 0
-action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Correlation by User and Risk - Rule
+action.correlationsearch.label = ESCU - RIR - Correlation by User and Risk - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Dev Sec Ops"], "cis20": ["CIS 13"], "confidence": 100, "context": ["Unknown"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.003", "T1204"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
 action.notable.param.rule_description = This search correlations detections by user and risk_score
-action.notable.param.rule_title = Correlation by User and Risk
+action.notable.param.rule_title = RBA: Correlation by User and Risk
 action.notable.param.security_domain = network
 action.notable.param.severity = high
 alert.digest_mode = 1
@@ -5531,7 +6159,7 @@ action.escu.full_search_name = ESCU - Dump LSASS via procdump Rename - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = null
-action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"]
+action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$, attempting to dump lsass.exe.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -5542,7 +6170,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Deprecated - Dump LSASS via procdump Rename - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group", "CISA AA22-257A"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -8170,8 +8798,8 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain users for situational awareness and Active Directory Discovery.
 action.escu.how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting.
-action.escu.creation_date = 2021-08-24
-action.escu.modification_date = 2021-08-24
+action.escu.creation_date = 2022-11-13
+action.escu.modification_date = 2022-11-13
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - AdsiSearcher Account Discovery - Rule
 action.escu.search_type = detection
@@ -8180,7 +8808,7 @@ action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Industroyer2", "Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = powershell process having commandline $Message$ for user enumeration
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 25}]
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 25}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -8188,7 +8816,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - AdsiSearcher Account Discovery - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Industroyer2", "Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Industroyer2", "Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "UserID", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -8205,7 +8833,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*objectcategory=user*" Message = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `adsisearcher_account_discovery_filter`
+search = `powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=user*" ScriptBlockText = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Computer ScriptBlockText UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `adsisearcher_account_discovery_filter`
 
 [ESCU - Allow File And Printing Sharing In Firewall - Rule]
 action.escu = 0
@@ -9954,7 +10582,7 @@ action.escu.full_search_name = ESCU - Create local admin accounts using net exe
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["DHS Report TA18-074A", "Azorult"]
+action.escu.analytic_story = ["DHS Report TA18-074A", "Azorult", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators group.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -9965,7 +10593,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Create local admin accounts using net exe - Rule
-action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "Azorult"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "Azorult", "CISA AA22-257A"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -10138,7 +10766,7 @@ action.escu.full_search_name = ESCU - Creation of lsass Dump with Taskmgr - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = null
-action.escu.analytic_story = ["Credential Dumping"]
+action.escu.analytic_story = ["Credential Dumping", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "TargetFilename", "threat_object_type": "file name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -10149,7 +10777,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Creation of lsass Dump with Taskmgr - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "TargetFilename", "role": ["Victim"], "type": "File Name"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "CISA AA22-257A"], "cis20": ["CIS 6", "CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "TargetFilename", "role": ["Victim"], "type": "File Name"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -10964,7 +11592,7 @@ action.escu.full_search_name = ESCU - Detect Exchange Web Shell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["HAFNIUM Group", "ProxyShell"]
+action.escu.analytic_story = ["HAFNIUM Group", "ProxyShell", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "file_name", "threat_object_type": "file name"}]
@@ -10975,7 +11603,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detect Exchange Web Shell - Rule
-action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group", "ProxyShell"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003", "T1190"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]}
+action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group", "ProxyShell", "CISA AA22-257A"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003", "T1190"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -11188,7 +11816,7 @@ action.escu.full_search_name = ESCU - Detect Mimikatz Using Loaded Images - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = null
-action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"]
+action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = A process, $Image$, has loaded $ImageLoaded$ that are typically related to credential dumping on $Computer$. Review for further details.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "ImageLoaded", "threat_object_type": "process"}, {"threat_object_field": "Image", "threat_object_type": "process"}]
@@ -11199,7 +11827,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detect Mimikatz Using Loaded Images - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"], "cis20": ["CIS 6", "CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Process"}, {"name": "Image", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware", "CISA AA22-257A"], "cis20": ["CIS 6", "CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Process"}, {"name": "Image", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -11418,7 +12046,7 @@ action.escu.full_search_name = ESCU - Detect New Local Admin account - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Microsoft Windows"]
-action.escu.analytic_story = ["DHS Report TA18-074A", "HAFNIUM Group"]
+action.escu.analytic_story = ["DHS Report TA18-074A", "HAFNIUM Group", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}]
@@ -11429,7 +12057,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Detect New Local Admin account - Rule
-action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Actions on Objectives", "Command \u0026 Control"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group", "CISA AA22-257A"], "cis20": ["CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Actions on Objectives", "Command \u0026 Control"], "mitre_attack": ["T1136.001", "T1136"], "nist": ["PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -14559,7 +15187,7 @@ action.escu.full_search_name = ESCU - Dump LSASS via comsvcs DLL - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group", "Living Off The Land", "Industroyer2"]
+action.escu.analytic_story = ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group", "Living Off The Land", "Industroyer2", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -14570,7 +15198,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Dump LSASS via comsvcs DLL - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group", "Living Off The Land", "Industroyer2"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group", "Living Off The Land", "Industroyer2", "CISA AA22-257A"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -14600,14 +15228,14 @@ action.escu.eli5 = Detect procdump.exe dumping the lsass process. This query loo
 During triage, confirm this is procdump.exe executing. If it is the first time a Sysinternals utility has been ran, it is possible there will be a -accepteula on the command line. Review other endpoint data sources for cross process (injection) into lsass.exe.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 action.escu.known_false_positives = None identified.
-action.escu.creation_date = 2021-09-16
-action.escu.modification_date = 2021-09-16
+action.escu.creation_date = 2022-08-31
+action.escu.modification_date = 2022-08-31
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Dump LSASS via procdump - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"]
+action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified attempting to dump lsass.exe on endpoint $dest$ by user $user$.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
@@ -14618,7 +15246,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Dump LSASS via procdump - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group", "CISA AA22-257A"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -15640,7 +16268,7 @@ action.escu.full_search_name = ESCU - Executables Or Script Creation In Suspicio
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Double Zero Destructor", "Data Destruction", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper", "Industroyer2", "Azorult", "DarkCrystal RAT"]
+action.escu.analytic_story = ["Double Zero Destructor", "Data Destruction", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper", "Industroyer2", "Azorult", "DarkCrystal RAT", "Brute Ratel C4"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious executable or scripts with file name $file_name$, $file_path$ and process_id $process_id$ executed in suspicious file path in Windows by $user$
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_name", "threat_object_type": "file name"}]
@@ -15651,7 +16279,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Executables Or Script Creation In Suspicious Path - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Double Zero Destructor", "Data Destruction", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper", "Industroyer2", "Azorult", "DarkCrystal RAT"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_id", "role": ["Attacker"], "type": "Process"}, {"name": "file_name", "role": ["Other", "Attacker"], "type": "File Name"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Double Zero Destructor", "Data Destruction", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper", "Industroyer2", "Azorult", "DarkCrystal RAT", "Brute Ratel C4"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_id", "role": ["Attacker"], "type": "Process"}, {"name": "file_name", "role": ["Other", "Attacker"], "type": "File Name"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -15778,7 +16406,7 @@ action.escu.full_search_name = ESCU - Extraction of Registry Hives - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["DarkSide Ransomware", "Credential Dumping"]
+action.escu.analytic_story = ["DarkSide Ransomware", "Credential Dumping", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = Suspicious use of `reg.exe` exporting Windows Registry hives containing credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "parent_process_id", "threat_object_type": "process"}]
@@ -15789,7 +16417,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Extraction of Registry Hives - Rule
-action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Credential Dumping"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Credential Access", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_id", "role": ["Parent Process", "Attacker"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Credential Dumping", "CISA AA22-257A"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Credential Access", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_id", "role": ["Parent Process", "Attacker"], "type": "Process"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -16127,8 +16755,8 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-AdGUser` commandlet. The `Get-AdUser` commandlet is used to return a list of all domain users. Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery.
 action.escu.how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting.
-action.escu.creation_date = 2021-08-24
-action.escu.modification_date = 2021-08-24
+action.escu.creation_date = 2022-09-13
+action.escu.modification_date = 2022-09-13
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Get ADUser with PowerShell Script Block - Rule
 action.escu.search_type = detection
@@ -16156,7 +16784,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filter*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_script_block_filter`
+search = `powershell` EventCode=4104 ScriptBlockText = "*get-aduser*" ScriptBlockText = "*-filter*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_aduser_with_powershell_script_block_filter`
 
 [ESCU - Get ADUserResultantPasswordPolicy with Powershell - Rule]
 action.escu = 0
@@ -16495,8 +17123,8 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Get-DomainUser` commandlet. `GetDomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and adversaries alike may use PowerView to enumerate domain users for situational awareness and Active Directory Discovery.
 action.escu.how_to_implement = The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 action.escu.known_false_positives = Administrators or power users may use this command for troubleshooting.
-action.escu.creation_date = 2022-03-22
-action.escu.modification_date = 2022-03-22
+action.escu.creation_date = 2022-11-13
+action.escu.modification_date = 2022-11-13
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Get DomainUser with PowerShell Script Block - Rule
 action.escu.search_type = detection
@@ -16505,7 +17133,7 @@ action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.analytic_story = ["Active Directory Discovery"]
 action.risk = 1
 action.risk.param._risk_message = powershell process having commandline $Message$ for user enumeration
-action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 25}]
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 25}, {"risk_object_field": "UserID", "risk_object_type": "user", "risk_score": 25}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -16513,7 +17141,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Get DomainUser with PowerShell Script Block - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Discovery"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "UserID", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -16530,7 +17158,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 ScriptBlockText = "*Get-DomainUser*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`
+search = `powershell` EventCode=4104 ScriptBlockText = "*Get-DomainUser*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`
 
 [ESCU - Get-ForestTrust with PowerShell - Rule]
 action.escu = 0
@@ -17921,14 +18549,14 @@ search = `wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.doc",
 [ESCU - High Process Termination Frequency - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This analytics are designed to indentify a high frequency of process termination on a machine which is a common behavior of ransomware malware before encrypting files. This technique is designed to avoid an exception error while accessing (docs, images, database and etc..) in the infected machine for encryption.
+description = This analytic is designed to identify a high frequency of process termination events on a computer in a short period of time, which is a common behavior of ransomware malware before encrypting files. This technique is designed to avoid an exception error while accessing (docs, images, database and etc..) in the infected machine for encryption.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1486"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This analytics are designed to indentify a high frequency of process termination on a machine which is a common behavior of ransomware malware before encrypting files. This technique is designed to avoid an exception error while accessing (docs, images, database and etc..) in the infected machine for encryption.
+action.escu.eli5 = This analytic is designed to identify a high frequency of process termination events on a computer in a short period of time, which is a common behavior of ransomware malware before encrypting files. This technique is designed to avoid an exception error while accessing (docs, images, database and etc..) in the infected machine for encryption.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the Image (process full path of terminated process) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
 action.escu.known_false_positives = admin or user tool that can terminate multiple process.
-action.escu.creation_date = 2021-03-16
-action.escu.modification_date = 2021-03-16
+action.escu.creation_date = 2022-09-14
+action.escu.modification_date = 2022-09-14
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - High Process Termination Frequency - Rule
 action.escu.search_type = detection
@@ -17956,7 +18584,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `sysmon` EventCode=5 |bin _time span=3s |stats values(Image) as proc_terminated min(_time) as firstTime max(_time) as lastTime  count by Computer EventCode ProcessID | where count >= 15 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `high_process_termination_frequency_filter`
+search = `sysmon` EventCode=5 |bin _time span=3s |stats values(Image) as proc_terminated min(_time) as firstTime max(_time) as lastTime  count by _time Computer EventCode ProcessID | where count >= 15 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `high_process_termination_frequency_filter`
 
 [ESCU - Hunting for Log4Shell - Rule]
 action.escu = 0
@@ -20999,30 +21627,25 @@ action.escu.data_models = ["Risk"]
 action.escu.eli5 = The following correlation is specific to Linux persistence and privilege escalation tactics and is tied to two analytic stories and any Linux analytic tied to persistence and privilege escalation. These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.
 action.escu.how_to_implement = Ensure Linux anomaly and TTP analytics are enabled. TTP may be set to Notables for point detections, anomaly should not be notables but risk generators. The correlation relies on more than x amount of distict detection names generated before generating a notable. Modify the value as needed. Default value is set to 4. This value may need to be increased based on activity in your environment.
 action.escu.known_false_positives = False positives will be present based on many factors. Tune the correlation as needed to reduce too many triggers.
-action.escu.creation_date = 2022-08-26
-action.escu.modification_date = 2022-08-26
+action.escu.creation_date = 2022-08-30
+action.escu.modification_date = 2022-08-30
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Linux Persistence and Privilege Escalation Risk Behavior - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = null
 action.escu.analytic_story = ["Linux Privilege Escalation", "Linux Persistence Techniques"]
-action.risk = 1
-action.risk.param._risk_message = Privilege escalation and persistence behaviors have been identified on $risk_object$.
-action.risk.param._risk = [{"risk_object_field": "risk_object", "risk_object_type": "system", "risk_score": 56}]
-action.risk.param._risk_score = 0
-action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Linux Persistence and Privilege Escalation Risk Behavior - Rule
+action.correlationsearch.label = ESCU - RIR - Linux Persistence and Privilege Escalation Risk Behavior - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Linux Privilege Escalation", "Linux Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548"], "nist": ["DE.CM"], "observable": [{"name": "risk_object", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
 action.notable.param.rule_description = The following correlation is specific to Linux persistence and privilege escalation tactics and is tied to two analytic stories and any Linux analytic tied to persistence and privilege escalation. These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.
-action.notable.param.rule_title = Linux Persistence and Privilege Escalation Risk Behavior
+action.notable.param.rule_title = RBA: Linux Persistence and Privilege Escalation Risk Behavior
 action.notable.param.security_domain = audit
 action.notable.param.severity = high
 alert.digest_mode = 1
@@ -21034,7 +21657,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count as risk_event_count, sum(All_Risk.calculated_risk_score) as risk_score, min(_time) as firstTime max(_time) as lastTime, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count from datamodel=Risk.All_Risk where (All_Risk.analyticstories IN ("Linux Privilege Escalation", "Linux Persistence Techniques") OR source = "*Linux*") All_Risk.annotations.mitre_attack.mitre_tactic IN ("persistence", "privilege-escalation") All_Risk.risk_object_type="system" by All_Risk.risk_object, All_Risk.risk_object_type, source | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | stats  values(source) as source, sum(risk_score) as risk_score, sum(risk_event_count) as risk_event_count, values(annotations.mitre_attack.mitre_tactic) as annotations.mitre_attack.mitre_tactic min(firstTime) as firstTime max(lastTime) as lastTime, values(annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count dc(source) as source_count by risk_object, risk_object_type | where distinct_detection_name >= 4 | `linux_persistence_and_privilege_escalation_risk_behavior_filter`
+search = | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count from datamodel=Risk.All_Risk where (All_Risk.analyticstories IN ("Linux Privilege Escalation", "Linux Persistence Techniques") OR source = "*Linux*") All_Risk.annotations.mitre_attack.mitre_tactic IN ("persistence", "privilege-escalation") All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where source_count >= 4 | `linux_persistence_and_privilege_escalation_risk_behavior_filter`
 
 [ESCU - Linux PHP Privilege Escalation - Rule]
 action.escu = 0
@@ -22241,30 +22864,25 @@ action.escu.data_models = ["Risk"]
 action.escu.eli5 = The following correlation identifies a distinct amount of analytics associated with the Living Off The Land analytic story that identify potentially suspicious behavior.
 action.escu.how_to_implement = To implement this correlation search a user needs to enable all detections in the Living Off The Land Analytic Story and confirm it is generating risk events. A simple search `index=risk analyticstories="Living Off The Land"` should contain events.
 action.escu.known_false_positives = There are no known false positive for this search, but it could contain false positives as multiple detections can trigger and not have successful exploitation. Modify the static value distinct_detection_name to a higher value. It is also required to tune analytics that are also tagged to ensure volume is never too much.
-action.escu.creation_date = 2022-08-19
-action.escu.modification_date = 2022-08-19
+action.escu.creation_date = 2022-09-09
+action.escu.modification_date = 2022-09-09
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Living Off The Land - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = null
 action.escu.analytic_story = ["Living Off The Land"]
-action.risk = 1
-action.risk.param._risk_message = An increase of Living Off The Land behavior has been detected on $affected_systems$
-action.risk.param._risk = [{"risk_object_field": "affected_systems", "risk_object_type": "system", "risk_score": 63}]
-action.risk.param._risk_score = 0
-action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Living Off The Land - Rule
+action.correlationsearch.label = ESCU - RIR - Living Off The Land - Rule
 action.correlationsearch.annotations = {"analytic_story": ["Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint"], "impact": 90, "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1105", "T1190", "T1059"], "nist": ["DE.CM"], "observable": [{"name": "affected_systems", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
 action.notable.param.rule_description = The following correlation identifies a distinct amount of analytics associated with the Living Off The Land analytic story that identify potentially suspicious behavior.
-action.notable.param.rule_title = Living Off The Land
+action.notable.param.rule_title = RBA: Living Off The Land
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
 alert.digest_mode = 1
@@ -22276,7 +22894,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count as risk_event_count, sum(All_Risk.calculated_risk_score) as risk_score, min(_time) as firstTime max(_time) as lastTime, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count from datamodel=Risk.All_Risk where All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object, All_Risk.risk_object_type, source | `drop_dm_object_name(All_Risk)` | stats  values(source) as source, sum(risk_score) as risk_score, sum(risk_event_count) as risk_event_count, values(annotations.mitre_attack.mitre_tactic) as annotations.mitre_attack.mitre_tactic min(firstTime) as firstTime max(lastTime) as lastTime, values(annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count dc(source) as source_count by risk_object, risk_object_type | where source_count >= 5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `living_off_the_land_filter`
+search = | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count from datamodel=Risk.All_Risk where All_Risk.analyticstories="Living Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where source_count >= 5 | `living_off_the_land_filter`
 
 [ESCU - Loading Of Dynwrapx Module - Rule]
 action.escu = 0
@@ -22413,30 +23031,25 @@ action.escu.data_models = ["Risk"]
 action.escu.eli5 = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically> Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` Call back to malicious LDAP server eg. Exploit.class Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
 action.escu.how_to_implement = To implement this correlation search a user needs to enable all detections in the Log4Shell Analytic Story and confirm it is generation risk events. A simple search `index=risk analyticstories="Log4Shell CVE-2021-44228"` should contain events.
 action.escu.known_false_positives = There are no known false positive for this search, but it could contain false positives as multiple detections can trigger and not have successful exploitation.
-action.escu.creation_date = 2022-08-26
-action.escu.modification_date = 2022-08-26
+action.escu.creation_date = 2022-09-09
+action.escu.modification_date = 2022-09-09
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Log4Shell CVE-2021-44228 Exploitation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = null
 action.escu.analytic_story = ["Log4Shell CVE-2021-44228"]
-action.risk = 1
-action.risk.param._risk_message = Log4Shell Exploitation detected against $affected_systems$
-action.risk.param._risk = [{"risk_object_field": "affected_systems", "risk_object_type": "system", "risk_score": 63}]
-action.risk.param._risk_score = 0
-action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Log4Shell CVE-2021-44228 Exploitation - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint"], "impact": 90, "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1105", "T1190", "T1059"], "nist": ["DE.CM"], "observable": [{"name": "affected_systems", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.label = ESCU - RIR - Log4Shell CVE-2021-44228 Exploitation - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint"], "impact": 90, "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1105", "T1190", "T1059"], "nist": ["DE.CM"], "observable": [{"name": "risk_object", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
 action.notable.param.rule_description = This correlation find exploitation of Log4Shell CVE-2021-44228 against systems using detections from Splunk Security Content Analytic Story. It does this by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume high problability of exploitation. The Analytic story breaks down into 3 major phases of a Log4Shell exploitation, specifically> Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}` Call back to malicious LDAP server eg. Exploit.class Post Exploitation Activity/Lateral Movement using Powershell or similar T1562.001 Each of these phases fall into different MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking into 2 or more phases showing up in detections triggerd is how this correlation search finds exploitation. If we get a notable from this correlation search the best way to triage it is by investigating the affected systems against Log4Shell exploitation using Splunk SOAR playbooks.
-action.notable.param.rule_title = Log4Shell CVE-2021-44228 Exploitation
+action.notable.param.rule_title = RBA: Log4Shell CVE-2021-44228 Exploitation
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
 alert.digest_mode = 1
@@ -22448,7 +23061,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count as risk_event_count, sum(All_Risk.calculated_risk_score) as risk_score, min(_time) as firstTime max(_time) as lastTime, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count from datamodel=Risk.All_Risk where All_Risk.analyticstories="Log4Shell CVE-2021-44228" All_Risk.risk_object_type="system" by All_Risk.risk_object, All_Risk.risk_object_type, source | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | stats  values(source) as source, sum(risk_score) as risk_score, sum(risk_event_count) as risk_event_count, values(annotations.mitre_attack.mitre_tactic) as annotations.mitre_attack.mitre_tactic min(firstTime) as firstTime max(lastTime) as lastTime, values(annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count dc(source) as source_count by risk_object, risk_object_type | where distinct_tactics >= 2 | `log4shell_cve_2021_44228_exploitation_filter`
+search = | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count from datamodel=Risk.All_Risk where All_Risk.analyticstories="Log4Shell CVE-2021-44228" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where source_count >= 2 | `log4shell_cve_2021_44228_exploitation_filter`
 
 [ESCU - Logon Script Event Trigger Execution - Rule]
 action.escu = 0
@@ -22972,7 +23585,7 @@ action.escu.full_search_name = ESCU - Modification Of Wallpaper - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Ransomware", "Revil Ransomware", "BlackMatter Ransomware", "Windows Registry Abuse"]
+action.escu.analytic_story = ["Ransomware", "Revil Ransomware", "BlackMatter Ransomware", "Windows Registry Abuse", "Brute Ratel C4"]
 action.risk = 1
 action.risk.param._risk_message = Wallpaper modification on $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 54}]
@@ -22983,7 +23596,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Modification Of Wallpaper - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware", "BlackMatter Ransomware", "Windows Registry Abuse"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware", "BlackMatter Ransomware", "Windows Registry Abuse", "Brute Ratel C4"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -26633,8 +27246,8 @@ action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This search is to detect a suspicious commandline designed to delete files or directory recursive using batch command. This technique was seen in ransomware (reddot) where it it tries to delete the files in recycle bin to impaire user from recovering deleted files.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 action.escu.known_false_positives = network operator may use this batch command to delete recursively a directory or files within directory
-action.escu.creation_date = 2021-06-22
-action.escu.modification_date = 2021-06-22
+action.escu.creation_date = 2022-11-12
+action.escu.modification_date = 2022-11-12
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Recursive Delete of Directory In Batch CMD - Rule
 action.escu.search_type = detection
@@ -26668,7 +27281,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*/c*  Processes.process=* rd * Processes.process="*/s*" Processes.process="*/q*" by Processes.user Processes.process_name Processes.parent_process_name Processes.parent_process Processes.process Processes.process_id Processes.dest |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recursive_delete_of_directory_in_batch_cmd_filter`
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*/c*  Processes.process="* rd *"  Processes.process="*/s*" Processes.process="*/q*" by Processes.user Processes.process_name Processes.parent_process_name Processes.parent_process Processes.process Processes.process_id Processes.dest |`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recursive_delete_of_directory_in_batch_cmd_filter`
 
 [ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule]
 action.escu = 0
@@ -27357,8 +27970,8 @@ action.escu.data_models = []
 action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may abuse WMI and this commandlet for lateral movement and remote code execution.
 action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 action.escu.known_false_positives = Administrators may leverage WWMI and powershell.exe to start a process on remote systems, but this activity is usually limited to a small set of hosts or users.
-action.escu.creation_date = 2021-11-15
-action.escu.modification_date = 2021-11-15
+action.escu.creation_date = 2022-11-15
+action.escu.modification_date = 2022-11-15
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Remote Process Instantiation via WMI and PowerShell Script Block - Rule
 action.escu.search_type = detection
@@ -27392,7 +28005,7 @@ relation = greater than
 quantity = 0
 realtime_schedule = 0
 is_visible = false
-search = `powershell` EventCode=4104 (Message="*Invoke-WmiMethod*" AND Message="*-CN*" AND Message="*-Class Win32_Process*" AND Message="*-Name create*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`
+search = `powershell` EventCode=4104 ScriptBlockText="*Invoke-WmiMethod*" AND (ScriptBlockText="*-CN*" OR ScriptBlockText="*-ComputerName*") AND ScriptBlockText="*-Class Win32_Process*" AND ScriptBlockText="*-Name create*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID|  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`
 
 [ESCU - Remote System Discovery with Adsisearcher - Rule]
 action.escu = 0
@@ -28748,7 +29361,7 @@ action.escu.full_search_name = ESCU - Scheduled Task Deleted Or Created via CMD
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["DHS Report TA18-074A", "NOBELIUM Group", "Windows Persistence Techniques", "Living Off The Land", "Azorult", "DarkCrystal RAT"]
+action.escu.analytic_story = ["DHS Report TA18-074A", "NOBELIUM Group", "Windows Persistence Techniques", "Living Off The Land", "Azorult", "DarkCrystal RAT", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = A schedule task process $process_name$ with create or delete commandline $process$ in host $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}]
@@ -28759,7 +29372,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Scheduled Task Deleted Or Created via CMD - Rule
-action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "NOBELIUM Group", "Windows Persistence Techniques", "Living Off The Land", "Azorult", "DarkCrystal RAT"], "cis20": ["CIS 3"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "NOBELIUM Group", "Windows Persistence Techniques", "Living Off The Land", "Azorult", "DarkCrystal RAT", "CISA AA22-257A"], "cis20": ["CIS 3"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -28840,7 +29453,7 @@ action.escu.full_search_name = ESCU - Schtasks Run Task On Demand - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["XMRig", "Industroyer2"]
+action.escu.analytic_story = ["XMRig", "Industroyer2", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = A "on demand" execution of schedule task process $process_name$  using commandline $process$ in host $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 48}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}]
@@ -28851,7 +29464,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Schtasks Run Task On Demand - Rule
-action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Industroyer2"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
+action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Industroyer2", "CISA AA22-257A"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -29609,7 +30222,7 @@ action.escu.full_search_name = ESCU - Short Lived Scheduled Task - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Microsoft Windows"]
-action.escu.analytic_story = ["Active Directory Lateral Movement"]
+action.escu.analytic_story = ["Active Directory Lateral Movement", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = A windows scheduled task was created and deleted in 30 seconds on $ComputerName$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}]
@@ -29620,7 +30233,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Short Lived Scheduled Task - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "CISA AA22-257A"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -30980,7 +31593,7 @@ action.escu.full_search_name = ESCU - Suspicious Process File Path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Data Destruction", "Double Zero Destructor", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper", "Industroyer2", "DarkCrystal RAT"]
+action.escu.analytic_story = ["Data Destruction", "Double Zero Destructor", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper", "Industroyer2", "DarkCrystal RAT", "Brute Ratel C4"]
 action.risk = 1
 action.risk.param._risk_message = Suspicioues process $Processes.process_path.file_path$ running from suspicious location
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}]
@@ -30991,7 +31604,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Suspicious Process File Path - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Data Destruction", "Double Zero Destructor", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper", "Industroyer2", "DarkCrystal RAT"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Data Destruction", "Double Zero Destructor", "XMRig", "Remcos", "WhisperGate", "Hermetic Wiper", "Industroyer2", "DarkCrystal RAT", "Brute Ratel C4"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -31608,7 +32221,7 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Active Directory Lateral Movement", "Living Off The Land"]
 action.risk = 1
-action.risk.param._risk_message = Svchost.exe spawned a LOLBAS process on $dest
+action.risk.param._risk_message = Svchost.exe spawned a LOLBAS process on $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 54}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
@@ -32544,7 +33157,7 @@ action.escu.full_search_name = ESCU - W3WP Spawning Shell - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Hermetic Wiper", "HAFNIUM Group", "ProxyShell"]
+action.escu.analytic_story = ["Hermetic Wiper", "HAFNIUM Group", "ProxyShell", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = Possible Web Shell execution on $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}]
@@ -32555,7 +33168,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - W3WP Spawning Shell - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "HAFNIUM Group", "ProxyShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "cve": ["CVE-2021-34473", "CVE-2021-34523", "CVE-2021-31207"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Hermetic Wiper", "HAFNIUM Group", "ProxyShell", "CISA AA22-257A"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "cve": ["CVE-2021-34473", "CVE-2021-34523", "CVE-2021-31207"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -32850,6 +33463,126 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wget (Processes.process="*-q *" OR Processes.process="*--quiet*"  AND Processes.process="*-O- *") OR (Processes.process="*|*" AND Processes.process="*bash*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wget_download_and_bash_execution_filter`
 
+[ESCU - Windows Access Token Manipulation SeDebugPrivilege - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies a suspicious process enabling the "SeDebugPrivilege" privilege token. SeDebugPrivilege allows a process to inspect and adjust the memory of other processes, and has long been a security concern. SeDebugPrivilege allows the token bearer to access any process or thread, regardless of security descriptors, per Palantir. This technique is abused by adversaries to gain debug privileges with their malicious software to be able to access or debug a process to dump credentials or to inject malicious code.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134.002", "T1134"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies a suspicious process enabling the "SeDebugPrivilege" privilege token. SeDebugPrivilege allows a process to inspect and adjust the memory of other processes, and has long been a security concern. SeDebugPrivilege allows the token bearer to access any process or thread, regardless of security descriptors, per Palantir. This technique is abused by adversaries to gain debug privileges with their malicious software to be able to access or debug a process to dump credentials or to inject malicious code.
+action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows Security Event Logs with 4703 EventCode enabled. The Windows TA is also required.
+action.escu.known_false_positives = Some native binaries and browser applications may request SeDebugPrivilege. Filter as needed.
+action.escu.creation_date = 2022-08-24
+action.escu.modification_date = 2022-08-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Access Token Manipulation SeDebugPrivilege - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Microsoft Windows"]
+action.escu.analytic_story = ["Brute Ratel C4"]
+action.risk = 1
+action.risk.param._risk_message = A process $ProcessName$ adjust its privileges with SeDebugPrivilege on $Computer$.
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 36}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Access Token Manipulation SeDebugPrivilege - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Brute Ratel C4"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134.002", "T1134"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `wineventlog_security` EventCode=4703 EnabledPrivilegeList = "*SeDebugPrivilege*" AND NOT(ProcessName IN ("*\\Program File*", "*\\System32\\lsass.exe*", "*\\SysWOW64\\lsass.exe*", "*\\SysWOW64\\svchost.exe*", "*\\System32\\svchost.exe*")) | stats count min(_time) as firstTime max(_time) as lastTime by Computer ProcessName ProcessId SubjectDomainName SubjectUserName SubjectUserSid TargetUserName TargetLogonId TargetDomainName EnabledPrivilegeList action | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_manipulation_sedebugprivilege_filter`
+
+[ESCU - Windows Access Token Manipulation Winlogon Duplicate Token Handle - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies a process requesting access to winlogon.exe attempting to duplicate its handle. This technique was seen in several adversaries to gain privileges for their process. Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134.001", "T1134"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies a process requesting access to winlogon.exe attempting to duplicate its handle. This technique was seen in several adversaries to gain privileges for their process. Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens.
+action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+action.escu.known_false_positives = It is possible legitimate applications will request access to winlogon, filter as needed.
+action.escu.creation_date = 2022-08-24
+action.escu.modification_date = 2022-08-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Access Token Manipulation Winlogon Duplicate Token Handle - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Brute Ratel C4"]
+action.risk = 1
+action.risk.param._risk_message = A process $SourceImage$ is duplicating the handle token of winlogon.exe in $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 36}, {"threat_object_field": "SourceImage", "threat_object_type": "process name"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Access Token Manipulation Winlogon Duplicate Token Handle - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Brute Ratel C4"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134.001", "T1134"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "SourceImage", "role": ["Parent Process"], "type": "Process Name"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `sysmon` EventCode=10 TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") GrantedAccess = 0x1040 | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage SourceProcessGUID TargetProcessGUID SourceProcessId TargetProcessId GrantedAccess CallTrace Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_manipulation_winlogon_duplicate_token_handle_filter`
+
+[ESCU - Windows Access Token Winlogon Duplicate Handle In Uncommon Path - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies a process requesting access in winlogon.exe to duplicate its handle with a non-common or public process source path. This technique was seen where adversaries attempt to gain privileges to their process. This duplicate handle access technique, may refer to a malicious process duplicating the process token of winlogon.exe and using it to a new process instance. Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134.001", "T1134"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies a process requesting access in winlogon.exe to duplicate its handle with a non-common or public process source path. This technique was seen where adversaries attempt to gain privileges to their process. This duplicate handle access technique, may refer to a malicious process duplicating the process token of winlogon.exe and using it to a new process instance. Winlogon.exe is the common targeted process of this technique because it contains high privileges and security tokens.
+action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+action.escu.known_false_positives = It is possible legitimate applications will request access to winlogon, filter as needed.
+action.escu.creation_date = 2022-08-24
+action.escu.modification_date = 2022-08-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Access Token Winlogon Duplicate Handle In Uncommon Path - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Brute Ratel C4"]
+action.risk = 1
+action.risk.param._risk_message = a process $SourceImage$ is duplicating the handle token of winlogon.exe in $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "SourceImage", "threat_object_type": "process name"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Access Token Winlogon Duplicate Handle In Uncommon Path - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Brute Ratel C4"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1134.001", "T1134"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "SourceImage", "role": ["Parent Process"], "type": "Process Name"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `sysmon` EventCode=10  TargetImage IN("*\\system32\\winlogon.exe*", "*\\SysWOW64\\winlogon.exe*") AND GrantedAccess = 0x1040 AND NOT (SourceImage IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage SourceProcessGUID TargetProcessGUID SourceProcessId TargetProcessId GrantedAccess CallTrace | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter`
+
 [ESCU - Windows AdFind Exe - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -32960,7 +33693,7 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["Windows Registry Abuse"]
 action.risk = 1
-action.risk.param._risk_message = the registry values for DirectoryServiceExtPt or LsaDbExtPt were modified on $dest$.
+action.risk.param._risk_message = The registry values for DirectoryServiceExtPt or LsaDbExtPt were modified on $dest$.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
@@ -33414,6 +34147,46 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process IN ("*-T *","*--upload-file *", "*-d *", "*--data *", "*-F *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_curl_upload_to_remote_destination_filter`
 
+[ESCU - Windows Defacement Modify Transcodedwallpaper File - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies a modification to the Transcodedwallpaper file in the wallpaper theme directory to change the wallpaper of the host machine. This technique was seen in adversaries attempting to deface or change the desktop wallpaper of the targeted host. During our testing, the common process that affects or changes the wallpaper if a user changes it via desktop personalized setting is explorer.exe.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies a modification to the Transcodedwallpaper file in the wallpaper theme directory to change the wallpaper of the host machine. This technique was seen in adversaries attempting to deface or change the desktop wallpaper of the targeted host. During our testing, the common process that affects or changes the wallpaper if a user changes it via desktop personalized setting is explorer.exe.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = 3rd part software application can change the wallpaper. Filter is needed.
+action.escu.creation_date = 2022-08-25
+action.escu.modification_date = 2022-08-25
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Defacement Modify Transcodedwallpaper File - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Brute Ratel C4"]
+action.risk = 1
+action.risk.param._risk_message = modification or creation of transcodedwallpaper file by $process_name$ in $dest$
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 9}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Defacement Modify Transcodedwallpaper File - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Brute Ratel C4"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_path !="*\\Windows\\Explorer.EXE" by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid  Processes.original_file_name | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path = "*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields file_name file_path process_name process_path process dest file_create_time _time proc_guid] | `windows_defacement_modify_transcodedwallpaper_file_filter`
+
 [ESCU - Windows Defender Exclusion Registry Entry - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -34354,6 +35127,46 @@ realtime_schedule = 0
 is_visible = false
 search = (`wineventlog_security` EventCode=1102) OR (`wineventlog_system` EventCode=104) | stats count min(_time) as firstTime max(_time) as lastTime by dest Message EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter`
 
+[ESCU - Windows Event Triggered Image File Execution Options Injection - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following hunting analytic identifies EventCode 3000 in Application channel indicating a process exit. This behavior is based on process names being added to the Image File Execution Options under HKLM \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ and \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit. Once these are set for a process, an eventcode 3000 will generate. The example used is from Thinkst Canary where a CanaryToken is setup to monitor for a commonly abused living off the land binary (ex. Klist.exe) and generate an event when it occurs. This can be seen as settings traps to monitor for suspicious behavior. Monitor and tune this hunting analytic and setup traps across your organization and begin monitoring.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1546.012"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following hunting analytic identifies EventCode 3000 in Application channel indicating a process exit. This behavior is based on process names being added to the Image File Execution Options under HKLM \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ and \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit. Once these are set for a process, an eventcode 3000 will generate. The example used is from Thinkst Canary where a CanaryToken is setup to monitor for a commonly abused living off the land binary (ex. Klist.exe) and generate an event when it occurs. This can be seen as settings traps to monitor for suspicious behavior. Monitor and tune this hunting analytic and setup traps across your organization and begin monitoring.
+action.escu.how_to_implement = This analytic requires capturing the Windows Event Log Application channel in XML.
+action.escu.known_false_positives = False positives may be present and tuning will be required before turning into a TTP or notable.
+action.escu.creation_date = 2022-09-08
+action.escu.modification_date = 2022-09-08
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Event Triggered Image File Execution Options Injection - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Windows Persistence Techniques"]
+action.risk = 1
+action.risk.param._risk_message = Windows eventcode 3000 triggered on $dest$ potentially indicating persistence or a monitoring of a process has occurred.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Event Triggered Image File Execution Options Injection - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1546.012"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `wineventlog_application` EventCode=3000 | rename param1 AS "Process" param2 AS "Exit_Code" | stats count min(_time) as firstTime max(_time) as lastTime by Process Exit_Code dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_triggered_image_file_execution_options_injection_filter`
+
 [ESCU - Windows Excessive Disabled Services Event - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -34532,6 +35345,46 @@ realtime_schedule = 0
 is_visible = false
 search = `powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" ScriptBlockText= "*SELECT*" ScriptBlockText= "*WHERE*" ScriptBlockText = "*PNPClass*" ScriptBlockText IN ("*Image*", "*Camera*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_gather_victim_host_information_camera_filter`
 
+[ESCU - Windows Gather Victim Identity SAM Info - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies a process that loads the samlib.dll module. This module is being abused by adversaries, threat actors and red teamers to access information of SAM objects or access credentials information in DC. This hunting query can be a good indicator that a process is capable of accessing the SAM object.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1589.001", "T1589"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies a process that loads the samlib.dll module. This module is being abused by adversaries, threat actors and red teamers to access information of SAM objects or access credentials information in DC. This hunting query can be a good indicator that a process is capable of accessing the SAM object.
+action.escu.how_to_implement = The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
+action.escu.known_false_positives = this module can be loaded by a third party application. Filter is needed.
+action.escu.creation_date = 2022-08-24
+action.escu.modification_date = 2022-08-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Gather Victim Identity SAM Info - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Brute Ratel C4"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $Computer$ that loads $ImageLoaded$ that are related to accessing to SAM object information.
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 9}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Gather Victim Identity SAM Info - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Brute Ratel C4"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1589.001", "T1589"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `sysmon` EventCode=7  (ImageLoaded = "*\\samlib.dll" AND OriginalFileName = "samlib.dll") OR (ImageLoaded = "*\\samcli.dll" AND OriginalFileName = "SAMCLI.DLL") AND NOT (Image IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_gather_victim_identity_sam_info_filter`
+
 [ESCU - Windows Gather Victim Network Info Through Ip Check Web Services - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -34634,7 +35487,7 @@ action.escu.full_search_name = ESCU - Windows Hidden Schedule Task Settings - Ru
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Microsoft Windows"]
-action.escu.analytic_story = ["Industroyer2", "Active Directory Discovery"]
+action.escu.analytic_story = ["Industroyer2", "Active Directory Discovery", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = A schedule task with hidden setting enable in host $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}]
@@ -34645,7 +35498,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Windows Hidden Schedule Task Settings - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Industroyer2", "Active Directory Discovery"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Industroyer2", "Active Directory Discovery", "CISA AA22-257A"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -34744,6 +35597,46 @@ realtime_schedule = 0
 is_visible = false
 search = `sysmon` EventCode=23 TargetFilename IN ("*.cmd", "*.ini","*.gif", "*.jpg", "*.jpeg", "*.db", "*.ps1", "*.doc*", "*.xls*", "*.ppt*", "*.bmp","*.zip", "*.rar", "*.7z", "*.chm", "*.png", "*.log", "*.vbs", "*.js", "*.vhd", "*.bak", "*.wbcat", "*.bkf" , "*.backup*", "*.dsk", "*.win") | stats values(TargetFilename) as deleted_files min(_time) as firstTime max(_time) as lastTime count by Computer user EventCode Image ProcessID |where count >=100 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_high_file_deletion_frequency_filter`
 
+[ESCU - Windows Hijack Execution Flow Version Dll Side Load - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = This analytic is to detect a process loading version.dll that is not in %windir%\\system32 or %windir%\\syswow64 dir path. This event is seen in ransomware and APT malware that executes malicious version.dll placed in the same folder of onedrive application that will execute that module. This technique is known to be DLL side loading. This technique was used to execute an agent of Brute Ratel C4 red teaming tools to serve as remote admin tool to collect and compromise target host.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.001", "T1574"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = This analytic is to detect a process loading version.dll that is not in %windir%\\system32 or %windir%\\syswow64 dir path. This event is seen in ransomware and APT malware that executes malicious version.dll placed in the same folder of onedrive application that will execute that module. This technique is known to be DLL side loading. This technique was used to execute an agent of Brute Ratel C4 red teaming tools to serve as remote admin tool to collect and compromise target host.
+action.escu.how_to_implement = The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
+action.escu.known_false_positives = unknown
+action.escu.creation_date = 2022-08-24
+action.escu.modification_date = 2022-08-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Hijack Execution Flow Version Dll Side Load - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Brute Ratel C4"]
+action.risk = 1
+action.risk.param._risk_message = a process $Image$ loading $ImageLoaded$ as a side load dll in $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 35}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Hijack Execution Flow Version Dll Side Load - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Brute Ratel C4"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.001", "T1574"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `sysmon` EventCode=7 ImageLoaded = "*\\version.dll" AND (Signed = "false" OR NOT(ImageLoaded IN("*\\windows\\system32*",  "*\\windows\\syswow64\\*"))) | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded process_name Computer EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_hijack_execution_flow_version_dll_side_load_filter`
+
 [ESCU - Windows Hunting System Account Targeting Lsass - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -34787,14 +35680,14 @@ search = `sysmon` EventCode=10 TargetImage=*lsass.exe | stats count min(_time) a
 [ESCU - Windows Identify Protocol Handlers - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings). To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL in the property to limit the scope of this query to similar handlers as ms-msdt.
+description = The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings). To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell.
 action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "nist": ["DE.CM"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings). To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell: get-Item Registry::HKEY_CLASSES_ROOT\* | Select-Object "Property","PSChildName" | Where-Object -Property Property -Match "^URL*" #|Export-Csv -path c:\temp\url_all.csv. Note my query is limited to URL in the property to limit the scope of this query to similar handlers as ms-msdt.
+action.escu.eli5 = The following hunting analytic will identify any protocol handlers utilized on the command-line. A protocol handler is an application that knows how to handle particular types of links: for example, a mail client is a protocol handler for "mailto:" links. When the user clicks a "mailto:" link, the browser opens the application selected as the handler for the "mailto:" protocol (or offers them a choice of handlers, depending on their settings). To identify protocol handlers we can use NirSoft https://www.nirsoft.net/utils/url_protocol_view.html URLProtocolView or query the registry using PowerShell.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 action.escu.known_false_positives = False positives will be found. https and http is a URL Protocol handler that will trigger this analytic. Tune based on process or command-line.
-action.escu.creation_date = 2022-07-11
-action.escu.modification_date = 2022-07-11
+action.escu.creation_date = 2022-09-13
+action.escu.modification_date = 2022-09-13
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Identify Protocol Handlers - Rule
 action.escu.search_type = detection
@@ -35125,14 +36018,14 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime
 [ESCU - Windows Ingress Tool Transfer Using Explorer - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = The following analytic detects an explorer.exe with a possible url link process command line on it. Explorer.exe is known windows process that handle start menu, taskbar ,desktop and file manager. So many threat actor abuses this process like DCRat malware, where it tries to open the url link with the default process browser application in the target host by putting the url link as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check which user and how this process was executed, what is the parent process and what is the url link. This technique is not so common way to open an url link.
+description = The following analytic identifies the Windows Explorer process with a URL within the command-line. Explorer.exe is known Windows process that handles start menu, taskbar, desktop and file manager. Many adversaries abuse this process, like DCRat malware, where it attempts to open the URL with the default browser application on the target host by putting the URL as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check which user and how this process was executed, what is the parent process and what is the URL link. This technique is not commonly used to open an URL.
 action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "nist": ["DE.CM"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = The following analytic detects an explorer.exe with a possible url link process command line on it. Explorer.exe is known windows process that handle start menu, taskbar ,desktop and file manager. So many threat actor abuses this process like DCRat malware, where it tries to open the url link with the default process browser application in the target host by putting the url link as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check which user and how this process was executed, what is the parent process and what is the url link. This technique is not so common way to open an url link.
+action.escu.eli5 = The following analytic identifies the Windows Explorer process with a URL within the command-line. Explorer.exe is known Windows process that handles start menu, taskbar, desktop and file manager. Many adversaries abuse this process, like DCRat malware, where it attempts to open the URL with the default browser application on the target host by putting the URL as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check which user and how this process was executed, what is the parent process and what is the URL link. This technique is not commonly used to open an URL.
 action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-action.escu.known_false_positives = unknown
-action.escu.creation_date = 2022-08-01
-action.escu.modification_date = 2022-08-01
+action.escu.known_false_positives = False positives may be present based on legitimate applications or third party utilities. Filter out any additional parent process names.
+action.escu.creation_date = 2022-08-30
+action.escu.modification_date = 2022-08-30
 action.escu.confidence = high
 action.escu.full_search_name = ESCU - Windows Ingress Tool Transfer Using Explorer - Rule
 action.escu.search_type = detection
@@ -35140,8 +36033,8 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
 action.escu.analytic_story = ["DarkCrystal RAT"]
 action.risk = 1
-action.risk.param._risk_message = a explorer process with url link $process$ in $dest$
-action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}]
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a remote payload.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
 action.risk.param._risk_score = 0
 action.risk.param.verbose = 0
 cron_schedule = 0 * * * *
@@ -35149,7 +36042,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Windows Ingress Tool Transfer Using Explorer - Rule
-action.correlationsearch.annotations = {"analytic_story": ["DarkCrystal RAT"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["DarkCrystal RAT"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -35162,6 +36055,46 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = explorer.exe OR Processes.original_file_name = explorer.exe) AND NOT (Processes.parent_process_name IN("userinit.exe", "svchost.exe")) Processes.process IN ("* http://*", "* https://*") by  Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_ingress_tool_transfer_using_explorer_filter`
 
+[ESCU - Windows Input Capture Using Credential UI Dll - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies a process that loads the credui.dll module. This legitimate module is typically abused by adversaries, threat actors and red teamers to create a credential UI prompt dialog box to lure users for possible credential theft or can be used to dump the credentials of a targeted host. This hunting query is a good pivot to check why the process loaded this dll and if it is a legitimate file. This hunting query may hit false positive for a third party application that uses a credential login UI for user login.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1056.002", "T1056"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies a process that loads the credui.dll module. This legitimate module is typically abused by adversaries, threat actors and red teamers to create a credential UI prompt dialog box to lure users for possible credential theft or can be used to dump the credentials of a targeted host. This hunting query is a good pivot to check why the process loaded this dll and if it is a legitimate file. This hunting query may hit false positive for a third party application that uses a credential login UI for user login.
+action.escu.how_to_implement = The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
+action.escu.known_false_positives = this module can be loaded by a third party application. Filter is needed.
+action.escu.creation_date = 2022-08-24
+action.escu.modification_date = 2022-08-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Input Capture Using Credential UI Dll - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Brute Ratel C4"]
+action.risk = 1
+action.risk.param._risk_message = a process $Image$ loaded $ImageLoaded$ in $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 9}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Input Capture Using Credential UI Dll - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Brute Ratel C4"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1056.002", "T1056"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `sysmon` EventCode=7  (ImageLoaded = "*\\credui.dll" AND OriginalFileName = "credui.dll") OR (ImageLoaded = "*\\wincredui.dll" AND OriginalFileName = "wincredui.dll") AND NOT(Image IN("*\\windows\\explorer.exe", "*\\windows\\system32\\*", "*\\windows\\sysWow64\\*", "*:\\program files*")) | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded OriginalFileName Computer EventCode Signed ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_input_capture_using_credential_ui_dll_filter`
+
 [ESCU - Windows InstallUtil Credential Theft - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -35551,7 +36484,7 @@ action.escu.full_search_name = ESCU - Windows ISO LNK File Creation - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Spearphishing Attachments"]
+action.escu.analytic_story = ["Spearphishing Attachments", "Brute Ratel C4"]
 action.risk = 1
 action.risk.param._risk_message = An ISO file was mounted on $dest$ and should be reviewed and filtered as needed.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}]
@@ -35562,7 +36495,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Windows ISO LNK File Creation - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint"], "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001", "T1566", "T1204.001", "T1204"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Brute Ratel C4"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint"], "impact": 80, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001", "T1566", "T1204.001", "T1204"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -36631,6 +37564,46 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe") Processes.process_name=msdt.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawning_msdt_filter`
 
+[ESCU - Windows Phishing Recent ISO Exec Registry - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following hunting analytic identifies registry artifacts when an ISO container is opened, clicked or mounted on the Windows operating system. As Microsoft makes changes to macro based document execution, adversaries have begun to utilize container based initial access based phishing campaigns to evade preventative controls. Once the ISO is clicked or mounted it will create a registry artifact related to this event as a recent application executed or opened.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001", "T1566"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following hunting analytic identifies registry artifacts when an ISO container is opened, clicked or mounted on the Windows operating system. As Microsoft makes changes to macro based document execution, adversaries have begun to utilize container based initial access based phishing campaigns to evade preventative controls. Once the ISO is clicked or mounted it will create a registry artifact related to this event as a recent application executed or opened.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives may be high depending on the environment and consistent use of ISOs. Restrict to servers, or filter out based on commonly used ISO names. Filter as needed.
+action.escu.creation_date = 2022-08-24
+action.escu.modification_date = 2022-08-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Phishing Recent ISO Exec Registry - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Brute Ratel C4"]
+action.risk = 1
+action.risk.param._risk_message = An ISO file was mounted on $dest$ and should be reviewed and filtered as needed.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Phishing Recent ISO Exec Registry - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Brute Ratel C4"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint"], "impact": 50, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566.001", "T1566"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_key_name= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs\\.iso" by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_phishing_recent_iso_exec_registry_filter`
+
 [ESCU - Windows Possible Credential Dumping - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -36655,7 +37628,7 @@ action.escu.full_search_name = ESCU - Windows Possible Credential Dumping - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = null
-action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack", "DarkSide Ransomware"]
+action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack", "DarkSide Ransomware", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related to credential dumping on $dest$. Review for further details.
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "ImageLoaded", "threat_object_type": "process"}, {"threat_object_field": "SourceImage", "threat_object_type": "process"}]
@@ -36666,7 +37639,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Windows Possible Credential Dumping - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack", "DarkSide Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Process"}, {"name": "SourceImage", "role": ["Child Process"], "type": "Process"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack", "DarkSide Ransomware", "CISA AA22-257A"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Process"}, {"name": "SourceImage", "role": ["Child Process"], "type": "Process"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -36919,6 +37892,46 @@ realtime_schedule = 0
 is_visible = false
 search = `powershell` EventCode=4104 (Message = "*Get-DomainComputer*" OR Message = "*Get-NetComputer*") AND (Message = "*-Unconstrained*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_powerview_unconstrained_delegation_discovery_filter`
 
+[ESCU - Windows Process Injection With Public Source Path - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies a process in a non-standard file path on Windows attempting to create a remote thread into a process. This Windows API,CreateRemoteThread, is commonly used by adversaries for process injection to evade detections or gain privilege escalation.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1055.002"], "nist": ["DE.CM"]}
+action.escu.data_models = []
+action.escu.eli5 = The following analytic identifies a process in a non-standard file path on Windows attempting to create a remote thread into a process. This Windows API,CreateRemoteThread, is commonly used by adversaries for process injection to evade detections or gain privilege escalation.
+action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+action.escu.known_false_positives = Some security products or third party applications may utilize CreateRemoteThread, filter as needed before enabling as a notable.
+action.escu.creation_date = 2022-08-24
+action.escu.modification_date = 2022-08-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Process Injection With Public Source Path - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = null
+action.escu.analytic_story = ["Brute Ratel C4"]
+action.risk = 1
+action.risk.param._risk_message = process $SourceImage$ create a remote thread to process $TargetImage$ on host $Computer$
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "SourceImage", "threat_object_type": "process"}, {"threat_object_field": "TargetImage", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Process Injection With Public Source Path - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Brute Ratel C4"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1055.002"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "Process"}, {"name": "TargetImage", "role": ["Target"], "type": "Process"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `sysmon` EventCode=8 TargetImage = "*.exe" AND NOT(SourceImage IN("C:\\Windows\\*", "C:\\Program File*", "%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by SourceImage TargetImage signature TargetProcessGuid SourceProcessGuid TargetProcessId SourceProcessId StartAddress EventCode Computer | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_process_injection_with_public_source_path_filter`
+
 [ESCU - Windows Process With NamedPipe CommandLine - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -36999,6 +38012,52 @@ realtime_schedule = 0
 is_visible = false
 search = `sysmon` EventCode=5 process_name IN ("PServiceControl.exe", "PService_PPD.exe") | stats min(_time) as firstTime max(_time) as lastTime count by process_name process process_path process_guid process_id EventCode dest user_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_processes_killed_by_industroyer2_malware_filter`
 
+[ESCU - Windows Protocol Tunneling with Plink - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the use of Plink being utilized to proxy egress or laterally in an organization. The analytic is limited to specific Plink options on the command-line, including -R -L and -D which will have the remote and local IP address or port and -l for a username. Modify the options as seen fit for your organization.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1572", "T1021.004"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies the use of Plink being utilized to proxy egress or laterally in an organization. The analytic is limited to specific Plink options on the command-line, including -R -L and -D which will have the remote and local IP address or port and -l for a username. Modify the options as seen fit for your organization.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives may be present if the organization allows for SSH tunneling outbound or internally. Filter as needed.
+action.escu.creation_date = 2022-09-15
+action.escu.modification_date = 2022-09-15
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Protocol Tunneling with Plink - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["CISA AA22-257A"]
+action.risk = 1
+action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to tunnel to a remote destination.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Protocol Tunneling with Plink - Rule
+action.correlationsearch.annotations = {"analytic_story": ["CISA AA22-257A"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command \u0026 Control"], "mitre_attack": ["T1572", "T1021.004"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the use of Plink being utilized to proxy egress or laterally in an organization. The analytic is limited to specific Plink options on the command-line, including -R -L and -D which will have the remote and local IP address or port and -l for a username. Modify the options as seen fit for your organization.
+action.notable.param.rule_title = Windows Protocol Tunneling with Plink
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=plink.exe OR Processes.original_file_name=Plink Processes.process IN ("*-R *", "*-L *", "*-D *", "*-l *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_protocol_tunneling_with_plink_filter`
+
 [ESCU - Windows Raccine Scheduled Task Deletion - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -37315,6 +38374,46 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.registry_path IN ("*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal\\*","*SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\*") by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.process_guid Registry.registry_key_name Registry.registry_value_data | `drop_dm_object_name(Registry)` | join process_guid _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)`] | table _time dest user process_name process process_guid registry_path registry_value_name registry_value_data registry_key_name | `windows_registry_modification_for_safe_mode_persistence_filter`
 
+[ESCU - Windows Remote Access Software BRC4 Loaded Dll - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following anomaly detection identifies the behavior related to 4 native Windows DLLs being loaded by a non-standard process. Identified by MDSec during their research into Brute Ratel, MDSec identified a high signal analytic by calling out these 4 DLLs being loaded into a process. LogonCLI.dll is the Net Logon Client DLL and is related to users and other domain services to get authenticated. Credui.dll is Credential Manager User Interface. Credential managers receive notifications when authentication information changes. For example, credential managers are notified when a user logs on or an account password changes. Samcli.dll is the Security Accounts Manager Client DLL. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. Dbghelp.dll is Windows Image Helper. Windows Image Helper is commonly seen in credential dumping due to native functions. All of these modules are important to monitor and track and combined may lead to credentail access or dumping.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1219", "T1003"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following anomaly detection identifies the behavior related to 4 native Windows DLLs being loaded by a non-standard process. Identified by MDSec during their research into Brute Ratel, MDSec identified a high signal analytic by calling out these 4 DLLs being loaded into a process. LogonCLI.dll is the Net Logon Client DLL and is related to users and other domain services to get authenticated. Credui.dll is Credential Manager User Interface. Credential managers receive notifications when authentication information changes. For example, credential managers are notified when a user logs on or an account password changes. Samcli.dll is the Security Accounts Manager Client DLL. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. Dbghelp.dll is Windows Image Helper. Windows Image Helper is commonly seen in credential dumping due to native functions. All of these modules are important to monitor and track and combined may lead to credentail access or dumping.
+action.escu.how_to_implement = The latest Sysmon TA 3.0 https://splunkbase.splunk.com/app/5709 will add the ImageLoaded name to the process_name field, allowing this query to work. Use as an example and implement for other products.
+action.escu.known_false_positives = This module can be loaded by a third party application. Filter is needed.
+action.escu.creation_date = 2022-08-24
+action.escu.modification_date = 2022-08-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Remote Access Software BRC4 Loaded Dll - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Brute Ratel C4"]
+action.risk = 1
+action.risk.param._risk_message = a process $Image$ loaded several modules $ImageLoaded$ that might related to credential access on $Computer$.
+action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 9}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Remote Access Software BRC4 Loaded Dll - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Brute Ratel C4"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 30, "context": ["Source:Endpoint"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1219", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = `sysmon` EventCode=7 |bin _time span=30s | eval BRC4_AnomalyLoadedDll=case(OriginalFileName=="credui.dll", 1, OriginalFileName=="DBGHELP.DLL", 1, OriginalFileName=="SAMCLI.DLL", 1, OriginalFileName=="winhttp.dll", 1, 1=1, 0) | eval BRC4_LoadedDllPath=case(match(ImageLoaded, "credui.dll"), 1, match(ImageLoaded, "dbghelp.dll"), 1, match(ImageLoaded, "samcli.dll"), 1, match(ImageLoaded, "winhttp.dll"), 1, 1=1, 0) | stats count min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as ImageLoaded values(OriginalFileName) as OriginalFileName dc(ImageLoaded) as ImageLoadedCount by Image  BRC4_LoadedDllPath BRC4_AnomalyLoadedDll Computer EventCode Signed | where  ImageLoadedCount == 4 AND (BRC4_LoadedDllPath == 1 OR BRC4_AnomalyLoadedDll == 1) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_remote_access_software_brc4_loaded_dll_filter`
+
 [ESCU - Windows Remote Access Software Hunt - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -37797,23 +38896,23 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=sc.exe Processes.process="*kernel*" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_create_kernel_mode_driver_filter`
 
-[ESCU - Windows Service Created With Suspicious Service Path - Rule]
+[ESCU - Windows Service Created with Suspicious Service Path - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = The following analytc uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path path is located in a non-common Service folder in Windows. Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution as well as persistence and execution. The Clop ransomware has also been seen in the wild abusing Windows services.
+description = The following analytics uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path path is located in a non-common Service folder in Windows. Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution as well as persistence and execution. The Clop ransomware has also been seen in the wild abusing Windows services.
 action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569", "T1569.002"]}
 action.escu.data_models = []
-action.escu.eli5 = The following analytc uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path path is located in a non-common Service folder in Windows. Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution as well as persistence and execution. The Clop ransomware has also been seen in the wild abusing Windows services.
+action.escu.eli5 = The following analytics uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path path is located in a non-common Service folder in Windows. Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution as well as persistence and execution. The Clop ransomware has also been seen in the wild abusing Windows services.
 action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints.
 action.escu.known_false_positives = Legitimate applications may install services with uncommon services paths.
-action.escu.creation_date = 2021-11-22
-action.escu.modification_date = 2021-11-22
+action.escu.creation_date = 2022-08-26
+action.escu.modification_date = 2022-08-26
 action.escu.confidence = high
-action.escu.full_search_name = ESCU - Windows Service Created With Suspicious Service Path - Rule
+action.escu.full_search_name = ESCU - Windows Service Created with Suspicious Service Path - Rule
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = null
-action.escu.analytic_story = ["Clop Ransomware", "Active Directory Lateral Movement"]
+action.escu.analytic_story = ["Clop Ransomware", "Active Directory Lateral Movement", "Brute Ratel C4"]
 action.risk = 1
 action.risk.param._risk_message = A service $Service_File_Name$ was created from a non-standard path using $Service_Name$
 action.risk.param._risk = [{"threat_object_field": "Service_File_Name", "threat_object_type": "other"}, {"threat_object_field": "Service_Name", "threat_object_type": "other"}]
@@ -37823,13 +38922,13 @@ cron_schedule = 0 * * * *
 dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
-action.correlationsearch.label = ESCU - Windows Service Created With Suspicious Service Path - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware", "Active Directory Lateral Movement"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569", "T1569.002"], "observable": [{"name": "Service_File_Name", "role": ["Other"], "type": "Other"}, {"name": "Service_Name", "role": ["Other"], "type": "Other"}]}
+action.correlationsearch.label = ESCU - Windows Service Created with Suspicious Service Path - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware", "Active Directory Lateral Movement", "Brute Ratel C4"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1569", "T1569.002"], "observable": [{"name": "Service_File_Name", "role": ["Other"], "type": "Other"}, {"name": "Service_Name", "role": ["Other"], "type": "Other"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
-action.notable.param.rule_description = The following analytc uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path path is located in a non-common Service folder in Windows. Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution as well as persistence and execution. The Clop ransomware has also been seen in the wild abusing Windows services.
-action.notable.param.rule_title = Windows Service Created With Suspicious Service Path
+action.notable.param.rule_description = The following analytics uses Windows Event Id 7045, `New Service Was Installed`, to identify the creation of a Windows Service where the service binary path path is located in a non-common Service folder in Windows. Red Teams and adversaries alike may create malicious Services for lateral movement or remote code execution as well as persistence and execution. The Clop ransomware has also been seen in the wild abusing Windows services.
+action.notable.param.rule_title = Windows Service Created with Suspicious Service Path
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = high
 alert.digest_mode = 1
@@ -37951,7 +39050,7 @@ action.escu.full_search_name = ESCU - Windows Service Creation Using Registry En
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["Active Directory Lateral Movement", "Suspicious Windows Registry Activities", "Windows Persistence Techniques", "Windows Registry Abuse"]
+action.escu.analytic_story = ["Active Directory Lateral Movement", "Suspicious Windows Registry Activities", "Windows Persistence Techniques", "Windows Registry Abuse", "Brute Ratel C4"]
 action.risk = 1
 action.risk.param._risk_message = A Windows Service was created on a endpoint from $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}]
@@ -37962,7 +39061,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Windows Service Creation Using Registry Entry - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "Suspicious Windows Registry Activities", "Windows Persistence Techniques", "Windows Registry Abuse"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Lateral Movement", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.011"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "Suspicious Windows Registry Activities", "Windows Persistence Techniques", "Windows Registry Abuse", "Brute Ratel C4"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Lateral Movement", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.011"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -37981,6 +39080,46 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` count  min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" Registry.registry_value_name = ImagePath by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data] | table _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data | `windows_service_creation_using_registry_entry_filter`
 
+[ESCU - Windows Service Deletion In Registry - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies a service being deleted from the Windows Registry under CurrentControlSet\Services. Adversaries may delete a service as part of defense evasion.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies a service being deleted from the Windows Registry under CurrentControlSet\Services. Adversaries may delete a service as part of defense evasion.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored.
+action.escu.known_false_positives = This event can be seen when administrator delete a service or uninstall/reinstall a software that creates service entry, but it is still recommended to check this alert with high priority.
+action.escu.creation_date = 2022-08-24
+action.escu.modification_date = 2022-08-24
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows Service Deletion In Registry - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Brute Ratel C4"]
+action.risk = 1
+action.risk.param._risk_message = A service was deleted on $dest$ within the Windows registry.
+action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows Service Deletion In Registry - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Brute Ratel C4"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+schedule_window = auto
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SYSTEM\\CurrentControlSet\\Services*" AND (Registry.action = deleted OR (Registry.registry_value_name = DeleteFlag AND Registry.registry_value_data = 0x00000001 AND Registry.action=modified)) by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_value_name Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_deletion_in_registry_filter`
+
 [ESCU - Windows Service Initiation on Remote Endpoint - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -38073,6 +39212,52 @@ realtime_schedule = 0
 is_visible = false
 search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = sc.exe OR Processes.original_file_name = sc.exe) Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_stop_by_deletion_filter`
 
+[ESCU - Windows System Binary Proxy Execution Compiled HTML File Decompile - Rule]
+action.escu = 0
+action.escu.enabled = 1
+description = The following analytic identifies the decompile parameter with the HTML Help application, HH.exe. This is a uncommon command to see ran and behavior. Most recently this was seen in a APT41 campaign where a CHM file was delivered and a script inside used a technique for running an arbitrary command in a CHM file via an ActiveX object. This unpacks an HTML help file to a specified path for launching the next stage.
+action.escu.mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1218.001", "T1218"], "nist": ["DE.CM"]}
+action.escu.data_models = ["Endpoint"]
+action.escu.eli5 = The following analytic identifies the decompile parameter with the HTML Help application, HH.exe. This is a uncommon command to see ran and behavior. Most recently this was seen in a APT41 campaign where a CHM file was delivered and a script inside used a technique for running an arbitrary command in a CHM file via an ActiveX object. This unpacks an HTML help file to a specified path for launching the next stage.
+action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+action.escu.known_false_positives = False positives should be limited, filter as needed.
+action.escu.creation_date = 2022-08-31
+action.escu.modification_date = 2022-08-31
+action.escu.confidence = high
+action.escu.full_search_name = ESCU - Windows System Binary Proxy Execution Compiled HTML File Decompile - Rule
+action.escu.search_type = detection
+action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
+action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
+action.escu.analytic_story = ["Suspicious Compiled HTML Activity", "Living Off The Land"]
+action.risk = 1
+action.risk.param._risk_message = $process_name$ has been identified using decompile against a CHM on $dest$ under user $user$.
+action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "process_name", "threat_object_type": "process"}]
+action.risk.param._risk_score = 0
+action.risk.param.verbose = 0
+cron_schedule = 0 * * * *
+dispatch.earliest_time = -70m@m
+dispatch.latest_time = -10m@m
+action.correlationsearch.enabled = 1
+action.correlationsearch.label = ESCU - Windows System Binary Proxy Execution Compiled HTML File Decompile - Rule
+action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity", "Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 100, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1218.001", "T1218"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]}
+schedule_window = auto
+action.notable = 1
+action.notable.param.nes_fields = user,dest
+action.notable.param.rule_description = The following analytic identifies the decompile parameter with the HTML Help application, HH.exe. This is a uncommon command to see ran and behavior. Most recently this was seen in a APT41 campaign where a CHM file was delivered and a script inside used a technique for running an arbitrary command in a CHM file via an ActiveX object. This unpacks an HTML help file to a specified path for launching the next stage.
+action.notable.param.rule_title = Windows System Binary Proxy Execution Compiled HTML File Decompile
+action.notable.param.security_domain = endpoint
+action.notable.param.severity = high
+alert.digest_mode = 1
+disabled = true
+enableSched = 1
+allow_skew = 100%
+counttype = number of events
+relation = greater than
+quantity = 0
+realtime_schedule = 0
+is_visible = false
+search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_hh` Processes.process=*-decompile* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_binary_proxy_execution_compiled_html_file_decompile_filter`
+
 [ESCU - Windows System File on Disk - Rule]
 action.escu = 0
 action.escu.enabled = 1
@@ -38469,7 +39654,7 @@ action.escu.full_search_name = ESCU - WinEvent Scheduled Task Created to Spawn S
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Microsoft Windows"]
-action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"]
+action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "Command", "threat_object_type": "unknown"}]
@@ -38480,7 +39665,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Command", "role": ["Target"], "type": "Unknown"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware", "CISA AA22-257A"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Command", "role": ["Target"], "type": "Unknown"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -38527,7 +39712,7 @@ action.escu.full_search_name = ESCU - WinEvent Scheduled Task Created Within Pub
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Microsoft Windows"]
-action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware", "IcedID", "Active Directory Lateral Movement", "Industroyer2"]
+action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware", "IcedID", "Active Directory Lateral Movement", "Industroyer2", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "Command", "threat_object_type": "unknown"}]
@@ -38538,7 +39723,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - WinEvent Scheduled Task Created Within Public Path - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware", "IcedID", "Active Directory Lateral Movement", "Industroyer2"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Command", "role": ["Target"], "type": "Unknown"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware", "IcedID", "Active Directory Lateral Movement", "Industroyer2", "CISA AA22-257A"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Command", "role": ["Target"], "type": "Unknown"}]}
 schedule_window = auto
 action.notable = 1
 action.notable.param.nes_fields = user,dest
@@ -38577,7 +39762,7 @@ action.escu.full_search_name = ESCU - WinEvent Windows Task Scheduler Event Acti
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Sysmon", "Microsoft Windows", "Carbon Black Response", "CrowdStrike Falcon", "Symantec Endpoint Protection"]
-action.escu.analytic_story = ["IcedID", "Windows Persistence Techniques", "Industroyer2", "DarkCrystal RAT"]
+action.escu.analytic_story = ["IcedID", "Windows Persistence Techniques", "Industroyer2", "DarkCrystal RAT", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = A Scheduled Task was scheduled and ran on $dest$.
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}]
@@ -38588,7 +39773,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - WinEvent Windows Task Scheduler Event Action Started - Rule
-action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Persistence Techniques", "Industroyer2", "DarkCrystal RAT"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Windows Persistence Techniques", "Industroyer2", "DarkCrystal RAT", "CISA AA22-257A"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -41539,7 +42724,7 @@ action.escu.full_search_name = ESCU - Randomly Generated Scheduled Task Name - R
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = ["Microsoft Windows"]
-action.escu.analytic_story = ["Active Directory Lateral Movement"]
+action.escu.analytic_story = ["Active Directory Lateral Movement", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = A windows scheduled task with a suspicious task name was created on $dest$
 action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 45}]
@@ -41550,7 +42735,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Randomly Generated Scheduled Task Name - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053", "T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "CISA AA22-257A"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053", "T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
@@ -44102,7 +45287,7 @@ action.escu.full_search_name = ESCU - Log4Shell JNDI Payload Injection Attempt -
 action.escu.search_type = detection
 action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"]
 action.escu.providing_technologies = null
-action.escu.analytic_story = ["Log4Shell CVE-2021-44228"]
+action.escu.analytic_story = ["Log4Shell CVE-2021-44228", "CISA AA22-257A"]
 action.risk = 1
 action.risk.param._risk_message = CVE-2021-44228 Log4Shell triggered for host $dest$
 action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}]
@@ -44113,7 +45298,7 @@ dispatch.earliest_time = -70m@m
 dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = ESCU - Log4Shell JNDI Payload Injection Attempt - Rule
-action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 30, "context": ["Source:Application Log", "Stage:Execution"], "cve": ["CVE-2021-44228"], "impact": 50, "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
+action.correlationsearch.annotations = {"analytic_story": ["Log4Shell CVE-2021-44228", "CISA AA22-257A"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 30, "context": ["Source:Application Log", "Stage:Execution"], "cve": ["CVE-2021-44228"], "impact": 50, "kill_chain_phases": ["Reconnaissance", "Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]}
 schedule_window = auto
 alert.digest_mode = 1
 disabled = true
diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf
index 1923951d6a..6571546502 100644
--- a/dist/escu/default/transforms.conf
+++ b/dist/escu/default/transforms.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-08-29T17:38:30 UTC
+# On Date: 2022-09-20T15:09:11 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -271,6 +271,14 @@ external_type = kvstore
 # description = A table of users seen doing console logins, and the first and last time that the activity was observed
 fields_list = _key, firstTime, lastTime, user, src, City, Region, Country
 
+[privileged_azure_ad_roles]
+filename = privileged_azure_ad_roles.csv
+default_match = false
+case_sensitive_match = false
+# description = A list of privileged Azure Active Directory roles.
+match_type = WILDCARD(azureadrole)
+min_matches = 1
+
 [prohibited_apps_launching_cmd]
 filename = prohibited_apps_launching_cmd.csv
 # description = A list of processes that should not be launching cmd.exe
diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf
index aee06d31f3..82226aecc5 100644
--- a/dist/escu/default/workflow_actions.conf
+++ b/dist/escu/default/workflow_actions.conf
@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security_content
-# On Date: 2022-08-29T17:38:30 UTC
+# On Date: 2022-09-20T15:09:11 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
diff --git a/dist/escu/lookups/privileged_azure_ad_roles.csv b/dist/escu/lookups/privileged_azure_ad_roles.csv
new file mode 100644
index 0000000000..877df539cd
--- /dev/null
+++ b/dist/escu/lookups/privileged_azure_ad_roles.csv
@@ -0,0 +1,29 @@
+azureadrole,isprvilegedadrole,description
+"""Application Administrator""",True,Can create and manage all aspects of app registrations and enterprise apps.
+"""Authentication Administrator""",True,Can access to view, set and reset authentication method information for any non-admin user.
+"""Authentication Policy Administrator""",True,Can create and manage the authentication methods policy, tenant-wide MFA settings, password protection policy, and verifiable credentials.
+"""Azure AD Joined Device Local Administrator""",True,Users assigned to this role are added to the local administrators group on Azure AD-joined devices.
+"""Azure DevOps Administrator""",True,Can manage Azure DevOps policies and settings.
+"""Azure Information Protection Administrator""",True,Can manage all aspects of the Azure Information Protection product.
+"""Cloud Application Administrator""",True,Can create and manage all aspects of app registrations and enterprise apps except App Proxy.
+"""Cloud Device Administrator""",True,Limited access to manage devices in Azure AD.
+"""Compliance Administrator""",True,Can read and manage compliance configuration and reports in Azure AD and Microsoft 365.
+"""Conditional Access Administrator""",True,Can manage Conditional Access capabilities.
+"""Exchange Administrator""",True,Can manage all aspects of the Exchange product.
+"""External Identity Provider Administrator""",True,Can configure identity providers for use in direct federation.
+"""Groups Administrator""",True,Members of this role can create/manage groups, create/manage groups settings like naming and expiration policies, and view groups activity and audit reports.
+"""Helpdesk Administrator""",True,Can reset passwords for non-administrators and Helpdesk Administrators.
+"""Hybrid Identity Administrator""",True,Can manage AD to Azure AD cloud provisioning, Azure AD Connect, Pass-through Authentication (PTA), Password hash synchronization (PHS), Seamless Single sign-on (Seamless SSO), and federation settings.
+"""Intune Administrator""",True,Can manage all aspects of the Intune product.
+"""License Administrator""",True,Can manage product licenses on users and groups.
+"""Network Administrator""",True,Can manage network locations and review enterprise network design insights for Microsoft 365 Software as a Service applications.
+"""Password Administrator""",True,Can reset passwords for non-administrators and Password Administrators.
+"""Privileged Authentication Administrator""",True,Can access to view, set and reset authentication method information for any user (admin or non-admin).
+"""Privileged Role Administrator""",True,Can manage role assignments in Azure AD, and all aspects of Privileged Identity Management.
+"""Security Administrator""",True,Can read security information and reports, and manage configuration in Azure AD and Office 365.
+"""SharePoint Administrator""",True,Can manage all aspects of the SharePoint service.
+"""Teams Administrator""",True,Can manage the Microsoft Teams service.
+"""User Administrator""",True,Can manage all aspects of users and groups, including resetting passwords for limited admins.
+"""Windows 365 Administrator""",True,Can provision and manage all aspects of Cloud PCs.
+
+
diff --git a/docs/mitre-map/coverage.json b/docs/mitre-map/coverage.json
index eea320842e..36072b4590 100644
--- a/docs/mitre-map/coverage.json
+++ b/docs/mitre-map/coverage.json
@@ -31,8 +31,8 @@
         },
         {
             "techniqueID": "T1055",
-            "score": 20,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_with_namedpipe_commandline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml"
+            "score": 21,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_process_injection_forwarder_bundle_downloads.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cobalt_strike_named_pipes.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_in_shell_application.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/loading_of_dynwrapx_module.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_createremotethread_in_browser.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/trickbot_named_pipe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_injection_with_public_source_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_with_namedpipe_commandline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_assistance_spawning_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winhlp32_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml"
         },
         {
             "techniqueID": "T1001.003",
@@ -46,8 +46,8 @@
         },
         {
             "techniqueID": "T1078",
-            "score": 38,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_user_enumeration_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_powershell_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_computer_account_name_change.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_kerberos_service_ticket_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_ticket_granting_ticket_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_user_logins_from_multiple_cities.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_attach_to_role_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_permanent_key_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_role_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_sts_assume_role_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_detect_gcploit_framework.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unusual_number_of_computer_service_tickets_requested.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml"
+            "score": 40,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/application/splunk_user_enumeration_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_saml_update_identity_provider.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_powershell_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_runbook_webhook_created.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_activity_from_previously_unseen_city.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_activity_from_previously_unseen_country.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_provisioning_activity_from_previously_unseen_region.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/gcp_detect_oauth_token_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_excessive_user_account_lockouts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_computer_account_name_change.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_kerberos_service_ticket_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_ticket_granting_ticket_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_account_lockout_events.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_failed_sso_attempts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/okta_user_logins_from_multiple_cities.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_instances_launched.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_attach_to_role_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_permanent_key_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_role_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_detect_sts_assume_role_abuse.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gcp_detect_gcploit_framework.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unusual_number_of_computer_service_tickets_requested.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml"
         },
         {
             "techniqueID": "T1189",
@@ -56,18 +56,18 @@
         },
         {
             "techniqueID": "T1078.004",
-            "score": 21,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_powershell_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_instances_launched.yml"
+            "score": 23,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_setdefaultpolicyversion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_successful_powershell_authentication.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_runbook_webhook_created.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/cloud_instance_modified_by_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_api_calls_from_user_roles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_new_user_aws_console_login.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_aws_api_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/detect_spike_in_security_group_activity.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_instances_destroyed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/abnormally_high_number_of_cloud_instances_launched.yml"
         },
         {
             "techniqueID": "T1136.003",
-            "score": 6,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_external_guest_user_invited.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_service_principal_created.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_automation_account_created.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_automation_runbook_created.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml"
         },
         {
             "techniqueID": "T1136",
-            "score": 11,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___account_harvesting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
+            "score": 13,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createaccesskey.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_createloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_updateloginprofile.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_automation_account_created.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_automation_runbook_created.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_add_app_role_assignment_grant_user.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_added_service_principal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_new_federated_domain_added.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/web_fraud___account_harvesting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_local_admin_accounts_using_net_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_new_local_admin_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_add_user_account.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/short_lived_windows_accounts.yml"
         },
         {
             "techniqueID": "T1110.001",
@@ -126,8 +126,8 @@
         },
         {
             "techniqueID": "T1098",
-            "score": 5,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_ssh_key_file_creation.yml"
+            "score": 10,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_delete_policy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_failure_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/aws_iam_successful_group_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_privileged_role_assigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_service_principal_new_client_credentials.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_service_principal_owner_added.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_user_enabled_and_password_reset.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_ssh_key_file_creation.yml"
         },
         {
             "techniqueID": "T1069.003",
@@ -151,14 +151,34 @@
         },
         {
             "techniqueID": "T1621",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multiple_failed_mfa_requests_for_user.yml"
+        },
+        {
+            "techniqueID": "T1098.003",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_global_administrator_role_assigned.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_privileged_role_assigned.yml"
         },
         {
             "techniqueID": "T1556",
             "score": 3,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_disable_mfa.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/o365_excessive_sso_logon_errors.yml"
         },
+        {
+            "techniqueID": "T1484",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_new_custom_domain_added.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_new_federated_domain_added.yml"
+        },
+        {
+            "techniqueID": "T1484.002",
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_new_custom_domain_added.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_new_federated_domain_added.yml"
+        },
+        {
+            "techniqueID": "T1098.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/azure_ad_service_principal_new_client_credentials.yml"
+        },
         {
             "techniqueID": "T1003.002",
             "score": 8,
@@ -216,13 +236,13 @@
         },
         {
             "techniqueID": "T1566.001",
-            "score": 25,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_iso_lnk_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_office_product_spawning_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/suspicious_email_attachment_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml"
+            "score": 26,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_iso_lnk_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_office_product_spawning_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/suspicious_email_attachment_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml"
         },
         {
             "techniqueID": "T1566",
-            "score": 29,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_iso_lnk_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_office_product_spawning_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/suspicious_email_attachment_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gdrive_suspicious_file_sharing.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_calendar_invite.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml"
+            "score": 30,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_suspicious_subject_with_attachment.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_email_with_known_abuse_web_service_link.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_shared_file_name.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_email___uba_anomaly.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshtml_module_load_in_office_product.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_drop_executable.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_application_spawn_rundll32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_creating_schedule_task.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_executing_macro_code.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_document_spawned_child_process_to_download.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_bitsadmin.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_certutil.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_mshta.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawning_wmic.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_writing_cab_or_inf.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_iso_lnk_file_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_office_product_spawning_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_cmd.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/winword_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/application/suspicious_email_attachment_extensions.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gdrive_suspicious_file_sharing.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/cloud/gsuite_suspicious_calendar_invite.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml"
         },
         {
             "techniqueID": "T1048.003",
@@ -316,8 +336,8 @@
         },
         {
             "techniqueID": "T1218",
-            "score": 55,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_diskshadow_proxy_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml"
+            "score": 56,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/deprecated/suspicious_rundll32_rename.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/control_loading_from_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mshta_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_spawning_a_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_regsvr32_application_control_bypass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_rundll32_inline_hta_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/office_product_spawn_cmd_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_dnsquery.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_lockworkstation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_process_creating_exe_dll_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/rundll_loading_dll_by_ordinal.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_mshta_spawn.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_dllregisterserver.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_plugininit.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_startw.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/suspicious_rundll32_no_command_line_arguments.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uac_bypass_with_colorui_com_object.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/uninstall_app_using_msiexec.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/verclsid_clsid_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wbemprox_com_object_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_diskshadow_proxy_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_credential_theft.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_in_non_standard_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_remote_network_connection.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_uninstall_option_with_network.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_installutil_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_rasautou_dll_execution.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml"
         },
         {
             "techniqueID": "T1036",
@@ -346,8 +366,8 @@
         },
         {
             "techniqueID": "T1003",
-            "score": 28,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_access_to_credential_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_non_system_account_targeting_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_possible_credential_dumping.yml"
+            "score": 29,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/access_lsass_memory_for_dump_creation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attacker_tools_on_endpoint.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/create_remote_thread_into_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_credential_dumping_through_lsass_access.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_using_loaded_images.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_comsvcs_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/dump_lsass_via_procdump.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/esentutl_sam_copy.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_powershell.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excel_spawning_windows_script_host.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/extraction_of_registry_hives.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_possible_access_to_credential_files.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/ntdsutil_export_ntds.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/sam_database_file_access_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_hunting_system_account_targeting_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_non_system_account_targeting_lsass.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_possible_credential_dumping.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml"
         },
         {
             "techniqueID": "T1087.002",
@@ -566,8 +586,8 @@
         },
         {
             "techniqueID": "T1218.001",
-            "score": 4,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_renamed.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_spawn_child_process.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_url_in_command_line.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml"
         },
         {
             "techniqueID": "T1218.005",
@@ -581,8 +601,8 @@
         },
         {
             "techniqueID": "T1574",
-            "score": 7,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_preload_hijack_library_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/msi_module_loaded_by_non_system_binary.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_search_order_hijacking_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml"
+            "score": 8,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_preload_hijack_library_calls.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/msi_module_loaded_by_non_system_binary.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/msmpeng_application_dll_side_loading.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_search_order_hijacking_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml"
         },
         {
             "techniqueID": "T1016",
@@ -671,8 +691,8 @@
         },
         {
             "techniqueID": "T1489",
-            "score": 8,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stop_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_stop_by_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_valid_account_with_never_expires_password.yml"
+            "score": 9,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_attempt_to_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/excessive_service_stop_attempt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_disable_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_stop_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_processes_killed_by_industroyer2_malware.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_security_account_manager_stopped.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_deletion_in_registry.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_service_stop_by_deletion.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_valid_account_with_never_expires_password.yml"
         },
         {
             "techniqueID": "T1222",
@@ -726,8 +746,8 @@
         },
         {
             "techniqueID": "T1589",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberos_user_enumeration.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/kerberos_user_enumeration.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_gather_victim_identity_sam_info.yml"
         },
         {
             "techniqueID": "T1589.002",
@@ -846,8 +866,8 @@
         },
         {
             "techniqueID": "T1021.004",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_ssh_remote_services_script_execute.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/linux_ssh_remote_services_script_execute.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_protocol_tunneling_with_plink.yml"
         },
         {
             "techniqueID": "T1055.001",
@@ -881,8 +901,8 @@
         },
         {
             "techniqueID": "T1491",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/modification_of_wallpaper.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_defacement_modify_transcodedwallpaper_file.yml"
         },
         {
             "techniqueID": "T1547.010",
@@ -986,8 +1006,8 @@
         },
         {
             "techniqueID": "T1546.012",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml"
+            "score": 2,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/registry_keys_used_for_privilege_escalation.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_event_triggered_image_file_execution_options_injection.yml"
         },
         {
             "techniqueID": "T1113",
@@ -996,13 +1016,13 @@
         },
         {
             "techniqueID": "T1134",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/runas_execution_in_commandline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml"
+            "score": 5,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/runas_execution_in_commandline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml"
         },
         {
             "techniqueID": "T1134.001",
-            "score": 1,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/runas_execution_in_commandline.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/runas_execution_in_commandline.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_access_token_manipulation_winlogon_duplicate_token_handle.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml"
         },
         {
             "techniqueID": "T1546.002",
@@ -1039,6 +1059,11 @@
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_gather_victim_network_info_through_ip_check_web_services.yml"
         },
+        {
+            "techniqueID": "T1134.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml"
+        },
         {
             "techniqueID": "T1071",
             "score": 5,
@@ -1056,8 +1081,8 @@
         },
         {
             "techniqueID": "T1574.001",
-            "score": 3,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_search_order_hijacking_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml"
+            "score": 4,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_search_order_hijacking_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_search_order_hijacking_hunt_with_sysmon.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_hijack_execution_flow_version_dll_side_load.yml"
         },
         {
             "techniqueID": "T1218.004",
@@ -1069,11 +1094,26 @@
             "score": 1,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_gather_victim_host_information_camera.yml"
         },
+        {
+            "techniqueID": "T1589.001",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_gather_victim_identity_sam_info.yml"
+        },
         {
             "techniqueID": "T1202",
             "score": 2,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml"
         },
+        {
+            "techniqueID": "T1056.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml"
+        },
+        {
+            "techniqueID": "T1056",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_input_capture_using_credential_ui_dll.yml"
+        },
         {
             "techniqueID": "T1204.001",
             "score": 1,
@@ -1089,6 +1129,16 @@
             "score": 3,
             "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_odbcconf_hunting.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_odbcconf_load_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_odbcconf_load_response_file.yml"
         },
+        {
+            "techniqueID": "T1055.002",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_process_injection_with_public_source_path.yml"
+        },
+        {
+            "techniqueID": "T1572",
+            "score": 1,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_protocol_tunneling_with_plink.yml"
+        },
         {
             "techniqueID": "T1561.002",
             "score": 2,
@@ -1101,8 +1151,8 @@
         },
         {
             "techniqueID": "T1219",
-            "score": 2,
-            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_access_software_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_access_software_rms_registry.yml"
+            "score": 3,
+            "comment": "https://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_access_software_brc4_loaded_dll.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_access_software_hunt.yml\n\nhttps://github.com/splunk/security_content/blob/develop/detections/endpoint/windows_remote_access_software_rms_registry.yml"
         },
         {
             "techniqueID": "T1529",

From 986716a55f0615c2efa3ce66d943213c94592a52 Mon Sep 17 00:00:00 2001
From: Lou Stella <ljstella@gmail.com>
Date: Thu, 22 Sep 2022 09:20:02 -0500
Subject: [PATCH 29/29] IceID -> IcedID

---
 .../endpoint/disable_defender_antivirus_registry.yml   |  8 ++++----
 .../disable_defender_blockatfirstseen_feature.yml      | 10 +++++-----
 .../disable_defender_enhanced_notification.yml         | 10 +++++-----
 .../endpoint/disable_defender_mpengine_registry.yml    |  8 ++++----
 .../endpoint/disable_defender_spynet_reporting.yml     |  8 ++++----
 ...disable_defender_submit_samples_consent_feature.yml |  8 ++++----
 detections/endpoint/disable_schedule_task.yml          |  2 +-
 detections/endpoint/disabling_defender_services.yml    |  2 +-
 .../suspicious_regsvr32_register_suspicious_path.yml   |  2 +-
 detections/endpoint/suspicious_rundll32_plugininit.yml |  2 +-
 .../windows_curl_download_to_suspicious_path.yml       |  2 +-
 .../wmic_noninteractive_app_uninstallation.yml         |  4 ++--
 .../ssa___disable_defender_antivirus_registry.yml      |  2 +-
 13 files changed, 34 insertions(+), 34 deletions(-)

diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml
index 4508894ffc..1b87b6e3f7 100644
--- a/detections/endpoint/disable_defender_antivirus_registry.yml
+++ b/detections/endpoint/disable_defender_antivirus_registry.yml
@@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This particular behavior is typically executed when an adversaries or
-  malware gains access to an endpoint and beings to perform execution and to evade
-  detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
+description: This particular behavior is typically executed when an adversary or
+  malware gains access to an endpoint and begins to perform execution and to evade
+  detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled
   task modifications will occur. During triage, review parallel processes and identify
   any further file modifications. Endpoint should be isolated.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
@@ -33,7 +33,7 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   - Windows Registry Abuse
   confidence: 70
   context:
diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
index 0d0c0f0518..ede167e758 100644
--- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
+++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml
@@ -6,10 +6,10 @@ author: Teoderick Contreras
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious modification of registry to disable
-  windows defender feature. This technique is to bypassed or evade detection from
-  Windows Defender AV product specially the BlockAtFirstSeen feature where it block
-  suspicious file first seen in the host.
+description: This analytic is intended to detect a suspicious modification of the Windows registry to disable
+  a Windows Defender feature. This technique is intended to bypass or evade detection from
+  Windows Defender AV, specifically the BlockAtFirstSeen feature where it blocks
+  suspicious files the first time seen on the host.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name
   = DisableBlockAtFirstSeen Registry.registry_value_data = 0x00000001 by _time span=1h
@@ -32,7 +32,7 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   - Windows Registry Abuse
   - Azorult
   confidence: 70
diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml
index c0a2da5e5f..0af4d6d4bf 100644
--- a/detections/endpoint/disable_defender_enhanced_notification.yml
+++ b/detections/endpoint/disable_defender_enhanced_notification.yml
@@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious modification of registry to disable
-  windows defender feature. This technique is to bypassed or evade detection from
-  Windows Defender AV product specially the Enhanced Notification feature wher user
-  or admin set to show or display alerts.
+description: This analytic is intended to detect a suspicious modification of registry to disable
+  windows defender features. This technique attempts to bypass or evade detection from
+  Windows Defender AV, specifically the Enhanced Notification feature where a user
+  or admin would receive alerts.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path = "*Microsoft\\Windows Defender\\Reporting*" Registry.registry_value_name
   = DisableEnhancedNotifications Registry.registry_value_data = 0x00000001 by _time
@@ -32,7 +32,7 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   - Windows Registry Abuse
   - Azorult
   confidence: 70
diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml
index e615625cef..eadc698c90 100644
--- a/detections/endpoint/disable_defender_mpengine_registry.yml
+++ b/detections/endpoint/disable_defender_mpengine_registry.yml
@@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This particular behavior is typically executed when an adversaries or
-  malware gains access to an endpoint and beings to perform execution and to evade
-  detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled
+description: This particular behavior is typically executed when an adversary or
+  malware gains access to an endpoint and begins to perform execution and to evade
+  detections. Usually, a batch (.bat) file will be executed and multiple registry and scheduled
   task modifications will occur. During triage, review parallel processes and identify
   any further file modifications. Endpoint should be isolated.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
@@ -33,7 +33,7 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   - Windows Registry Abuse
   confidence: 70
   context:
diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml
index fdf6f86f27..b8bd66a4da 100644
--- a/detections/endpoint/disable_defender_spynet_reporting.yml
+++ b/detections/endpoint/disable_defender_spynet_reporting.yml
@@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious modification of registry to disable
-  windows defender feature. This technique is to bypassed or evade detection from
-  Windows Defender AV product specially the spynet reporting for its telemetry.
+description: This analytic is intended to detect a suspicious modification of registry to disable
+  Windows Defender feature. This technique is intended to bypass or evade detection from
+  Windows Defender AV product, specifically the spynet reporting for Defender telemetry.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name
   = SpynetReporting Registry.registry_value_data = 0x00000000 by _time span=1h Registry.dest
@@ -31,7 +31,7 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   - Windows Registry Abuse
   - Azorult
   confidence: 70
diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
index e6444b3401..516d974a65 100644
--- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
+++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml
@@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to detect a suspicious modification of registry to disable
-  windows defender feature. This technique is to bypassed or evade detection from
-  Windows Defender AV product specially the submit samples feature for further analysis..
+description: This analytic is intended to detect a suspicious modification of the Windows registry to disable
+  a Windows Defender feature. This technique is intended to bypass or evade detection from
+  Windows Defender AV, specifically the feature that submits samples for further analysis.
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry
   where Registry.registry_path = "*\\Microsoft\\Windows Defender\\SpyNet*" Registry.registry_value_name
   = SubmitSamplesConsent Registry.registry_value_data = 0x00000000 by _time span=1h
@@ -31,7 +31,7 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   - Windows Registry Abuse
   - Azorult
   confidence: 70
diff --git a/detections/endpoint/disable_schedule_task.yml b/detections/endpoint/disable_schedule_task.yml
index d222d57b32..5557698c0c 100644
--- a/detections/endpoint/disable_schedule_task.yml
+++ b/detections/endpoint/disable_schedule_task.yml
@@ -7,7 +7,7 @@ type: TTP
 datamodel:
 - Endpoint
 description: This analytic is to detect a suspicious commandline to disable existing
-  schedule task. This technique is used by adversaries or commodity malware like IceID
+  schedule task. This technique is used by adversaries or commodity malware like IcedID
   to disable security application (AV products) in the targetted host to evade detections.
   This TTP is a good pivot to check further why and what other process run before
   and after this detection. check which process execute the commandline and what task
diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml
index 8d7c5fc76e..e82bdcb7b3 100644
--- a/detections/endpoint/disabling_defender_services.yml
+++ b/detections/endpoint/disabling_defender_services.yml
@@ -34,7 +34,7 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   - Windows Registry Abuse
   confidence: 70
   context:
diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
index 5bee38d8e6..ccf975cf98 100644
--- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
+++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml
@@ -37,7 +37,7 @@ references:
 tags:
   analytic_story:
   - Suspicious Regsvr32 Activity
-  - Iceid
+  - Icedid
   - Living Off The Land
   asset_type: Endpoint
   cis20:
diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml
index d0ebb2b3e7..cede6d0a8a 100644
--- a/detections/endpoint/suspicious_rundll32_plugininit.yml
+++ b/detections/endpoint/suspicious_rundll32_plugininit.yml
@@ -7,7 +7,7 @@ type: TTP
 datamodel:
 - Endpoint
 description: This search is to detect a suspicious rundll32.exe process with plugininit
-  parameter. This technique is commonly seen in IceID malware to execute its initial
+  parameter. This technique is commonly seen in IcedID malware to execute its initial
   dll stager to download another payload to the compromised machine.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*PluginInit*
diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
index f49e493d6a..abd97200a0 100644
--- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml
+++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml
@@ -34,7 +34,7 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   - Ingress Tool Transfer
   confidence: 100
   context:
diff --git a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
index b8c8dc98d8..f5988a8cd5 100644
--- a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
+++ b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml
@@ -7,7 +7,7 @@ type: Hunting
 datamodel:
 - Endpoint
 description: This analytic indentifies WMIC command-line attempting to uninstall
-  application non-interactively. This technique was seen in IceID to uninstall AV
+  application non-interactively. This technique was seen in IcedID to uninstall AV
   products on the compromised host to evade detection. This Hunting
   query maybe a good indicator that some process tries to uninstall application using
   wmic which is not a common behavior. This approach may seen in some script or third
@@ -31,7 +31,7 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   - Azorult
   confidence: 50
   context:
diff --git a/detections/experimental/endpoint/ssa___disable_defender_antivirus_registry.yml b/detections/experimental/endpoint/ssa___disable_defender_antivirus_registry.yml
index 403547a5c0..cdf5bb40e0 100644
--- a/detections/experimental/endpoint/ssa___disable_defender_antivirus_registry.yml
+++ b/detections/experimental/endpoint/ssa___disable_defender_antivirus_registry.yml
@@ -32,7 +32,7 @@ references:
 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
 tags:
   analytic_story:
-  - IceID
+  - IcedID
   automated_detection_testing: passed
   confidence: 70
   context: