diff --git a/bin/docker_detection_tester/detection_testing_execution.py b/bin/docker_detection_tester/detection_testing_execution.py
index ecb592a413..c91bfcdb7e 100644
--- a/bin/docker_detection_tester/detection_testing_execution.py
+++ b/bin/docker_detection_tester/detection_testing_execution.py
@@ -1,7 +1,7 @@
 import argparse
 import copy
 import csv
-from ctypes.wintypes import tagRECT
+# from ctypes.wintypes import tagRECT
 import json
 import os
 import queue
diff --git a/detections/cloud/aws_credential_access_failed_login.yml b/detections/cloud/aws_credential_access_failed_login.yml
index dea0c9dfa6..f3ba0c78a0 100644
--- a/detections/cloud/aws_credential_access_failed_login.yml
+++ b/detections/cloud/aws_credential_access_failed_login.yml
@@ -15,7 +15,7 @@ references:
 - https://attack.mitre.org/techniques/T1110/001/
 tags:
   analytic_story:
-  - AWS Credential Access
+  - AWS Identity and Access Management Account Takeover
   asset_type: AWS Account
   cis20:
   - CIS 3
diff --git a/detections/cloud/aws_credential_access_getpassworddata.yml b/detections/cloud/aws_credential_access_getpassworddata.yml
index 8b3402e2e1..4985d40b74 100644
--- a/detections/cloud/aws_credential_access_getpassworddata.yml
+++ b/detections/cloud/aws_credential_access_getpassworddata.yml
@@ -15,7 +15,7 @@ references:
 - https://stratus-red-team.cloud/attack-techniques/AWS/aws.credential-access.ec2-get-password-data/
 tags:
   analytic_story:
-  - AWS Credential Access
+  - AWS Identity and Access Management Account Takeover
   asset_type: AWS Account
   cis20:
   - CIS 3
diff --git a/detections/cloud/aws_credential_access_rds_password_reset.yml b/detections/cloud/aws_credential_access_rds_password_reset.yml
index 7346657dec..0ba6b0bf6c 100644
--- a/detections/cloud/aws_credential_access_rds_password_reset.yml
+++ b/detections/cloud/aws_credential_access_rds_password_reset.yml
@@ -17,7 +17,7 @@ references:
 - https://aws.amazon.com/premiumsupport/knowledge-center/reset-master-user-password-rds
 tags:
   analytic_story:
-  - AWS Credential Access
+  - AWS Identity and Access Management Account Takeover
   asset_type: AWS Account
   cis20:
   - CIS 3
diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml
new file mode 100644
index 0000000000..37311ef681
--- /dev/null
+++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml
@@ -0,0 +1,61 @@
+name: AWS Multiple Users Failing To Authenticate From Ip
+id: 71e1fb89-dd5f-4691-8523-575420de4630
+version: 1
+date: '2022-09-27'
+author: Bhavin Patel
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies one source Ip failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. 
+search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats  dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent |  where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
+how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment.
+known_false_positives: No known false postives for this detection. Please review this alert
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/
+- https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/
+tags:
+  analytic_story:
+  - AWS Identity and Access Management Account Takeover
+  asset_type: AWS Account
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Outcome:Blocked
+  - Stage:Recon
+  - Other:Brute Force
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: Multiple failed console login attempts against users $tried_accounts$ seen from $src_ip$
+  mitre_attack_id:
+  - T1003.002
+  nist:
+  - DE.CM
+  observable:
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: tried_accounts
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - user
+  - action
+  - eventName
+  - src_ip
+  risk_score: 54
+  security_domain: threat
diff --git a/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml
new file mode 100644
index 0000000000..a43bc7e2b3
--- /dev/null
+++ b/detections/cloud/aws_unusual_number_of_failed_authentications_from_ip.yml
@@ -0,0 +1,65 @@
+name: AWS Unusual Number of Failed Authentications From Ip
+id: 0b5c9c2b-e2cb-4831-b4f1-af125ceb1386
+version: 1
+date: '2022-09-26'
+author: Bhavin Patel, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies one source IP failing to authenticate into the AWS Console with multiple valid users. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment to obtain initial access or elevate privileges. 
+  The detection calculates the standard deviation for source IP and leverages the 3-sigma statistical rule to identify an unusual number of failed authentication attempts. To customize this analytic, users can try different combinations of the bucket span time and the calculation of the upperBound field. This logic can be used for real time security monitoring as well as threat hunting exercises. 
+  While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage. A similar analytic following the threshold model is `AWS Multiple Users Failing To Authenticate From Ip`.
+search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats  dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip
+| eventstats  avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by src_ip 
+| eval  upperBound=(ip_avg+ip_std*3) 
+| eval  isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier = 1 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
+how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the calculation of the upperBound field to tune this search according to their environment
+known_false_positives: No known false postives for this detection. Please review this alert
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/
+- https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/
+tags:
+  analytic_story:
+  - AWS Identity and Access Management Account Takeover
+  asset_type: AWS Account
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Outcome:Blocked
+  - Stage:Recon
+  - Other:Brute Force
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: Unusual number of failed console login attempts against users $tried_accounts$ seen from $src_ip$
+  mitre_attack_id:
+  - T1003.002
+  nist:
+  - DE.CM
+  observable:
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: tried_accounts
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - user
+  - action
+  - eventName
+  - src_ip
+  risk_score: 54
+  security_domain: threat
diff --git a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml
index 21b7bab24b..671367235c 100644
--- a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml
+++ b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml
@@ -8,7 +8,7 @@ datamodel: []
 description: The following analytic identifies an attempt to disable multi-factor authentication for an Azure AD user. An adversary who has obtained access to an Azure AD tenant 
   may disable multi-factor authentication as a way to plant a backdoor and maintain persistence using a valid account.
   This way the attackers can keep persistance in the environment without adding new users.
-search: '`azuread` "body.operationName"="Disable Strong Authentication" 
+search: '`azuread` body.category=AuditLogs body.operationName="Disable Strong Authentication" 
   | rename body.properties.* as *
   | rename targetResources{}.userPrincipalName as userPrincipalName
   | rename targetResources{}.type as type
diff --git a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml
index 62c94fce3a..5b50c35122 100644
--- a/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml
+++ b/detections/cloud/azure_ad_multiple_users_failing_to_authenticate_from_ip.yml
@@ -11,14 +11,14 @@ description: 'The following analytic identifies one source Ip failing to authent
 
   Azure AD tenants can be very different depending on the organization. Users should test this detection and customize the arbitrary threshold if needed.'
 
-search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignInLogs body.properties.authenticationDetails{}.succeeded= false 
+search: ' `azuread` body.category= SignInLogs body.properties.status.errorCode=50126 body.properties.authenticationDetails{}.succeeded= false 
   | rename body.properties.* as *
   | bucket span=5m _time
   | stats  dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress
   | where unique_accounts > 30
   | `azure_ad_multiple_users_failing_to_authenticate_from_ip_filter`'
 how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). 
-  You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the AuditLogs.
+  You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs
   log category.
 known_false_positives: A source Ip failing to authenticate with multiple users is not a common for legitimate behavior.
 references:
diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml
index ded1815871..6759e7ce17 100644
--- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml
+++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml
@@ -18,13 +18,13 @@ description: 'The following analytic identifies one source Ip failing to authent
   While looking for anomalies using statistical methods like the standard deviation can have benefits, we also recommend using threshold-based detections to complement coverage.
   A similar analytic following the threshold model is `Azure AD Multiple Users Failing To Authenticate From Ip`.'
 
-search: ' `azuread` body.properties.status.errorCode= 50126 body.category= SignInLogs body.properties.authenticationDetails{}.succeeded= false 
+search: ' `azuread` body.category=SignInLogs body.properties.status.errorCode=50126 body.properties.authenticationDetails{}.succeeded= false 
   | rename body.properties.* as *
   | bucket span=5m _time
   | stats  dc(userPrincipalName) AS unique_accounts values(userPrincipalName) as tried_accounts by _time, ipAddress
   | eventstats  avg(unique_accounts) as ip_avg , stdev(unique_accounts) as ip_std by ipAddress
   | eval  upperBound=(ip_avg+ip_std*3)
-  | eval  isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
+  | eval  isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | where isOutlier = 1
   | `azure_ad_unusual_number_of_failed_authentications_from_ip_filter`'
 how_to_implement: You must install the latest version of  Splunk Add-on for Microsoft Cloud Services from  Splunkbase(https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events in your Splunk environment. Specifically, this analytic leverages the SignInLogs
   log category.
diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml
index 268265bc68..53bb8272de 100644
--- a/detections/cloud/detect_aws_console_login_by_new_user.yml
+++ b/detections/cloud/detect_aws_console_login_by_new_user.yml
@@ -1,6 +1,6 @@
 name: Detect AWS Console Login by New User
 id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71
-version: 2
+version: 3
 date: '2022-05-10'
 author: Rico Valdez, Splunk
 type: Hunting
@@ -13,7 +13,7 @@ description: This search looks for AWS CloudTrail events wherein a console login
   the last hour
 search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication
   where Authentication.signature=ConsoleLogin by Authentication.user | `drop_dm_object_name(Authentication)`
-  | join user type=outer [ inputlookup previously_seen_users_console_logins | stats
+  | join user type=outer [ | inputlookup previously_seen_users_console_logins | stats
   min(firstTime) as earliestseen by user] | eval userStatus=if(earliestseen >= relative_time(now(),
   "-24h@h") OR isnull(earliestseen), "First Time Logging into AWS Console", "Previously
   Seen User") | where userStatus="First Time Logging into AWS Console" | `security_content_ctime(firstTime)`
@@ -32,10 +32,12 @@ references: []
 tags:
   analytic_story:
   - Suspicious Cloud Authentication Activities
-  - AWS Credential Access
+  - AWS Identity and Access Management Account Takeover
   asset_type: AWS Instance
   cis20:
   - CIS 16
+  mitre_attack_id:
+  - T1552
   confidence: 60
   context:
   - Source:Cloud Data
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
index e1f112c9d6..497e808482 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml
@@ -44,7 +44,7 @@ tags:
   analytic_story:
   - Suspicious AWS Login Activities
   - Suspicious Cloud Authentication Activities
-  - AWS Credential Access
+  - AWS Identity and Access Management Account Takeover
   asset_type: AWS Instance
   cis20:
   - CIS 16
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
index 2f1fe53c8a..58211f1cc2 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml
@@ -45,7 +45,7 @@ tags:
   analytic_story:
   - Suspicious AWS Login Activities
   - Suspicious Cloud Authentication Activities
-  - AWS Credential Access
+  - AWS Identity and Access Management Account Takeover
   asset_type: AWS Instance
   cis20:
   - CIS 16
diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
index f6ac8156d4..b423a1574d 100644
--- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
+++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml
@@ -44,7 +44,7 @@ tags:
   analytic_story:
   - Suspicious AWS Login Activities
   - Suspicious Cloud Authentication Activities
-  - AWS Credential Access
+  - AWS Identity and Access Management Account Takeover
   asset_type: AWS Instance
   cis20:
   - CIS 16
diff --git a/stories/aws_credential_access.yml b/stories/aws_credential_access.yml
deleted file mode 100644
index 24ae012a03..0000000000
--- a/stories/aws_credential_access.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-name: AWS Credential Access
-id: 4210b690-293f-411d-a9d8-bcfb2ea5fff9
-version: 1
-date: '2022-08-19'
-author: Gowthamaraj Rajendran, Bhavin Patel,  Splunk
-description: Identify activity and techniques associated with accessing credential files from AWS resources, monitor unusual authentication related activities to the AWS Console and other services such as RDS.
-narrative: Adversaries employ a variety of techniques to steal AWS Cloud credentials like account names, passwords and keys. Usage of legitimate keys will assist the attackers to gain access to other sensitive system and they can also mimic legitimate behaviour making them harder to be detected. Such activity may involve mulitple failed login to the console, new console logins and password reset activities.
-references:
-- https://attack.mitre.org/tactics/TA0006/
-tags:
-  analytic_story: AWS Credential Access
-  category:
-  - Cloud Security
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  usecase: Security Monitoring
diff --git a/stories/aws_identity_and_access_management_account_takeover.yml b/stories/aws_identity_and_access_management_account_takeover.yml
new file mode 100644
index 0000000000..33dd525e2d
--- /dev/null
+++ b/stories/aws_identity_and_access_management_account_takeover.yml
@@ -0,0 +1,19 @@
+name: AWS Identity and Access Management Account Takeover
+id: 4210b690-293f-411d-a9d8-bcfb2ea5fff9
+version: 2
+date: '2022-08-19'
+author: Gowthamaraj Rajendran, Bhavin Patel,  Splunk
+description: Identify activity and techniques associated with accessing credential files from AWS resources, monitor unusual authentication related activities to the AWS Console and other services such as RDS.
+narrative: Amazon Web Services provides a web service known as Identity and Access Management(IAM) for controlling and securly managing various AWS resources. This is basically the foundation of how users in AWS interact with various resources/services in cloud and vice versa. Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. 
+  Adversaries employ a variety of techniques to steal AWS Cloud credentials like account names, passwords and keys and takeover legitmate user accounts. Usage of legitimate keys will assist the attackers to gain access to other sensitive system and they can also mimic legitimate behaviour making them harder to be detected. Such activity may involve multiple failed login to the console, new console logins and password reset activities.
+references:
+- https://attack.mitre.org/tactics/TA0006/
+tags:
+  analytic_story: AWS Identity and Access Management Account Takeover
+  category:
+  - Cloud Security
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Security Monitoring
diff --git a/tests/cloud/aws_multiple_users_failing_to_authenticate_from_ip.test.yml b/tests/cloud/aws_multiple_users_failing_to_authenticate_from_ip.test.yml
new file mode 100644
index 0000000000..f610876bef
--- /dev/null
+++ b/tests/cloud/aws_multiple_users_failing_to_authenticate_from_ip.test.yml
@@ -0,0 +1,13 @@
+name: AWS Multiple Users Failing To Authenticate From Ip Unit Test
+tests:
+- name: AWS Multiple Users Failing To Authenticate From Ip
+  file: cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: aws_cloudtrail.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json
+    source: aws_cloudtrail
+    sourcetype: aws:cloudtrail
+    update_timestamp: true
diff --git a/tests/cloud/aws_unusual_number_of_failed_authentications_from_ip.test.yml b/tests/cloud/aws_unusual_number_of_failed_authentications_from_ip.test.yml
new file mode 100644
index 0000000000..e1d36861c5
--- /dev/null
+++ b/tests/cloud/aws_unusual_number_of_failed_authentications_from_ip.test.yml
@@ -0,0 +1,13 @@
+name: AWS Unusual Number of Failed Authentications From Ip Unit Test
+tests:
+- name: AWS Unusual Number of Failed Authentications From Ip
+  file: cloud/aws_unusual_number_of_failed_authentications_from_ip.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -7d
+  latest_time: now
+  attack_data:
+  - file_name: aws_cloudtrail.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json
+    source: aws_cloudtrail
+    sourcetype: aws:cloudtrail
+    update_timestamp: true